Author: permaine Date: 2008-01-25 09:21:26 -0500 (Fri, 25 Jan 2008) New Revision: 7234 Added: branches/Seam_1_2_1_AP/examples/remoting/chatroom/resources/chatroom-service.xml.mq Modified: branches/Seam_1_2_1_AP/src/main/org/jboss/seam/framework/Query.java Log: JBPAPP-512 Added: branches/Seam_1_2_1_AP/examples/remoting/chatroom/resources/chatroom-service.xml.mq =================================================================== --- branches/Seam_1_2_1_AP/examples/remoting/chatroom/resources/chatroom-service.xml.mq (rev 0) +++ branches/Seam_1_2_1_AP/examples/remoting/chatroom/resources/chatroom-service.xml.mq 2008-01-25 14:21:26 UTC (rev 7234) @@ -0,0 +1,18 @@ +<server> + + <mbean code="org.jboss.mq.server.jmx.Topic" + name="jboss.mq.destination:service=Topic,name=chatroomTopic"> + <depends optional-attribute-name="DestinationManager">jboss.mq:service=DestinationManager</depends> + <depends optional-attribute-name="SecurityManager">jboss.mq:service=SecurityManager</depends> + <attribute name="SecurityConf"> + <security> + <role name="guest" read="true" write="true"/> + <role name="publisher" read="true" write="true" create="false"/> + + <role name="durpublisher" read="true" write="true" create="true"/> + </security> + </attribute> + </mbean> + +</server> + Modified: branches/Seam_1_2_1_AP/src/main/org/jboss/seam/framework/Query.java =================================================================== --- branches/Seam_1_2_1_AP/src/main/org/jboss/seam/framework/Query.java 2008-01-25 13:45:17 UTC (rev 7233) +++ branches/Seam_1_2_1_AP/src/main/org/jboss/seam/framework/Query.java 2008-01-25 14:21:26 UTC (rev 7234) @@ -30,6 +30,9 @@ private static final Pattern ORDER_PATTERN = Pattern.compile("\\s(order)(\\s)+by\\s", Pattern.CASE_INSENSITIVE); private static final Pattern WHERE_PATTERN = Pattern.compile("\\s(where)\\s", Pattern.CASE_INSENSITIVE); + private static final Pattern ORDER_CLAUSE_PATTERN = Pattern.compile("^[\\w\\.,\\s]*$"); + + private String ejbql; private Integer firstResult; private Integer maxResults; @@ -259,7 +262,11 @@ public void setOrder(String order) { + if (order!= null && !ORDER_CLAUSE_PATTERN.matcher(order).find()) { + throw new IllegalArgumentException("invalid order clause"); + } this.order = order; + refresh(); } protected List<ValueBinding> getQueryParameters()