Hey All, First - The seam examples that are linked off of seamframwork.org's "See Seam in Action..." section: where are they hosted? where can I find more information on them (seam version?, persistence config? etc...)? and how can we change/update them? The main reason I ask is because it appears the DVD example is having some sort of persistence config issue. Selecting "Start Shopping" throws a JDBC error. A user reported it, but I thought I remember Pete saying that those demos were a little out of date. Second - The user wanted to send me an email because he thought he saw a security issue (see below) where previous users information was displayed in one of the text fields. I asked him to put a jira in and that we would look into it. Does this sound familiar to anyone? Thanks, Jay -------- Original Message -------- Subject: Re: Adam R. SeamFramework.org Date: Mon, 25 Feb 2008 10:48:25 -0500 From: Jay Balunas <jbalunas(a)redhat.com&gt; To: A R <adamr_98(a)yahoo.com&gt; References: <460081.70615.qm(a)web50906.mail.re2.yahoo.com&gt; Hi Adam, Thanks for providing this information - I will take a look at the example. But - if you could enter a jira with this information (and any other info about it) that would be great. That way this can be tracked and commented on. When you say "other user sessions" do you mean other users that are currently logged in, or a user that you had previously been logged in as? If it is the latter - Does it appear that you are logged in as the user now and can access things as that user? Thanks, Jay A R wrote: > Adam R. SeamFramework.org > > jbalunas(a)redhat.com > > Hi Jay, > > The on-line dvd store demo has some database > configuration issues. > > However, an apparent security related issue has been > observed. > > Nutshell description: The Username text input box in > the Login panel displays information entered from > other users' sessions. > > I've been able to reproduce this observation on > numerous attempts typically in less than five (5) > minutes of "banging" on the application. > > At first I thought it was just browser caching and > indeed anybody else will ignore it because they will > see things like "User1", "User2" etc. And make the > assumption that it is the way the app is supposed to > run because the instructions hint to that behavior. > > I am able to consistently duplicate a test that > consists of visiting the site from a connection in San > Jose California, and entering the Username "sanjose". > I'm then able to visit the site from a different > connection, computer, and browser in Berkeley > California and see "sanjose" in the Username field. > > I do not have a recipe for reproducing the result. My > test consists of miscellaneous "banging" on the > following few items (in no order): > > -Entering Username and then failing the app (Start > Shopping). > -Many fast reloads (sometimes around 50). > -Clicking on the Login and/or Create Account buttons. > -Multiple tabbed sessions. > > My personal concern is that, the above > misconfiguration is not the reason for the security > violation. It is however exposing an unexpected > failure mode that might otherwise be hidden. My > recommendation is not to fix the configuration issues > until this failure is understood. > > Let me know if I can provide any additional > information. > > Regards, > AdamR. > > > > > _______________________________________________ seam-dev mailing list seam-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/seam-dev

On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote: > First - The seam examples that are linked off of seamframwork.org's > "See Seam in Action..." section: where are they hosted? where can I > find more information on them (seam version?, persistence config? > etc...)? and how can we change/update them? > > The main reason I ask is because it appears the DVD example is > having some sort of persistence config issue. Selecting "Start > Shopping" throws a JDBC error. A user reported it, but I thought I > remember Pete saying that those demos were a little out of date. > > Second - The user wanted to send me an email because he thought he > saw a security issue (see below) where previous users information > was displayed in one of the text fields. I asked him to put a jira > in and that we would look into it. Does this sound familiar to > anyone? It is running on demo.jboss.com and needs to be taken down. It's running with other demos on an old version of JBoss. We are not able to upgrade the JBoss version for fear of messing up the other demos. At one time we had access to the JBoss instance on that machine from the demo account, but the last time I tried to administer it I found the JBoss instance was running as root and we couldn't reset it. IT, as usual, was unresponsive. We really need to remove the links to that demo machine. _______________________________________________ seam-dev mailing list seam-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/seam-dev

It is running on demo.jboss.com and needs to be taken down. It's running with other demos on an old version of JBoss. We are not able to upgrade the JBoss version for fear of messing up the other demos. At one time we had access to the JBoss instance on that machine from the demo account, but the last time I tried to administer it I found the JBoss instance was running as root and we couldn't reset it. IT, as usual, was unresponsive. We really need to remove the links to that demo machine.

Do we have a ticket with IT to get the demos removed and replaced with a html page saying "Unavailable, please follow the getting started instructions to run this demo"? If so, what number is it? On 25/02/2008, Norman Richards <orb(a)nostacktrace.com&gt; wrote: > > On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote: > > > First - The seam examples that are linked off of seamframwork.org's > > "See Seam in Action..." section: where are they hosted? where can I > > find more information on them (seam version?, persistence config? > > etc...)? and how can we change/update them? > > > > The main reason I ask is because it appears the DVD example is > > having some sort of persistence config issue. Selecting "Start > > Shopping" throws a JDBC error. A user reported it, but I thought I > > remember Pete saying that those demos were a little out of date. > > > > Second - The user wanted to send me an email because he thought he > > saw a security issue (see below) where previous users information > > was displayed in one of the text fields. I asked him to put a jira > > in and that we would look into it. Does this sound familiar to > > anyone? > > > It is running on demo.jboss.com and needs to be taken down. It's > running with other demos on an old version of JBoss. We are not able > to upgrade the JBoss version for fear of messing up the other demos. > At one time we had access to the JBoss instance on that machine from > the demo account, but the last time I tried to administer it I found > the JBoss instance was running as root and we couldn't reset it. IT, > as usual, was unresponsive. > > We really need to remove the links to that demo machine. > > > _______________________________________________ > seam-dev mailing list > seam-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/seam-dev > -- Pete Muir http://in.relation.to/Bloggers/Pete http://www.seamframework.org _______________________________________________ seam-dev mailing list seam-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/seam-dev

I have not heard from anyone if there is an existing ticket for the demos so I opened a new one. Here is the email and ticket information: