[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1045) enable the application message bundle to be connected to the core resource bundle
by Keith Naas (JIRA)
enable the application message bundle to be connected to the core resource bundle
---------------------------------------------------------------------------------
Key: JBSEAM-1045
URL: http://jira.jboss.com/jira/browse/JBSEAM-1045
Project: JBoss Seam
Issue Type: Feature Request
Components: Core
Reporter: Keith Naas
On our projects, we wanted to be able to connect the core Seam ResourceBundle to the Faces Application message-bundle. Since the Faces Application message-bundle is instantiated by Faces, we cannot have it point directly to the Seam ResourceBundle. However, by fronting it with this class, we are able to make use of the nice Seam functionality from within core JSF controls (such as UIInput validation and conversion messages).
{code}
package com.biglots.common.web.util;
import java.util.Enumeration;
import org.jboss.seam.core.Interpolator;
import org.jboss.seam.core.ResourceBundle;
/**
* The <i>ApplicationResourceBundle</i> is an attempt to fix the disconnect between having multiple resource bundles
* and the lone application resource bundle used within the JSF. Within JSF2.1, it is possible to have multiple named
* resource bundles. However, all error messages, validation messages, conversion messages, that are generated from
* within core JSF classes go through the single message-bundle configured from within the faces-config.xml file. We
* want to be able to reuse the messages in such a way that we only specify the message values once, and simply hook up
* the messages bundles to the APIs in the seam components.xml. <p/> The ApplicationResourceBundle is just a class that
* fronts the org.jboss.seam.core.ResourceBundle while also correctly handling EL expressions defined in any messages.
* For instance, a message could be defined as "general.label.login.caption=#{someexpression}is invalid.". Pretty cool,
* huh? So what else does it provide? It allows for resource bundles to have precedence. <p/> How do I configure this?
* Well, pretty easily. To get the messasges available to Java classes, in the faces-config.xml just do
* <code>
* <application>
* <message-bundle>com.biglots.common.web.util.ApplicationResourceBundle</message-bundle>
* </application>
* </code>
* Then to configure the seam ResourceBundle that we are fronting, just do the following in components.xml.
* Note that the order of the values is also the order of precedence during a lookup.
* <code>
* <core:resource-bundle>
* <core:bundle-names>
* <value>general</value>
* <value>META-INF.messages</value>
* <value>messages</value>
* </core:bundle-names>
* </core:resource-bundle>
* </code>
*
* <p/> What if you want some named resource bundles? For instance to have a resource bundle named "generalMsg"
* available in Session scope, just do the following in components.xml.
* You can specify as many of the named resource bundles as you like, just make s
* sure to configure the core resource bundle one as well.
* <code>
* <component name="generalMsg" class="org.jboss.seam.core.ResourceBundle">
* <property name="bundleNames">
* <value>general</value>
* <value>META-INF.messages</value>
* </property>
* </component>
* </code>
*
* @author knaas
*/
public class ApplicationResourceBundle extends java.util.ResourceBundle
{
/**
* Returns the keys available in all of the configured resource bundles.
* @return
*/
@Override
public Enumeration<String> getKeys()
{
return ResourceBundle.instance().getKeys();
}
/**
* Returns the message that is looked up in the configured resource bundles.
* It also interpolates any EL in the message so that we can put EL in messages
* and they are properly evaluated in all Java Classes and JSF Views.
*
*/
@Override
protected Object handleGetObject(final String key)
{
return Interpolator.instance().interpolate(ResourceBundle.instance().getString(key), (Object[])null);
}
}
{code}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 5 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1137) Potentially large security hole in Seam Captcha implementation
by Ian Hlavats (JIRA)
Potentially large security hole in Seam Captcha implementation
--------------------------------------------------------------
Key: JBSEAM-1137
URL: http://jira.jboss.com/jira/browse/JBSEAM-1137
Project: JBoss Seam
Issue Type: Bug
Components: Security
Affects Versions: 1.2.0.GA
Environment: Any
Reporter: Ian Hlavats
I have been experiencing "holes" in the Seam captcha integration recently.
The Seam documentation (section 21.1.1) recommends client-side state saving for JSF.
The following scenario should point out a potential security issue with this approach.
Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component.
Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all.
In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text.
Can the malicious user can now submit the previous copy of my form without the captcha component in the tree?
I am using the MyFaces 1.1.4 JSF implementation.
Thanks.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 5 months