[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3838) Permission check fails on collections that contain lazily initialized entities
by Georges Berscheid (JIRA)
Permission check fails on collections that contain lazily initialized entities
------------------------------------------------------------------------------
Key: JBSEAM-3838
URL: https://jira.jboss.org/jira/browse/JBSEAM-3838
Project: Seam
Issue Type: Bug
Components: Security
Affects Versions: 2.1.0.SP1
Reporter: Georges Berscheid
org.jboss.seam.security.permission.PermissionMapper.filterByPermission:94
The permission filter checks if the target of the check is of the same class as the target of the permission. If the collection-parameter is the result of a javax.persistence.Query.getResultList() (using Hibernate), and one of the entities returned in that List had previously been lazily fetched (e.g. as part of an entity relationship) this check will fail.
Hibernate probably does some optimization and knows that it had fetched this entity before, and hence puts the lazy proxy into the result list. The proxy's class name is something like Entity_$$_javassist_12 which won't match the class name of the permission target (Entity).
The only work-around I could find for this is to eagerly fetch all entity relationships that are affected by this behavior, which kills the performance of the application.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 2 months
[JBoss JIRA] Created: (JBSEAM-4525) Allow faces messages to be Scope other than CONVERSATION
by Michael Youngstrom (JIRA)
Allow faces messages to be Scope other than CONVERSATION
--------------------------------------------------------
Key: JBSEAM-4525
URL: https://jira.jboss.org/jira/browse/JBSEAM-4525
Project: Seam
Issue Type: Feature Request
Components: JSF Integration
Affects Versions: 2.2.0.GA
Reporter: Michael Youngstrom
Assignee: Michael Youngstrom
Fix For: 2.2.1.CR1
The conversation scope can be a problematic scope for FacesMessages. Often the developer may wish to end a conversation "before-redirect" and communitcate a message to the next page. However, this doesn't work since by default FacesMessages is a conversation scoped component.
If FacesMessages were allowed to be a Session scoped component project wouldn't have this issue at the expense of a less correct concurrency situation (multiple pages rendered at the same time from the same session may mix up messages).
That said it would be nice to give the project a choice. The scope for FacesMessages can be overridden to be Session scoped, however, the static :"instance()" method currently only looks in the conversation scope so the scope essentially cannot be overridden.
This feature request is to change FacesMessages.instance() to not force lookup in the conversation scope allowing projects if they wish to override FacesMessages' scope if they wish.
I will plan on committing the change myself for 2.2.1 unless someone objects.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 2 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1563) create "bin" distribution
by Dan Allen (JIRA)
create "bin" distribution
-------------------------
Key: JBSEAM-1563
URL: http://jira.jboss.com/jira/browse/JBSEAM-1563
Project: JBoss Seam
Issue Type: Feature Request
Components: Core
Affects Versions: 2.0.0.BETA1, 1.3.0.ALPHA, 1.2.1.GA
Reporter: Dan Allen
The current releases of Seam are ridiculously large, weighing in at around 80MB. That is almost as big as the JBoss AS download! While it is critical to offer the entire bundle for Seam developers, contributors, and source builders, I think it would be appropriate to offer a "bin" distribution that is intended just to run Seam. Perhaps just spin off seam-gen as its own download. That should give people exactly what they need to run Seam, and nothing more.
Below is a comparison table of some competing projects:
Spring Framework: 10MB (2.6MB if you pull it from the maven repository)
Ruby on Rails: 2.2 MB (standalone version)
I remember when I first discovered Seam, I put off trying it out because it was too hefty of a download. Let's make it more attractive.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 2 months