Return-Path: <issues-return-27825-archive-asf-public=cust-asf.ponee.io@struts.apache.org>
X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io
Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io
Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183])
	by cust-asf2.ponee.io (Postfix) with ESMTP id 4BCCA200B32
	for <archive-asf-public-internal@cust-asf2.ponee.io>; Thu, 23 Jun 2016 09:14:18 +0200 (CEST)
Received: by cust-asf.ponee.io (Postfix)
	id 4A73D160A58; Thu, 23 Jun 2016 07:14:18 +0000 (UTC)
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by cust-asf.ponee.io (Postfix) with SMTP id 9DFFC160A68
	for <archive-asf-public@cust-asf.ponee.io>; Thu, 23 Jun 2016 09:14:17 +0200 (CEST)
Received: (qmail 7358 invoked by uid 500); 23 Jun 2016 07:14:16 -0000
Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:issues-help@struts.apache.org>
List-Unsubscribe: <mailto:issues-unsubscribe@struts.apache.org>
List-Post: <mailto:issues@struts.apache.org>
List-Id: <issues.struts.apache.org>
Reply-To: dev@struts.apache.org
Delivered-To: mailing list issues@struts.apache.org
Received: (qmail 7254 invoked by uid 99); 23 Jun 2016 07:14:16 -0000
Received: from arcas.apache.org (HELO arcas) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 23 Jun 2016 07:14:16 +0000
Received: from arcas.apache.org (localhost [127.0.0.1])
	by arcas (Postfix) with ESMTP id 8A5C82C1F62
	for <issues@struts.apache.org>; Thu, 23 Jun 2016 07:14:16 +0000 (UTC)
Date: Thu, 23 Jun 2016 07:14:16 +0000 (UTC)
From: "Greg Huber (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12974788.1464785968000.7067.1466666056564@Atlassian.JIRA>
In-Reply-To: <JIRA.12974788.1464785968000@Atlassian.JIRA>
References: <JIRA.12974788.1464785968000@Atlassian.JIRA> <JIRA.12974788.1464785968461@arcas>
Subject: [jira] [Comment Edited] (WW-4641) CVE-2016-0785
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394
archived-at: Thu, 23 Jun 2016 07:14:18 -0000


    [ https://issues.apache.org/jira/browse/WW-4641?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15345939#comment-15345939 ] 

Greg Huber edited comment on WW-4641 at 6/23/16 7:13 AM:
---------------------------------------------------------

If %{bean.id} is not referring to id="bean" of the iterator, rather the page bean, them I am incorrect as have not understood the issue.

{code:xml}
<s:iterator value="beanList" id="bean">
<s:textfield name="beanList(%/{bean.id}).name" />
{code}
this works for me:
{code:xml}
<s:iterator var="bean" value="eventList">
<s:hidden name="eventList(%/{#bean.sequence}).sequence" value="%/{#bean.sequence}" />
{code}


was (Author: gregh99):
If %{bean.id} is not referring to id="bean" of the iterator, rather the page bean, them I am incorrect as have not understood the issue.

{code:xml}
<s:iterator value="beanList" id="bean">
<s:textfield name="beanList(%{bean.id}).name" />
{code}
this works for me:
{code:xml}
<s:iterator var="bean" value="eventList">
<s:hidden name="eventList(%/{#bean.sequence}).sequence" value="%/{#bean.sequence}" />
{code}

> CVE-2016-0785
> -------------
>
>                 Key: WW-4641
>                 URL: https://issues.apache.org/jira/browse/WW-4641
>             Project: Struts 2
>          Issue Type: New Feature
>          Components: Expression Language
>    Affects Versions: 2.3.20
>         Environment:  apache tomcat 6.0.27
>            Reporter: Samba
>            Assignee: Lukasz Lenart
>              Labels: features
>             Fix For: 2.3.30
>
>   Original Estimate: 168h
>  Remaining Estimate: 168h
>
> Hi Team,
> http://struts.apache.org/docs/s2-029.html
> please suggest the replacement code for %{..} for the latest version of the struts 2.3.28
> Thanks
> Sambasiva Rao



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)