10:05 a.m.
Hey All,
First - The seam examples that are linked off of seamframwork.org's "See
Seam in Action..." section: where are they hosted? where can I find
more information on them (seam version?, persistence config? etc...)?
and how can we change/update them?
The main reason I ask is because it appears the DVD example is having
some sort of persistence config issue. Selecting "Start Shopping"
throws a JDBC error. A user reported it, but I thought I remember Pete
saying that those demos were a little out of date.
Second - The user wanted to send me an email because he thought he saw a
security issue (see below) where previous users information was
displayed in one of the text fields. I asked him to put a jira in and
that we would look into it. Does this sound familiar to anyone?
Thanks,
Jay
-------- Original Message --------
Subject: Re: Adam R. SeamFramework.org
Date: Mon, 25 Feb 2008 10:48:25 -0500
From: Jay Balunas <jbalunas(a)redhat.com>
To: A R <adamr_98(a)yahoo.com>
References: <460081.70615.qm(a)web50906.mail.re2.yahoo.com>
Hi Adam,
Thanks for providing this information - I will take a look at the example.
But - if you could enter a jira with this information (and any other
info about it) that would be great. That way this can be tracked and
commented on.
When you say "other user sessions" do you mean other users that are
currently logged in, or a user that you had previously been logged in
as? If it is the latter - Does it appear that you are logged in as the
user now and can access things as that user?
Thanks,
Jay
A R wrote:
Adam R. SeamFramework.org
jbalunas(a)redhat.com
Hi Jay,
The on-line dvd store demo has some database
configuration issues.
However, an apparent security related issue has been
observed.
Nutshell description: The Username text input box in
the Login panel displays information entered from
other users’ sessions.
I’ve been able to reproduce this observation on
numerous attempts typically in less than five (5)
minutes of “banging” on the application.
At first I thought it was just browser caching and
indeed anybody else will ignore it because they will
see things like “User1”, “User2” etc. And make the
assumption that it is the way the app is supposed to
run because the instructions hint to that behavior.
I am able to consistently duplicate a test that
consists of visiting the site from a connection in San
Jose California, and entering the Username “sanjose”.
I’m then able to visit the site from a different
connection, computer, and browser in Berkeley
California and see “sanjose” in the Username field.
I do not have a recipe for reproducing the result. My
test consists of miscellaneous “banging” on the
following few items (in no order):
-Entering Username and then failing the app (Start
Shopping).
-Many fast reloads (sometimes around 50).
-Clicking on the Login and/or Create Account buttons.
-Multiple tabbed sessions.
My personal concern is that, the above
misconfiguration is not the reason for the security
violation. It is however exposing an unexpected
failure mode that might otherwise be hidden. My
recommendation is not to fix the configuration issues
until this failure is understood.
Let me know if I can provide any additional
information.
Regards,
AdamR.
1:16 p.m.
These demo servers have a very out of date jboss install IIRC. And we
don't have access to it to update/restart it.
On 25/02/2008, Jay Balunas <jbalunas(a)redhat.com> wrote:
Hey All,
First - The seam examples that are linked off of seamframwork.org's "See
Seam in Action..." section: where are they hosted? where can I find
more information on them (seam version?, persistence config? etc...)?
and how can we change/update them?
The main reason I ask is because it appears the DVD example is having
some sort of persistence config issue. Selecting "Start Shopping"
throws a JDBC error. A user reported it, but I thought I remember Pete
saying that those demos were a little out of date.
Second - The user wanted to send me an email because he thought he saw a
security issue (see below) where previous users information was
displayed in one of the text fields. I asked him to put a jira in and
that we would look into it. Does this sound familiar to anyone?
Thanks,
Jay
-------- Original Message --------
Subject: Re: Adam R. SeamFramework.org
Date: Mon, 25 Feb 2008 10:48:25 -0500
From: Jay Balunas <jbalunas(a)redhat.com>
To: A R <adamr_98(a)yahoo.com>
References: <460081.70615.qm(a)web50906.mail.re2.yahoo.com>
Hi Adam,
Thanks for providing this information - I will take a look at the example.
But - if you could enter a jira with this information (and any other
info about it) that would be great. That way this can be tracked and
commented on.
When you say "other user sessions" do you mean other users that are
currently logged in, or a user that you had previously been logged in
as? If it is the latter - Does it appear that you are logged in as the
user now and can access things as that user?
Thanks,
Jay
A R wrote:
> Adam R. SeamFramework.org
>
> jbalunas(a)redhat.com
>
> Hi Jay,
>
> The on-line dvd store demo has some database
> configuration issues.
>
> However, an apparent security related issue has been
> observed.
>
> Nutshell description: The Username text input box in
> the Login panel displays information entered from
> other users' sessions.
>
> I've been able to reproduce this observation on
> numerous attempts typically in less than five (5)
> minutes of "banging" on the application.
>
> At first I thought it was just browser caching and
> indeed anybody else will ignore it because they will
> see things like "User1", "User2" etc. And make the
> assumption that it is the way the app is supposed to
> run because the instructions hint to that behavior.
>
> I am able to consistently duplicate a test that
> consists of visiting the site from a connection in San
> Jose California, and entering the Username "sanjose".
> I'm then able to visit the site from a different
> connection, computer, and browser in Berkeley
> California and see "sanjose" in the Username field.
>
> I do not have a recipe for reproducing the result. My
> test consists of miscellaneous "banging" on the
> following few items (in no order):
>
> -Entering Username and then failing the app (Start
> Shopping).
> -Many fast reloads (sometimes around 50).
> -Clicking on the Login and/or Create Account buttons.
> -Multiple tabbed sessions.
>
> My personal concern is that, the above
> misconfiguration is not the reason for the security
> violation. It is however exposing an unexpected
> failure mode that might otherwise be hidden. My
> recommendation is not to fix the configuration issues
> until this failure is understood.
>
> Let me know if I can provide any additional
> information.
>
> Regards,
> AdamR.
>
>
>
>
>
_______________________________________________
seam-dev mailing list
seam-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/seam-dev
--
Pete Muir
http://in.relation.to/Bloggers/Pete
http://www.seamframework.org
1:19 p.m.
On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote:
First - The seam examples that are linked off of
seamframwork.org's
"See Seam in Action..." section: where are they hosted? where can I
find more information on them (seam version?, persistence config?
etc...)? and how can we change/update them?
The main reason I ask is because it appears the DVD example is
having some sort of persistence config issue. Selecting "Start
Shopping" throws a JDBC error. A user reported it, but I thought I
remember Pete saying that those demos were a little out of date.
Second - The user wanted to send me an email because he thought he
saw a security issue (see below) where previous users information
was displayed in one of the text fields. I asked him to put a jira
in and that we would look into it. Does this sound familiar to
anyone?
It is running on demo.jboss.com and needs to be taken down. It's
running with other demos on an old version of JBoss. We are not able
to upgrade the JBoss version for fear of messing up the other demos.
At one time we had access to the JBoss instance on that machine from
the demo account, but the last time I tried to administer it I found
the JBoss instance was running as root and we couldn't reset it. IT,
as usual, was unresponsive.
We really need to remove the links to that demo machine.
1:26 p.m.
I agree - we should probably figure out a way to take them down (at least
remove the "see seam in action" section), and maybe host some of the
examples on the same server as seamframework.org. The example that I wrote
for 'Seam in Production" points to the hotel booking example there.
I'm going to switch it to be the seamframework.org site itself - more
impressive too ;)
-Jay
On Mon, Feb 25, 2008 at 2:19 PM, Norman Richards <orb(a)nostacktrace.com>
wrote:
On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote:
> First - The seam examples that are linked off of seamframwork.org's
> "See Seam in Action..." section: where are they hosted? where can I
> find more information on them (seam version?, persistence config?
> etc...)? and how can we change/update them?
>
> The main reason I ask is because it appears the DVD example is
> having some sort of persistence config issue. Selecting "Start
> Shopping" throws a JDBC error. A user reported it, but I thought I
> remember Pete saying that those demos were a little out of date.
>
> Second - The user wanted to send me an email because he thought he
> saw a security issue (see below) where previous users information
> was displayed in one of the text fields. I asked him to put a jira
> in and that we would look into it. Does this sound familiar to
> anyone?
It is running on demo.jboss.com and needs to be taken down. It's
running with other demos on an old version of JBoss. We are not able
to upgrade the JBoss version for fear of messing up the other demos.
At one time we had access to the JBoss instance on that machine from
the demo account, but the last time I tried to administer it I found
the JBoss instance was running as root and we couldn't reset it. IT,
as usual, was unresponsive.
We really need to remove the links to that demo machine.
_______________________________________________
seam-dev mailing list
seam-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/seam-dev
1:39 p.m.
Christian,
I'm going to update a general outline for the seamframework.org "seam in
production" listing. I think it would be really cool for you to add some of
the details and descriptions, you know them much better than I.
I think having out first "Seam in production" entry be the site itself is
really neat and will give people of sense of Seam's ability.
What do you think?
-Jay
On Mon, Feb 25, 2008 at 2:26 PM, Jay Balunas <tech4j(a)gmail.com> wrote:
I agree - we should probably figure out a way to take them down (at
least
remove the "see seam in action" section), and maybe host some of the
examples on the same server as seamframework.org. The example that I
wrote for 'Seam in Production" points to the hotel booking example there.
I'm going to switch it to be the seamframework.org site itself - more
impressive too ;)
-Jay
On Mon, Feb 25, 2008 at 2:19 PM, Norman Richards <orb(a)nostacktrace.com>
wrote:
>
> On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote:
>
> > First - The seam examples that are linked off of seamframwork.org's
> > "See Seam in Action..." section: where are they hosted? where can I
> > find more information on them (seam version?, persistence config?
> > etc...)? and how can we change/update them?
> >
> > The main reason I ask is because it appears the DVD example is
> > having some sort of persistence config issue. Selecting "Start
> > Shopping" throws a JDBC error. A user reported it, but I thought I
> > remember Pete saying that those demos were a little out of date.
> >
> > Second - The user wanted to send me an email because he thought he
> > saw a security issue (see below) where previous users information
> > was displayed in one of the text fields. I asked him to put a jira
> > in and that we would look into it. Does this sound familiar to
> > anyone?
>
> It is running on demo.jboss.com and needs to be taken down. It's
> running with other demos on an old version of JBoss. We are not able
> to upgrade the JBoss version for fear of messing up the other demos.
> At one time we had access to the JBoss instance on that machine from
> the demo account, but the last time I tried to administer it I found
> the JBoss instance was running as root and we couldn't reset it. IT,
> as usual, was unresponsive.
>
> We really need to remove the links to that demo machine.
>
> _______________________________________________
> seam-dev mailing list
> seam-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/seam-dev
>
4:06 a.m.
On Feb 25, 2008, at 20:19 , Norman Richards wrote:
It is running on demo.jboss.com and needs to be taken down.
It's
running with other demos on an old version of JBoss. We are not
able to upgrade the JBoss version for fear of messing up the other
demos. At one time we had access to the JBoss instance on that
machine from the demo account, but the last time I tried to
administer it I found the JBoss instance was running as root and we
couldn't reset it. IT, as usual, was unresponsive.
We really need to remove the links to that demo machine.
I've removed them from the sidebar. Unfortunately, we don't really
have the capacity to host our own demo server on the same box as the
production websites until we get the new box ready from Red Hat IT.
4:29 p.m.
Do we have a ticket with IT to get the demos removed and replaced with
a html page saying "Unavailable, please follow the getting started
instructions to run this demo"?
If so, what number is it?
On 25/02/2008, Norman Richards <orb(a)nostacktrace.com> wrote:
On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote:
> First - The seam examples that are linked off of seamframwork.org's
> "See Seam in Action..." section: where are they hosted? where can I
> find more information on them (seam version?, persistence config?
> etc...)? and how can we change/update them?
>
> The main reason I ask is because it appears the DVD example is
> having some sort of persistence config issue. Selecting "Start
> Shopping" throws a JDBC error. A user reported it, but I thought I
> remember Pete saying that those demos were a little out of date.
>
> Second - The user wanted to send me an email because he thought he
> saw a security issue (see below) where previous users information
> was displayed in one of the text fields. I asked him to put a jira
> in and that we would look into it. Does this sound familiar to
> anyone?
It is running on demo.jboss.com and needs to be taken down. It's
running with other demos on an old version of JBoss. We are not able
to upgrade the JBoss version for fear of messing up the other demos.
At one time we had access to the JBoss instance on that machine from
the demo account, but the last time I tried to administer it I found
the JBoss instance was running as root and we couldn't reset it. IT,
as usual, was unresponsive.
We really need to remove the links to that demo machine.
_______________________________________________
seam-dev mailing list
seam-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/seam-dev
--
Pete Muir
http://in.relation.to/Bloggers/Pete
http://www.seamframework.org
6 p.m.
I am not aware of one - if it has not been done - I can work on it.
-Jay
On Thu, Feb 28, 2008 at 5:29 PM, Pete Muir <pmuir(a)bleepbleep.org.uk> wrote:
Do we have a ticket with IT to get the demos removed and replaced
with
a html page saying "Unavailable, please follow the getting started
instructions to run this demo"?
If so, what number is it?
On 25/02/2008, Norman Richards <orb(a)nostacktrace.com> wrote:
>
> On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote:
>
> > First - The seam examples that are linked off of seamframwork.org's
> > "See Seam in Action..." section: where are they hosted? where can
I
> > find more information on them (seam version?, persistence config?
> > etc...)? and how can we change/update them?
> >
> > The main reason I ask is because it appears the DVD example is
> > having some sort of persistence config issue. Selecting "Start
> > Shopping" throws a JDBC error. A user reported it, but I thought I
> > remember Pete saying that those demos were a little out of date.
> >
> > Second - The user wanted to send me an email because he thought he
> > saw a security issue (see below) where previous users information
> > was displayed in one of the text fields. I asked him to put a jira
> > in and that we would look into it. Does this sound familiar to
> > anyone?
>
>
> It is running on demo.jboss.com and needs to be taken down. It's
> running with other demos on an old version of JBoss. We are not able
> to upgrade the JBoss version for fear of messing up the other demos.
> At one time we had access to the JBoss instance on that machine from
> the demo account, but the last time I tried to administer it I found
> the JBoss instance was running as root and we couldn't reset it. IT,
> as usual, was unresponsive.
>
> We really need to remove the links to that demo machine.
>
>
> _______________________________________________
> seam-dev mailing list
> seam-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/seam-dev
>
--
Pete Muir
http://in.relation.to/Bloggers/Pete
http://www.seamframework.org
_______________________________________________
seam-dev mailing list
seam-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/seam-dev
9:09 a.m.
I have not heard from anyone if there is an existing ticket for the demos so
I opened a new one. Here is the email and ticket information:
Greetings,
This message has been automatically generated in response to the
creation of a trouble ticket regarding:
"JBoss Seam demos need to be removed",
a summary of which appears below.
There is no need to reply to this message right now. Your ticket has been
assigned an ID of [redhat.com #574277].
Please include the string:
[redhat.com #574277]
in the subject line of all future correspondence about this issue. To do so,
you may reply to this message.
Thank you,
helpdesk(a)redhat.com
-------------------------------------------------------------------------
Hello,
The seam demos on the "http://www.jboss.com/docs/demos"
<http://www.jboss.com/docs/demos> page need to be
removed or replaced with a html page saying "Please see
http://seamframework.org/Documentation/GettingStarted for details and
instructions on running the Seam demos". The demos are running old
versions of Seam and JBoss AS, and also require other maintenance that
we do not have access to.
This applies to the Seam DVD store and Seam booking example. The Seam
tools demos have more to do with JBDS - I have copied Max Andersen on
this email as he is the JBDS lead and may have comments as well.
Thanks,
Jay
On Thu, Feb 28, 2008 at 7:00 PM, Jay Balunas <tech4j(a)gmail.com> wrote:
I am not aware of one - if it has not been done - I can work on it.
-Jay
On Thu, Feb 28, 2008 at 5:29 PM, Pete Muir <pmuir(a)bleepbleep.org.uk>
wrote:
> Do we have a ticket with IT to get the demos removed and replaced with
> a html page saying "Unavailable, please follow the getting started
> instructions to run this demo"?
>
> If so, what number is it?
>
> On 25/02/2008, Norman Richards <orb(a)nostacktrace.com> wrote:
> >
> > On Feb 25, 2008, at 10:05 AM, Jay Balunas wrote:
> >
> > > First - The seam examples that are linked off of seamframwork.org's
> > > "See Seam in Action..." section: where are they hosted? where
can
> I
> > > find more information on them (seam version?, persistence config?
> > > etc...)? and how can we change/update them?
> > >
> > > The main reason I ask is because it appears the DVD example is
> > > having some sort of persistence config issue. Selecting "Start
> > > Shopping" throws a JDBC error. A user reported it, but I thought I
> > > remember Pete saying that those demos were a little out of date.
> > >
> > > Second - The user wanted to send me an email because he thought he
> > > saw a security issue (see below) where previous users information
> > > was displayed in one of the text fields. I asked him to put a jira
> > > in and that we would look into it. Does this sound familiar to
> > > anyone?
> >
> >
> > It is running on demo.jboss.com and needs to be taken down. It's
> > running with other demos on an old version of JBoss. We are not able
> > to upgrade the JBoss version for fear of messing up the other demos.
> > At one time we had access to the JBoss instance on that machine from
> > the demo account, but the last time I tried to administer it I found
> > the JBoss instance was running as root and we couldn't reset it.
> IT,
> > as usual, was unresponsive.
> >
> > We really need to remove the links to that demo machine.
> >
> >
> > _______________________________________________
> > seam-dev mailing list
> > seam-dev(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/seam-dev
> >
>
>
> --
> Pete Muir
> http://in.relation.to/Bloggers/Pete
> http://www.seamframework.org
> _______________________________________________
> seam-dev mailing list
> seam-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/seam-dev
>
10:17 a.m.
On Mar 4, 2008, at 9:09 AM, Jay Balunas wrote:
I have not heard from anyone if there is an existing ticket for the
demos so I opened a new one. Here is the email and ticket
information:
It looks like the server is back running as the demo user again, so I
should have access to replace the app now.
10:22 a.m.
Do we want to replace it or remove it? The email I sent to IT asks for it
to be removed and/or replaced with a link to the getting started section in
sfwk.org.
If that is going to be different I need to email the helpdesk.
-Jay
On Tue, Mar 4, 2008 at 11:17 AM, Norman Richards <orb(a)nostacktrace.com>
wrote:
On Mar 4, 2008, at 9:09 AM, Jay Balunas wrote:
> I have not heard from anyone if there is an existing ticket for the
> demos so I opened a new one. Here is the email and ticket
> information:
It looks like the server is back running as the demo user again, so I
should have access to replace the app now.
6067
days inactive
6075
days old
10 comments
5 participants
participants (5)
-
Christian Bauer -
Jay Balunas -
Jay Balunas -
Norman Richards -
Pete Muir