[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3067) Identity Management: JPAIdentityStore remember-me feature isn't working
by Leonid Maslov (JIRA)
Identity Management: JPAIdentityStore remember-me feature isn't working
-----------------------------------------------------------------------
Key: JBSEAM-3067
URL: http://jira.jboss.com/jira/browse/JBSEAM-3067
Project: Seam
Issue Type: Bug
Components: Security
Affects Versions: 2.1.0.A1
Environment: Win Xp, SP-3
Reporter: Leonid Maslov
Priority: Minor
<identity-management:jpa-identity-store
name="identityStore"
account-class="xxx.xxx.members.MemberAccount"/>
<drools:rule-base name="securityRules">
<drools:rule-files>
<value>/security.drl</value>
</drools:rule-files>
</drools:rule-base>
<security:identity remember-me="true"/>
1) Does not work for remember-me case.
2) replacing the last string with <security:identity remember-me="true" authenticate-method="#{identityManager.authenticate}"/>
doesn't work at all - fails with exception about LoginContext method invocation
3) reverting to non identity-management solves the problem
PS> (Sorry, I haven't any investigations about @Observer rememberMe and so on.. at the moment)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 7 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3058) HTML and CSS sanitation filters for Seam Text
by Christian Bauer (JIRA)
HTML and CSS sanitation filters for Seam Text
---------------------------------------------
Key: JBSEAM-3058
URL: http://jira.jboss.com/jira/browse/JBSEAM-3058
Project: Seam
Issue Type: Task
Components: Seam Text, Wiki
Reporter: Christian Bauer
Assigned To: Christian Bauer
Although we only allow certain elments and attributes, and do not allow quotes and ampersands in HTML fragments parsed through Seam Text, various XSS attack vectors are still open.
1. We can't remove IMG and A from the allowed list of HTML elements because they are already used in probably hundreds of documents. So we need to filter the SRC and HREF attribute values.
2. We need to filter the STYLE attribute on any element, because a) background:url(javascript) is executed on most browser b) Internet Explorer also executes background-color: expression(javascript). But, the STYLE attribute it is used for document layout on production sites (mostly with DIV elements) and there simply is no alternative.
The following rules from the Ruby/Python rules can be a starting point: http://wiki.whatwg.org/wiki/Sanitization_rules
First, implement the callbacks/stacks in seam-text.g so this filter can be hooked in as a SeamTextParser extension.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 7 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3003) maintain insertion order of parameters in UrlBuilder
by Dan Allen (JIRA)
maintain insertion order of parameters in UrlBuilder
----------------------------------------------------
Key: JBSEAM-3003
URL: http://jira.jboss.com/jira/browse/JBSEAM-3003
Project: Seam
Issue Type: Feature Request
Components: JSF Controls
Affects Versions: 2.1.0.A1
Reporter: Dan Allen
Assigned To: Dan Allen
Priority: Minor
Fix For: 2.1.0.BETA1
Right now it is difficult to create UrlRewrite rules because the order of the parameters jumps around. This happens because the parameters are appended to a plain HashMap (for s:link, s:button, etc), giving no guarantee to their order. My feeling is that parameters should maintain their insertion order, which can be accomplished using a LinkedHashMap.
At first, I thought about having the parameters sorted alphabetically. However, that takes control away from the developer to order the links how they see fit. As long as we can document the order in which Seam appends parameters, then the developer can predict the order the parameters will appear in the URL.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 7 months