[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4064) Seam eclipse perspective, New seam project, Seam facet, Existing seam runtime not displayed. Exists error when try to newly create it
by Jeff Wexler (JIRA)
Seam eclipse perspective, New seam project, Seam facet, Existing seam runtime not displayed. Exists error when try to newly create it
-------------------------------------------------------------------------------------------------------------------------------------
Key: JBSEAM-4064
URL: https://jira.jboss.org/jira/browse/JBSEAM-4064
Project: Seam
Issue Type: Bug
Components: Tools
Affects Versions: 2.1.1.GA
Environment: Windows 2003 server, 4GB memory, eclipse-jee-ganymede-SR2-win32.zip, JBossTools-ALL-win32-3.0.0.GA-R200903141626-H5.zip, PostgreSQL 8.3.7 JDBC Driver 8.3-604.jdbc4
Reporter: Jeff Wexler
Created a new Seam project. In doing so, added Seam Runtime. Deployed as EAR.
After project was created, mistakenly selected BuildAll which built and deployed all projects in the workspace.
Subsequently deleted the Seam project created above and deleted the directories for the project on the hard disk.
Was able to select the jboss server etc that I had previously created, however, the previously created Seam Runtime in the Seam Facet dialog of the New Seam Project dialog is not displayed.
When select the Add button and then select the jboss-seam-1.2.1.GA directory, then the name defaults as jboss-seam-2.1.1.GA which is the name I used previously. This time, unable to select any version other than 1.2. Previously was able to select 2.1.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 8 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-4015) Security Vulnerability in booking example
by Stuart Douglas (JIRA)
Security Vulnerability in booking example
-----------------------------------------
Key: JBSEAM-4015
URL: https://jira.jboss.org/jira/browse/JBSEAM-4015
Project: Seam
Issue Type: Bug
Components: Examples
Reporter: Stuart Douglas
It is possible to leak details (real name and username) of a previously logged in user to an un-authenticated user in the booking example. This is because the 'user' field on the SLSB authenticator is not cleared on every log in attempt.
If an unauthenticated user gets a previously used SLSB then the 'user' field will already be set to another users details, and if their login attempt fails then the other users details will be outjected to the session. If this user then clicks the 'create account' button the username and real name fields will be pre-filled with the other users details.
This of course depends on the SLSB pooling mechanism used by the AS, however it is easy to reproduce and it is possible to pull peoples details out of the demo hosted at exadel.com.
Anywhere that uses SLSB's and outjection is vulnerable to similar problems unless the outjected field is set to a specific value every time.
A framework wide approach to this problem would be to nullify all outjected fields on SLSB's after method invocation.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 8 months