July 2008 - seam-issues - Jboss List Archives

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3086) Allow unproxied components in components.xml

by Luke Maurer (JIRA)

Allow unproxied components in components.xml -------------------------------------------- Key: JBSEAM-3086 URL: http://jira.jboss.com/jira/browse/JBSEAM-3086 Project: Seam Issue Type: Feature Request Components: Core Reporter: Luke Maurer It would be very convenient to be able to define a "component" in components.xml without actually having it be wrapped in a proxy, in cases where I just want to have an object put into application context and have a few setters called on it, but don't need any interceptors installed. For a use case, see http://www.jasypt.org/hibernate3.html (the "Providing the encryptor to Hibernate" section) - instructions are given for a convenient way to configure the library using Spring, even though the classes in question (StandardPBEStringEncryptor and HibernatePBEStringEncryptor) were not written as Spring beans. The equivalent code in Seam components.xml does not work, since Seam attempts to proxy the objects, and the classes are final (Javassist throws a CannotCompileException). Since none of the functionality offered by proxies is required, in principle the only requirement to make this work would be a way to turn off proxying. (Presumably Spring does so automatically here.) Naturally, there is a perfectly good workaround, which would be to use a @Factory or @Unwrap method on a Seam component and include setter methods to do the configuration. But this is a lot of tedious glue code, and I find the idea of directly configuring the objects in components.xml to be much more elegant. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 1 month

3
4
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-2450) OWASP / New Session after Login

by ahus1 (JIRA)

OWASP / New Session after Login ------------------------------- Key: JBSEAM-2450 URL: http://jira.jboss.com/jira/browse/JBSEAM-2450 Project: JBoss Seam Issue Type: Feature Request Affects Versions: 2.0.0.GA Environment: Linux 2.6, jetty 6.1.5, java 6 Reporter: ahus1 Hello, OWASP has compiled a "top 10" vulnerablilities for web applications. One suggestion against session hijacking was the following: Start a new HTTP-Session after a successful login: "Consider regenerating a new session upon successful authentication or privilege level change." http://www.owasp.org/index.php/Top_10_2007-A7 Therefore there should be a (configurable?) switch to choose "continue with new session ID after successful log on" I have thought of invalidating the current HTTP session, creating a new one and copying all elements from the old session to the new session in my Authenticator. But Seam 2.0.0 doesn't allow this: When I use the lowlevel functions this is blocked by IllegalStateException("Please end the HttpSession via Seam.invalidateSession()") in Lifecyle. When I use Seam.invalidateSession(), the session is only destroyed at the end of the request and I am unable to copy any objects in my Authenticator as the new session doesn't exist yet. The workaround I have come up with is a filter, that destroys the complete session before the log in. This is not very elegant, but it works for me as I don't have i.e. a shoping basket that I'd like to preserve. A "nice" implementation in seam shouldn't have this limitation. shane.bryzak(a)jboss.com asked for this ticket to be assigned to her. The Java Class: Code: /** * This filter enforces a new session whenever there is a POST, should be mapped * to the URL of the login page in your web.xml * @author Alexander Schwartz 2007 */ public class NewSessionFilter implements Filter { private Log log = LogFactory.getLog(NewSessionFilter.class); private String url; public void destroy() { // empty. } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (request instanceof HttpServletRequest) { HttpServletRequest httpRequest = (HttpServletRequest) request; if (httpRequest.getMethod().equals("POST") && httpRequest.getSession() != null && !httpRequest.getSession().isNew() && httpRequest.getRequestURI().endsWith(url)) { httpRequest.getSession().invalidate(); httpRequest.getSession(true); log.info("new Session:" + httpRequest.getSession().getId()); } } chain.doFilter(request, response); } public void init(FilterConfig filterConfig) throws ServletException { url = filterConfig.getInitParameter("url"); if (url == null) { throw new ServletException( "please specify parameter 'url' with login URL"); } } } The web.xml: Code: <filter> <display-name>NewSessionFilter</display-name> <filter-name>NewSessionFilter</filter-name> <filter-class> NewSessionFilter </filter-class> <init-param> <param-name>url</param-name> <param-value>/iss/login.jsf</param-value> </init-param> </filter> <filter-mapping> <filter-name>NewSessionFilter</filter-name> <servlet-name>Faces Servlet</servlet-name> <url-pattern>/iss/login.jsf</url-pattern> <dispatcher>REQUEST</dispatcher> </filter-mapping> -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 1 month

11
16
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1683) s:fileUpload with required attribute

by Jonas Erma (JIRA)

s:fileUpload with required attribute ------------------------------------ Key: JBSEAM-1683 URL: http://jira.jboss.com/jira/browse/JBSEAM-1683 Project: JBoss Seam Issue Type: Feature Request Components: JSF Affects Versions: 2.0.0.BETA1 Reporter: Jonas Erma Fix For: 2.0.0.CR1 Is it possible to introduce a required attribute into the s:fileUpload tag? That way, I wouldn't need to check in my action methods if the file is null. tazman -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 1 month

5
4
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3054) use outbound urlrewriting in seambay example

by Dan Allen (JIRA)

use outbound urlrewriting in seambay example -------------------------------------------- Key: JBSEAM-3054 URL: http://jira.jboss.com/jira/browse/JBSEAM-3054 Project: Seam Issue Type: Feature Request Components: Examples Affects Versions: 2.1.0.A1, 2.0.2.SP1 Reporter: Dan Allen Assigned To: Dan Allen Fix For: 2.0.x, 2.1.0.BETA1 Let's show off outbound urlrewriting in the seambay example. The current hard-coded RESTful URLs look so labor intensive. Plus, it all stops working if you turn off urlrewriting. By pushing it all into the urlrewrite engine, it works either way. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 1 month

4
7
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-2240) refactor for easier extensibility of seam identity: seam identiy interface + seam identity base impl

by koen handekyn (JIRA)

refactor for easier extensibility of seam identity: seam identiy interface + seam identity base impl ---------------------------------------------------------------------------------------------------- Key: JBSEAM-2240 URL: http://jira.jboss.com/jira/browse/JBSEAM-2240 Project: JBoss Seam Issue Type: Feature Request Components: Core Affects Versions: 2.0.0.GA Reporter: koen handekyn Priority: Optional to allow easier extensibility of the seam identity class it would be useful to have a clear seam identity interface with complementary base impl from (package org.jboss.seam.security) use case: i'm trying to define my own seam identiy that contains as an extra parameter domain (login@domain/password). to have a complete implementation (which also saves the domain into a cookie) i'm stuck as 1. i don't know have an interface that I should satisfy if I wanted to make an implementation from scratch 2. extending from seam idenity has some issues : i missing some protected accessors to some private members (that maybe could be protected?) alternatively my question would be solved if i could have extension points within initFromCookie and at "setCookieValueIfEnabled( getUsername() ); from method postAuthenticate()" such that i could combine and split login and domain when saving/reading the cookie. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 1 month

3
5
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-2095) Multiple DataSources in same EAR, hib2ddl and import.sql run on all

by Ian Darwin (JIRA)

Multiple DataSources in same EAR, hib2ddl and import.sql run on all ------------------------------------------------------------------- Key: JBSEAM-2095 URL: http://jira.jboss.com/jira/browse/JBSEAM-2095 Project: JBoss Seam Issue Type: Feature Request Components: Core Affects Versions: 2.0.0.CR1 Environment: EAR deployment, POJO beans setup by Seam-Gen. OS not relevant; tried JDK1.6 and 1.7EA. DB is PostgreSQL 8. Reporter: Ian Darwin When using multiple DataSources in an EJB3 EAR, as suggested by Gavin the the URL referenced below, using Hibernate as the underlying persistence, it appears that the "schema export" and the /import.sql get applied to both. It would be nice if there could be a more fine-grained mechanism for associating import.sql and hbm2ddl with particular entities. I have two Datasources, call them "all" and "bugs" (the idea being that the bugs database will be shared by all developers and should be permanent, whereas the "all" database should be dropped and recreated/imported each tim). 16:07:55,345 INFO [SchemaExport] Running hbm2ddl schema export 16:07:55,345 INFO [SchemaExport] exporting generated schema to database 16:07:55,504 INFO [SchemaExport] Executing import script: /import.sql 16:07:55,568 INFO [SchemaExport] schema export complete ... 16:07:55,710 INFO [SchemaExport] Running hbm2ddl schema export 16:07:55,711 INFO [SchemaExport] exporting generated schema to database 16:07:55,857 INFO [SchemaExport] Executing import script: /import.sql 16:07:55,911 INFO [SchemaExport] schema export complete It would be most convenient if one could specify more precisely which entities go in which Schema. I have added the @PersistenceContext annotation on the BugsHome class' EntityManager: @PersistenceUnit(name="tcpseambug") @In EntityManager bugEntityManager; public EntityManager getEntityManager() { return bugEntityManager; } Note that if I disable the hbm2ddl export on the "bugs" database, then schema setup quits when one of the tables in the "all" database shows up missing. N.B. Will be happy to write up a complete example for the Reference Manual once this is working :-), as there are several related questions on the Forums. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 2 months

4
11
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-2050) reorganize modules

by Dan Allen (JIRA)

reorganize modules ------------------ Key: JBSEAM-2050 URL: http://jira.jboss.com/jira/browse/JBSEAM-2050 Project: JBoss Seam Issue Type: Feature Request Components: Tools Affects Versions: 2.0.0.CR1 Reporter: Dan Allen Fix For: 2.0.x I would like to make "modules" a first order directory (renamed from "src") and also organize tests so they are per-module. This will encourage per-module tests and also prevent circular dependencies (because the folders are treated as modules and not one big lump of source code). The ui module also once again finds itself adjacent to the other modules. jboss-seam/ examples/ <-- showing this just as a reference point modules/ core/ main/java test/java ui/ main/java test/java (continue for debug, ioc, gen, pdf, mail, remoting) Although Eclipse doesn't know the first think about multi-modules, this will be idea for setting up a module-aware IDE like IntelliJ IDEA (and to some degree, NetBeans). -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 3 months

4
11
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1670) allow multiple scopes for @In annotation

by Dan Allen (JIRA)

allow multiple scopes for @In annotation ---------------------------------------- Key: JBSEAM-1670 URL: http://jira.jboss.com/jira/browse/JBSEAM-1670 Project: JBoss Seam Issue Type: Patch Components: Core Affects Versions: 2.0.0.BETA1 Reporter: Dan Allen Priority: Minor Fix For: 2.0.0.CR1, 2.0.0.GA, 2.0.1.GA Right now, your only option for the scope on the @In annotation is an explicit scope or a hierarchical search of all the scopes. I can imagine that there are times when you want to look in a handful of scopes, but not all of them. For instance, anything within a conversation, but not above. Additionally, by making this a multi-value attribute, the developer can override the order in which the scopes are searched. They are searched in the order specified. ScopeType[] scope() default {}; This would also eliminate the need for the UNSPECIFIED scope since no scopes would assume a hierarchical search. The logic that would have to change is Component#getValueToInject() -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 3 months

3
6
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1710) Support multiple life cycle methods (per inheritance) on JavaBean classes

by Dan Allen (JIRA)

Support multiple life cycle methods (per inheritance) on JavaBean classes ------------------------------------------------------------------------- Key: JBSEAM-1710 URL: http://jira.jboss.com/jira/browse/JBSEAM-1710 Project: JBoss Seam Issue Type: Bug Components: Core Affects Versions: 2.0.0.BETA1, 2.0.0.CR1 Reporter: Dan Allen Priority: Minor EJB supports multiple life cycle methods for a bean, as long as two life cycle methods do not appear in the same class in the inheritance hierarchy. Thus, you can define a @PostConstruct method on the concrete class, and a different @PostConstruct method on its superclass. As per the EJB specification (with minor corrections for clarity): "Life cycle callback interceptor methods may be defined on super classes of the bean class, the bean class itself, or interceptor classes. However, a given class may not have more than one life cycle callback interceptor method for the same life cycle event." The following comment is found in Component.java regarding this issue: // TODO: check the EJB3 spec, I think you are allowed to have multiple life cycle methods on a bean! The comment is correct in that multiple life cycle methods are not allowed on a single bean class. However, through inheritance, it is possible to have two different life cycle methods for the same Seam component. Currently, Component#initMembers() works backwards up the inheritance chain while scanning methods. Therefore, the life cycle method on the highest member of the hierarchy currently wins. So, as it stands now, the handling of life cycle callbacks for JavaBeans is inconsistent with how they are handled by the EJB container on session and message-driven beans. I was able to verify this with a simple demonstration I conducted. This incompatibility shouldn't be too difficult to fix. Just switch the life cycle method properties to an array and ensure that superclass methods are called first. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 3 months

3
5
0 / 0

[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1389) Please make the methods parse and createPage protected instead of private.

by Chris Rudd (JIRA)

Please make the methods parse and createPage protected instead of private. -------------------------------------------------------------------------- Key: JBSEAM-1389 URL: http://jira.jboss.com/jira/browse/JBSEAM-1389 Project: JBoss Seam Issue Type: Feature Request Components: Core Reporter: Chris Rudd We have a dynamic routine that locates pages xml files from multiple locations. Since parse and createPage are private methods we cannot override and extend the Pages component without lifting the entire source and replicating it, or using reflection to get at those methods. Neither of these are good long term aproaches. In general it seems that lots of the core components that one might want to extend to hook in additional functionality cannot be due to the use of private instead of protected methods. The extended funtionality provided by the resolution to JBSEAM-715 does not rectify my issue as that relies on explitly defining the pages xml files. I believe there are several other people who are looking for a way to use an algorithm to locate them rather than a fixed list. Making those methods protected solves the problem as it allows anyone to extend the functionaliry of the Pages component to provide extended rules / algorithms for locating pages xml files, while not affecting the functionality of the core at all. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 3 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

seam-issues July 2008