myfaces-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From simon <simon.kitch...@chello.at>
Subject Re: Is it possible to use AddResource with my own components?
Date Fri, 11 Jan 2008 17:17:28 GMT

On Fri, 2008-01-11 at 17:31 +0100, Matt.Rossner-prest@sanofi-aventis.com
wrote:
> Hi,
> 
>  
> 
> I’ve written a custom component that requires some Javascript. I have
> the js in an external file but I was hoping to have it included in the
> tag, kind of like the myfaces tags do. I tried using the AddResource
> class, basically looked at the myfaces source and tried to do the same
> thing, but it fails on the component validation. It checks if the
> package starts with org.apache.myfaces.custom… or something like that.
> I can’t really get past that unless if I want to rebuild myfaces. Is
> there a way to get this to work externally? Or is there a way to do
> this I don’t know about. For now I have to just manually include the
> script in the JSP pages. This will work, but it can lead to
> complication if someone else is using the tag and neglects to add the
> javascript.

I know that this code was written with the intention of allowing other
people to use it for their own resources.

However if I remember correctly, it was decided to require users to
write and register a simple subclass of one of the pieces to "enable"
serving resources from their own package. This greatly reduces the
possibility that an attacker could trick the ExtensionsFilter into
serving out all the resources an application had on its classpath
(possibly including config files with database passwords etc).

Sorry I cannot remember the exact details for the moment.

Of course as this code is licensed under the APL, you are also free to
take the necessary bits and modify them as needed. If you redistribute
the result, you do need to make some minor acknowledgements; the exact
details will be somewhere on the Apache website.

Regards,

Simon


Mime
View raw message