Return-Path: X-Original-To: apmail-struts-commits-archive@minotaur.apache.org Delivered-To: apmail-struts-commits-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 5D927C054 for ; Fri, 14 Nov 2014 07:45:00 +0000 (UTC) Received: (qmail 22380 invoked by uid 500); 14 Nov 2014 07:45:00 -0000 Delivered-To: apmail-struts-commits-archive@struts.apache.org Received: (qmail 22341 invoked by uid 500); 14 Nov 2014 07:45:00 -0000 Mailing-List: contact commits-help@struts.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@struts.apache.org Delivered-To: mailing list commits@struts.apache.org Received: (qmail 22327 invoked by uid 99); 14 Nov 2014 07:45:00 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 14 Nov 2014 07:45:00 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=5.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 14 Nov 2014 07:44:54 +0000 Received: from eris.apache.org (localhost [127.0.0.1]) by eris.apache.org (Postfix) with ESMTP id 93A5D2388993 for ; Fri, 14 Nov 2014 07:44:03 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: svn commit: r929145 [1/3] - in /websites/production/struts/content: development/2.x/docs/ release/2.3.x/docs/ Date: Fri, 14 Nov 2014 07:44:00 -0000 To: commits@struts.apache.org From: lukaszlenart@apache.org X-Mailer: svnmailer-1.0.9 Message-Id: <20141114074403.93A5D2388993@eris.apache.org> X-Virus-Checked: Checked by ClamAV on apache.org Author: lukaszlenart Date: Fri Nov 14 07:43:54 2014 New Revision: 929145 Log: Updates production Added: websites/production/struts/content/development/2.x/docs/version-notes-2319.html websites/production/struts/content/release/2.3.x/docs/version-notes-2319.html Modified: websites/production/struts/content/development/2.x/docs/building-struts-2-normal-release.html websites/production/struts/content/development/2.x/docs/model-driven.html websites/production/struts/content/development/2.x/docs/rest-plugin.html websites/production/struts/content/development/2.x/docs/security.html websites/production/struts/content/release/2.3.x/docs/actionmapper.html websites/production/struts/content/release/2.3.x/docs/building-struts-2-normal-release.html websites/production/struts/content/release/2.3.x/docs/file-upload.html websites/production/struts/content/release/2.3.x/docs/guides.html websites/production/struts/content/release/2.3.x/docs/interceptors.html websites/production/struts/content/release/2.3.x/docs/migration-guide.html websites/production/struts/content/release/2.3.x/docs/model-driven.html websites/production/struts/content/release/2.3.x/docs/rest-plugin.html websites/production/struts/content/release/2.3.x/docs/security.html websites/production/struts/content/release/2.3.x/docs/sitegraph-plugin.html websites/production/struts/content/release/2.3.x/docs/spring-plugin.html websites/production/struts/content/release/2.3.x/docs/type-conversion.html websites/production/struts/content/release/2.3.x/docs/validation.html websites/production/struts/content/release/2.3.x/docs/version-notes-2318.html Modified: websites/production/struts/content/development/2.x/docs/building-struts-2-normal-release.html ============================================================================== --- websites/production/struts/content/development/2.x/docs/building-struts-2-normal-release.html (original) +++ websites/production/struts/content/development/2.x/docs/building-struts-2-normal-release.html Fri Nov 14 07:43:54 2014 @@ -139,33 +139,39 @@ under the License.

Content

+/*]]>*/

Building Steps (Struts)

Getting ready

  1. Create an "Struts 2.x.y omnibus ticket" ticket in JIRA to refer to in upcoming release related commit comments and for general documentation purposes. Mark it with priority "Blocker".
  2. Switch to branch develop
  3. Ensure that the master POM and Struts Annotations have current releases
  4. Review JIRA for any issues without a fix version set, and for any issues that should be resolved for the pending release.
  5. Ensure that there are no repositories or pluginRepositories listed in the poms.
  6. If you have committed all changes regarding the release process, close the omnibus ticket as it is the last open ticket for the upcoming release
  7. Release the upcoming version in JIRA (under Administration/Manage Releases) and tag the release date
  8. Add next milestone ve rsion to the JIRA roadmap
  9. Create DONE and TODO filters for the new version, share with all, and remove obsolete TODO filter
  10. Create a new Version Notes page in Confluence, link from Migration Guide, and link to prior release page and JIRA DONE filters of the version to release
  11. Export wiki pages and put them under /docs

Update Draft Docs when needed

Checkout struts-site project (see details at the bottom of this page) and perform export:

If build will fail try again - don't use clean, the exporter is going to update only outdated pages. After successful export, commit updated files into struts-production

Be sure your local copy is up-to-date

- -

Create a release branch

+ +
+ Icon +
+

Please remember to keep BOM subproject in sync - <struts-version.version>X.X.X</struts-version.version> - must be the same as the parent pom.

+
+
+

Create a release branch

-

Now you should be on release/X.X.X.X branch (git status supposed to confirm that). You must push changes to remote repo as the Release plugins will push changes to remote as well.

Prepare release

Tag the release by using the "release:prepare" goal of Maven:

-

For a dry run, add -DdryRun=true. If you do a dry run, use mvn release:clean to clean up after you have looked at the output.

When prompted for the SCM tag name, follow this pattern: STRUTS_2_3_[PATCH_VERSION]

Icon
-

If you get an error message, try to re-run mvn release:prepare -Dusername=yourSvnUsername -Dpassword=yourSvnPassword -DautoVersionSubmodules=true command again, -Dresume flag is set to true by default and the plugin will resume the release process from where it failed before.

+

If you get an error message, try to re-run mvn release:prepare -DautoVersionSubmodules=true command again, -Dresume flag is set to true by default and the plugin will resume the release process from where it failed before.

Follow the link to get more information about performed operation by release plugin.

Perform the release

-

Follow the link to get more information about performed operation by release plugin. After this step the artifacts will be hosted by Nexus.

If you need to run perform again, (or in a different box), do:

-

Now both master and develop branches should be up to date with the changes introduced by the release.

Vote on it

Post a release/quality vote to the dev list (and only the dev list). The example mail is on Sample announcements page.
If the vote result is for an ASF release (i.e. not test build), update site, announce. If the vote result is for GA, push to central.

Copy files

After the vote, if the distribution is being mirrored (there was a favourable release vote) copy the Sources and Binaries:

+

Now both master and develop branches should be up to date with the changes introduced by the release.

+ Icon +
+

Do not remove the tag! It clearly indicates what was planned and it can be used as a history marker. Always used the next version number, do not redeploy the same version as it breaks Maven's policy and you will have to manually clean up Maven repository.

+
+
+

Vote on it

Post a release/quality vote to the dev list (and only the dev list). The example mail is on Sample announcements page.
If the vote result is for an ASF release (i.e. not test build), update site, announce. If the vote result is for GA, push to central.

Copy files

After the vote, if the distribution is being mirrored (there was a favourable release vote) copy the Sources and Binaries:

-
-

Gangster class (model):

-
- -
-

JSP for creating a Gangster:

-
- -

Settings

The following settings can be customized. See the developer guide.
For more configuration options see the Convention Plugin Documentation

Setting

Description

Default

Possible Values

struts.rest.handlerOverride.EXTENSION

The alias for the ContentTypeHandler implementation that handles the EXTENSION val ue

N/A

Any declared alias for a ContentTypeHandler implementation

struts.rest.defaultExtension

The default extension to use when none is explicitly specified in the request

xhtml

Any extension

struts.rest.validationFailureStatusCode

The HTTP status code to return on validation failure

400

Any HTTP status code as an integer

struts.rest.namespace

Optional parameter to specify namespace for REST services

/

eg. /rest

struts.rest.content.restrictToGET

Optional parameter, if set to true blocks returning content from any other methods than GET, if set to false, the content can be returned for any kind of method

true

eg. put struts.rest.content.restrictToGET = false in struts.properties

Resource s

Version History

From Struts 2.1.1+

+

Use Jackson framework as JSON ContentTypeHandler

The default JSON Content Handler is build on top of the JSON-lib. If you prefer to use the Jackson framework for JSON serialisation, you can configure the JacksonLibHandler as Content Handler for your json requests. 

First you need to add the jackson dependency to your web application by downloading the jar file and put it under WEB-INF/lib or by adding following xml snippet to your dependencies section in the pom.xml when you are using maven as build system.

+ +

Now you can overwrite the Content Handler with the Jackson Content Handler in the struts.xml:

+ +

 

Settings

The following settings can be customized. See the developer guide.
For more configuration options see the Convention Plugin Documentation

Setting

Description

Default

Possible Values

struts.rest.handlerOverride.EXTENSION

The alias for the ContentTypeHandler implementation that handles the EXTENSION value

N/A

Any declared alias for a ContentTypeHandler implementation

struts.rest.defaultExtension

The default extension to use when none is explicitly specified in the request

xhtml

Any extension

struts.rest.validationFailureStatusCode

The HTTP status code to return on validation failure

400

Any HTTP st atus code as an integer

struts.rest.namespace

Optional parameter to specify namespace for REST services

/

eg. /rest

struts.rest.content.restrictToGET

Optional parameter, if set to true blocks returning content from any other methods than GET, if set to false, the content can be returned for any kind of method

true

eg. put struts.rest.content.restrictToGET = false in struts.properties

Resources

Version History

From Struts 2.1.1+

Modified: websites/production/struts/content/development/2.x/docs/security.html ============================================================================== --- websites/production/struts/content/development/2.x/docs/security.html (original) +++ websites/production/struts/content/development/2.x/docs/security.html Fri Nov 14 07:43:54 2014 @@ -138,7 +138,18 @@ under the License.
-

Security tips

The Apache Struts 2 doesn't provide any security mechanism - it is just a pure web framework. Below are few tips you should consider during application development with the Apache Struts 2.

Restrict access to the Config Browser

Config Browser Plugin exposes internal configuration and should be used only during development phase. If you must use it on production site, we strictly recommend restricting access to it - you can use  Basic Authentication or any other security mechanism (e.g. Apache Shiro)

Don't mix different access levels in the same namespace

Very often access to different resources is controlled based on URL p atterns, see snippet below. Because of that you cannot mix actions with different security levels in the same namespace. Always group actions in one namespace by security level.

+

+ +

Security tips

The Apache Struts 2 doesn't provide any security mechanism - it is just a pure web framework. Below are few tips you should consider during application development with the Apache Struts 2.

Restrict access to the Config Browser

Config Browser Plugin exposes internal configuration and should be used only during development phase. If you must use it on production site, we strictly recommend restricting access to it - you can use  Basic Authentication or any other security mechanism (e.g. Apache Shiro)

Don't mix different access levels in the same namespace

Very often access to different resources is controlled based on URL patterns, see snippet below. Becaus e of that you cannot mix actions with different security levels in the same namespace. Always group actions in one namespace by security level.

-
+

Internal security mechanism

The Apache Struts 2 contains internal security manager which blocks access to particular classes and Java packages - it's a OGNL-wide mechanism which means it affects any aspect of the framework ie. incoming parameters, expressions used in JSPs, etc.

The defaults are as follow:

+ +

Any expression or target which evaluates to one of these will be blocked and you see a WARN in logs:

+
[WARNING] Target class [class example.MyBean] or declaring class of member type [public example.MyBean()] are excluded!
+

In that case new MyBean() was used to create a new instance of class (inside JSP) - it's blocked because target of such expression is evaluated to java.lang.Class

+ Icon +
+

It is possible to redefine the above constants in struts.xml but try to avoid this and rather change design of your application!

+
+
+

OGNL is used to call action's methods

This can impact actions which have large inheritance hierarchy and use the same method's name throughout the hierarchy, this was reported as an issue WW-4405. See the example below:

+ +

In such case OGNL cannot properly map which method to call when request is coming. This is do the OGNL limitation. To solve the problem don't use the same method's names through the hierarchy, you can simply change the action's method from save() to saveAction() and leaving annotation as is to allow call this action via /save.action request.

Added: websites/production/struts/content/development/2.x/docs/version-notes-2319.html ============================================================================== --- websites/production/struts/content/development/2.x/docs/version-notes-2319.html (added) +++ websites/production/struts/content/development/2.x/docs/version-notes-2319.html Fri Nov 14 07:43:54 2014 @@ -0,0 +1,174 @@ + + + + + + + + + + + + + + + + + + + Version Notes 2.3.19 + + + + + + + +
+  Home > Guides > Migration Guide > Version Notes 2.3.19 + +
+ + + + + + +
+
+ +
+
+ + +
Apache Struts 2 Documentation
+
Version Notes 2.3.19
+ +
+ + + Edit Page +   + + + Browse Space +   + + + Add Page +   + + + Add News +
+
+ +
+
+

(tick) These are the notes for the Struts 2.3.19 distribution.

(tick) For prior notes in this release series, see Version Notes 2.3.16.1

  • If you are a Maven user, you might want to get started using the Maven Archetype.
  • Another quick-start entry point is the blank application. Rename and deploy the WAR as a starting point for your own development.
Maven Dependency
+ +

You can also use Struts Archetype Catalog like below

Struts Archetype Catalog
+ +
Staging Repository
+ +

Internal Changes

  • (warning) Merged security fixes from version 2.3.16.1, 2.3.16.2, 2.3.16.3
  • (warning) Extended existing security mechanism to block access to given Java packages and Classes, see #11 or read Internal security mechanism
  • Collection Parameters for Redir ectResults, WW-4224
  • Make ParametersInterceptor supports chinese in hash key by default, WW-4250
  • themes.properties can be loaded using ServletContext allows to put template folder under WEB-INF or on classpath, WW-4260
  • New tag datetextfield, WW-3493
  • Only valid Ognl expressions are cached, WW-4146
  • CustomTextProvider can be used for validation errors of model driven actions, WW-4202
  • datetimepicker's label fixed, WW-4254
  • PropertiesJudge removed and properties are checked in SecurityMemberAccess, WW-4257
  • resource reloading works in IBM JVM, WW-4266
  • default reloading settings were removed from default.properties, WW-4267
  • (warning) commons-fileupload library upgraded to version 1.3.1 to fix potential security vulnerability, WW-4286
  • The scheme attribute accepts expressions in s:url tag, WW-4024
  • Solves problem with infinite loop in FastByteArrayOutputStream, WW-4383
  • LocalizedTextUtil supports many ClassLoaders, WW-4379
  • Bill of Materials pom was introduced, WW-4326
  • debug=browser|console was migrated to jQuery, WW-4322
  • struts_dojo.js was fixed, WW-4349
  • interface org/apache/struts2/views/TagLibrary was restored and marked as @Depreacted, WW-4255
  • and many other small improvements, please see the release notes

 

+ Icon +
+

Please read information about new internal security mechanism introduced with this version, it can have impact on your application!

+
+
+

 

Issue Detail

Issue List

Other resources



+
+ + +
+
+
+ Generated by CXF SiteExporter +
+ + \ No newline at end of file Modified: websites/production/struts/content/release/2.3.x/docs/actionmapper.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/actionmapper.html (original) +++ websites/production/struts/content/release/2.3.x/docs/actionmapper.html Fri Nov 14 07:43:54 2014 @@ -139,11 +139,11 @@ under the License.
+/*]]>*/
  • Description
  • DefaultActionMapper
  • Custom ActionMapper
  • CompositeActionMapper
  • PrefixBasedActionMapper
  • ActionMapper and ActionMapping objects Modified: websites/production/struts/content/release/2.3.x/docs/building-struts-2-normal-release.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/building-struts-2-normal-release.html (original) +++ websites/production/struts/content/release/2.3.x/docs/building-struts-2-normal-release.html Fri Nov 14 07:43:54 2014 @@ -139,34 +139,39 @@ under the License.

    Content

    - +/*]]>*/

    +

    Building Steps (Struts)

    Getting ready

    1. Create an "Struts 2.x.y omnibus ticket" ticket in JIRA to refer to in upcoming release related commit comments and for general documentation purposes. Mark it with priority "Blocker".
    2. Switch to branch develop
    3. Ensure that the master POM and Struts Annotations have current releases
    4. Review JIRA for any issues without a fix version set, and for any issues that should be resolved for the pending release.
    5. Ensure that there are no repositories or pluginRepositories listed in the poms.
    6. If you have committed all changes regarding the release process, close the omnibus ticket as it is the last open ticket for the upcoming release
    7. Release the upcoming version in JIRA (under Administration/Manage Releases) and tag the release date
    8. Add next milestone ve rsion to the JIRA roadmap
    9. Create DONE and TODO filters for the new version, share with all, and remove obsolete TODO filter
    10. Create a new Version Notes page in Confluence, link from Migration Guide, and link to prior release page and JIRA DONE filters of the version to release
    11. Export wiki pages and put them under /docs

    Update Draft Docs when needed

    Checkout struts-site project (see details at the bottom of this page) and perform export:

    If build will fail try again - don't use clean, the exporter is going to update only outdated pages. After successful export, commit updated files into struts-production

    Be sure your local copy is up-to-date

    - -

    Create a release branch

    + +
    + Icon +
    +

    Please remember to keep BOM subproject in sync - <struts-version.version>X.X.X</struts-version.version> - must be the same as the parent pom.

    +
    +
    +

    Create a release branch

    -

    Now you should be on release/X.X.X.X branch (git status supposes confirm that). You must push changes to remote repo as the Release plugins will push changes to remote as well.

    Prepare release

    Tag the release by using the "release:prepare" goal of Maven:

    -

    For a dry run, add -DdryRun=true. If you do a dry run, use mvn release:clean to clean up after you have looked at the output.

    When prompted for the SCM tag name, follow this pattern: STRUTS_2_3_[PATCH_VERSION]

    Icon
    -

    If you get an error message, try to re-run mvn release:prepare -Dusername=yourSvnUsername -Dpassword=yourSvnPassword -DautoVersionSubmodules=true command again, -Dresume flag is set to true by default and the plugin will resume the release process from where it failed before.

    +

    If you get an error message, try to re-run mvn release:prepare -DautoVersionSubmodules=true command again, -Dresume flag is set to true by default and the plugin will resume the release process from where it failed before.

    Follow the link to get more information about performed operation by release plugin.

    Perform the release

    -

    Follow the link to get more information about performed operation by release plugin. After this step the artifacts will be hosted by Nexus.

    If you need to run perform again, (or in a different box), do:

    -

    Now both master and develop branches should be up to date with the changes introduced by the release.

    Vote on it

    Post a release/quality vote to the dev list (and only the dev list). The example mail is on Sample announcements page.
    If the vote result is for an ASF release (i.e. not test build), update site, announce. If the vote result is for GA, push to central.

    Copy files

    After the vote, if the distribution is being mirrored (there was a favourable release vote) copy the Sources and Binaries:

    +

    Now both master and develop branches should be up to date with the changes introduced by the release.

    + Icon +
    +

    Do not remove the tag! It clearly indicates what was planned and it can be used as a history marker. Always used the next version number, do not redeploy the same version as it breaks Maven's policy and you will have to manually clean up Maven repository.

    +
    +
    +

    Vote on it

    Post a release/quality vote to the dev list (and only the dev list). The example mail is on Sample announcements page.
    If the vote result is for an ASF release (i.e. not test build), update site, announce. If the vote result is for GA, push to central.

    Copy files

    After the vote, if the distribution is being mirrored (there was a favourable release vote) copy the Sources and Binaries:

  • If a new DTD was defined, add it to source/dtds
  • Update current version and release date in struts-site/_config.yml
  • Update page source files
    • struts-site/source/announce.md (if applicable, refer also to corresponding security bulletin)
    • struts-site/source/downloads.html (Prior Releases section)
    • struts-site/source/index.html (some parts will updated automatically with values defined in _config.yml)
  • Generate site with Jekyll
    • jekyll build
    • with jekyll serve -w you can check the generated site at http://localhost:4000

  • Commit the changes and the generated content

Now the changes must be deployed to production which is basically a separated Subversion repository, you check it out with command below:

-

It's a good idea to keep that working copy to be used with future releases. Right now copy content of struts-site/content to struts-production, then commit changes. Next step is to update exported wiki pages. With current approach the pages are kept in struts-production/release/2.X.x/docs where X is the current branch (ie. 2.3.x, 2.2.x and so on). Simply remove the whole content from under /docs and update it with docs from assembly (you can download one from Maven repository or copy generated during release process which supposes to be in struts/assembly/target/cwiki). And commit changes.

Redeploy the draft docs (Optional)

Make public available all the pages that could leak confidential information about the vulnerability. Wait or manually e xport the space in Confluence. Build snapshot locally and copy assembly/target/assembly/out/struts2-#.#.#-SNAPSHOT-docs.zip to people.apache.org and update /www/struts.apache.org/2.x/docs

Post announcements

We leave this as the last step, once the artifacts have had time to sync up on the mirrors. Target it to: user@struts.a.o and announcements@struts.a.o, samples are available at Sample announcements page

+

It's a good idea to keep that working copy to be used with future releases. Right now copy content of struts-site/content to struts-production, then commit changes. Next step is to update exported wiki pages. With current approach the pages are kept in struts-production/release/2.X.x/docs where X is the current branch (ie. 2.3.x, 2.2.x and so on). Simply remove the whole content from under /docs and update it with docs from assembly (you can download one from Maven repository or copy generated during release process which supposes to be in struts/assembly/target/cwiki). And commit changes.

Redeploy the draft docs (Optional)

  • Checkout source of the website and export Confluence pages

    + +

    Now the whole Confluence space is exported to target/cwiki/WW/docs/

  • Checkout copy of production website

    + +

    (you can checkout just a subtree, but it's better to checkout the whole repo especially when you want to update also the main web page)

  • Update production

    + +

Post announcements

We leave this as the last step, once the artifacts have had time to sync up on the mirrors. Target it to: user@struts.a.o and announcements@struts.a.o, samples are available at Sample announcements page

Modified: websites/production/struts/content/release/2.3.x/docs/file-upload.html ============================================================================== --- websites/production/struts/content/release/2.3.x/docs/file-upload.html (original) +++ websites/production/struts/content/release/2.3.x/docs/file-upload.html Fri Nov 14 07:43:54 2014 @@ -139,11 +139,11 @@ under the License.

The Struts 2 framework provides built-in support for processing file uploads that conform to RFC 1867, "Form-based File Upload in HTML". When correctly configured the framework will pass uploaded file(s) into your Action class. Support for individual and multiple file uploads are provided. When a file is uploaded it will typically be stored in a temporary directory. Uploaded files should be processed or moved by your Action class to ensure the data is not lost. Be aware that servers may have a security policy in place that prohibits you from writing to directories other than the temporary directory and the directories that belong to your web application.

+/*]]>*/