svn commit: r1011991 - in /websites/production/struts/content/docs: freemarker-result.html interceptors.html noop-interceptor.html s2-028.html spring-plugin.html

Tue, 09 May 2017 23:35:38 -0700 

Author: lukaszlenart
Date: Wed May 10 06:35:13 2017
New Revision: 1011991

Log:
Updates production

Added:
    websites/production/struts/content/docs/noop-interceptor.html
Modified:
    websites/production/struts/content/docs/freemarker-result.html
    websites/production/struts/content/docs/interceptors.html
    websites/production/struts/content/docs/s2-028.html
    websites/production/struts/content/docs/spring-plugin.html

Modified: websites/production/struts/content/docs/freemarker-result.html
==============================================================================
--- websites/production/struts/content/docs/freemarker-result.html (original)
+++ websites/production/struts/content/docs/freemarker-result.html Wed May 10 
06:35:13 2017
@@ -139,38 +139,9 @@ under the License.
 
     <div class="pagecontent">
         <div class="wiki-content">
-            <div id="ConfluenceContent">
-
-<p>Renders a view using the Freemarker template engine.
-</p><p>
-The FreemarkarManager class configures the template loaders so that the
-template location can be either
-</p>
-
-<p></p><ul></ul><p></p><ul><li>relative to the web root folder. eg 
<code>/WEB-INF/views/home.ftl</code>
-</li></ul><p></p><ul><li>a classpath resuorce. eg 
<code>/com/company/web/views/home.ftl</code></li></ul><p></p>
-
-
-<p>Also see <a shape="rect" href="freemarker-support.html">Freemarker 
Support</a>.</p>
-
-<h2 id="FreeMarkerResult-Parameters">Parameters</h2>
-
-
-<p></p><ul></ul><p></p><ul><li><b>location (default)</b> - the location of the 
template to process.</li></ul><p></p><ul><li><b>parse</b> - true by default. If 
set to false, the location param will
-not be parsed for Ognl expressions.</li></ul><p></p><ul><li><b>contentType</b> 
- defaults to "text/html" unless 
specified.</li></ul><p></p><ul><li><b>writeIfCompleted</b> - false by default, 
write to stream only if there isn't any error 
-processing the template. Setting template_exception_handler=rethrow in 
freemarker.properties
-will have the same effect.</li></ul><p></p>
-
-
-<h2 id="FreeMarkerResult-Examples">Examples</h2>
-
-<div class="code panel pdl" style="border-width: 1px;"><div class="codeContent 
panelContent pdl">
-<script class="brush: xml; gutter: false; theme: Default" 
type="syntaxhighlighter"><![CDATA[
-
-&lt;result name=&quot;success&quot; 
type=&quot;freemarker&quot;&gt;foo.ftl&lt;/result&gt;
-
-]]></script>
-</div></div></div>
+            <div id="ConfluenceContent"><p>Renders a view using the Freemarker 
template engine. The <code>FreemarkarManager</code>&#160;class configures the 
template loaders so that the template location can be either</p><ul 
style="list-style-type: square;"><li>relative to the web root folder, 
e.g.:&#160;<code>/WEB-INF/views/home.ftl</code></li><li>a classpath resource, 
e.g.: 
<code>/com/company/web/views/home.ftl</code></li></ul><p>&#160;</p><p>Also see 
<a shape="rect" href="freemarker-support.html">Freemarker Support</a>.</p><h2 
id="FreeMarkerResult-Parameters">Parameters</h2><ul style="list-style-type: 
square;"><li><strong>location</strong> (default) - the location of the template 
to process.</li><li><strong>parse&#160;</strong>- true by default. If set to 
false, the location param will not be parsed for 
expressions.</li><li><strong>contentType</strong>&#160;- defaults to 
<code>text/html</code>&#160;unless 
specified.</li><li><strong>writeIfCompleted</strong>&#160;- <code>false</co
 de>&#160;by default, write to stream only if there isn't any error processing 
the template. Setting <code>template_exception_handler=rethrow</code>&#160;in 
<code>freemarker.properties</code>&#160;will have the same effect.</li></ul><h2 
id="FreeMarkerResult-Examples">Examples</h2><div class="code panel pdl" 
style="border-width: 1px;"><div class="codeContent panelContent pdl">
+<pre class="brush: xml; gutter: false; theme: Default" 
style="font-size:12px;">&lt;result name="success" 
type="freemarker"&gt;foo.ftl&lt;/result&gt;</pre>
+</div></div><p>&#160;</p><p>&#160;</p></div>
         </div>
 
                     <div class="tabletitle">

Modified: websites/production/struts/content/docs/interceptors.html
==============================================================================
--- websites/production/struts/content/docs/interceptors.html (original)
+++ websites/production/struts/content/docs/interceptors.html Wed May 10 
06:35:13 2017
@@ -140,11 +140,11 @@ under the License.
     <div class="pagecontent">
         <div class="wiki-content">
             <div id="ConfluenceContent"><div 
class="confluence-information-macro confluence-information-macro-tip"><span 
class="aui-icon aui-icon-small aui-iconfont-approve 
confluence-information-macro-icon"></span><div 
class="confluence-information-macro-body"><p>The default Interceptor stack is 
designed to serve the needs of most applications. Most applications will 
<strong>not</strong> need to add Interceptors or change the Interceptor 
stack.</p></div></div><p>Many Actions share common concerns. Some Actions need 
input validated. Other Actions may need a file upload to be pre-processed. 
Another Action might need protection from a double submit. Many Actions need 
drop-down lists and other controls pre-populated before the page 
displays.</p><p>The framework makes it easy to share solutions to these 
concerns using an "Interceptor" strategy. When you request a resource that maps 
to an "action", the framework invokes the Action object. But, before the Action 
is executed, the invocatio
 n can be intercepted by another object. After the Action executes, the 
invocation could be intercepted again. Unsurprisingly, we call these objects 
"Interceptors."</p><p><style type="text/css">/*<![CDATA[*/
-div.rbtoc1492969959447 {padding: 0px;}
-div.rbtoc1492969959447 ul {list-style: disc;margin-left: 0px;}
-div.rbtoc1492969959447 li {margin-left: 0px;padding-left: 0px;}
+div.rbtoc1494398043379 {padding: 0px;}
+div.rbtoc1494398043379 ul {list-style: disc;margin-left: 0px;}
+div.rbtoc1494398043379 li {margin-left: 0px;padding-left: 0px;}
 
-/*]]>*/</style></p><div class="toc-macro rbtoc1492969959447">
+/*]]>*/</style></p><div class="toc-macro rbtoc1494398043379">
 <ul class="toc-indentation"><li><a shape="rect" 
href="#Interceptors-UnderstandingInterceptors">Understanding 
Interceptors</a></li><li><a shape="rect" 
href="#Interceptors-ConfiguringInterceptors">Configuring 
Interceptors</a></li><li><a shape="rect" 
href="#Interceptors-StackingInterceptors">Stacking Interceptors</a>
 <ul class="toc-indentation"><li><a shape="rect" 
href="#Interceptors-TheDefaultConfiguration">The Default 
Configuration</a></li></ul>
 </li><li><a shape="rect" href="#Interceptors-FrameworkInterceptors">Framework 
Interceptors</a>
@@ -425,6 +425,12 @@ div.rbtoc1492969959447 li {margin-left:
             &lt;interceptor name=&quot;roles&quot; 
class=&quot;org.apache.struts2.interceptor.RolesInterceptor&quot; /&gt;
             &lt;interceptor name=&quot;annotationWorkflow&quot; 
class=&quot;com.opensymphony.xwork2.interceptor.annotations.AnnotationWorkflowInterceptor&quot;
 /&gt;
             &lt;interceptor name=&quot;multiselect&quot; 
class=&quot;org.apache.struts2.interceptor.MultiselectInterceptor&quot; /&gt;
+            &lt;interceptor name=&quot;noop&quot; 
class=&quot;org.apache.struts2.interceptor.NoOpInterceptor&quot; /&gt;
+
+            &lt;!-- Empty stack - performs no operations --&gt;
+            &lt;interceptor-stack name=&quot;emptyStack&quot;&gt;
+                &lt;interceptor-ref name=&quot;noop&quot;/&gt;
+            &lt;/interceptor-stack&gt;
 
             &lt;!-- Basic stack --&gt;
             &lt;interceptor-stack name=&quot;basicStack&quot;&gt;
@@ -575,7 +581,7 @@ div.rbtoc1492969959447 li {margin-left:
 
 &lt;/struts&gt;
 ]]></script>
-</div></div>Since the <code>struts-default.xml</code> is included in the 
application's configuration by default, all of the predefined interceptors and 
stacks are available "out of the box".<h2 
id="Interceptors-FrameworkInterceptors">Framework 
Interceptors</h2><p>Interceptor classes are also defined using a key-value pair 
specified in the Struts configuration file. The names specified below come 
specified in <a shape="rect" 
href="struts-defaultxml.html">struts-default.xml</a>. If you extend the 
<code>struts-default</code> package, then you can use the names below. 
Otherwise, they must be defined in your package with a name-class pair 
specified in the &lt;interceptors&gt; tag.</p><div class="table-wrap"><table 
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Interceptor</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="
 1" class="confluenceTd"><p><a shape="rect" href="alias-interceptor.html">Alias 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>alias</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Converts similar parameters that may be named 
differently between requests.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="chaining-interceptor.html">Chaining Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>chain</p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Makes the previous Action's properties 
available to the current Action. Commonly used together with &lt;result 
type="chain"&gt; (in the previous Action).</p></td></tr><tr><td colspan="1" 
rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="checkbox-interceptor.html">Checkbox Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>checkbox</p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>Adds 
 automatic checkbox handling code that detect an unchecked checkbox and add it 
as a parameter with a default (usually 'false') value. Uses a specially named 
hidden field to detect unsubmitted checkboxes. The default unchecked value is 
overridable for non-boolean value'd checkboxes.</p></td></tr><tr><td 
colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="cookie-interceptor.html">Cookie Interceptor</a></p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>cookie</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Inject cookie with a certain configurable name / value 
into action. (Since 2.0.7.)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="cookieprovider-interceptor.html">CookieProvider 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>cookieProvider</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Transfer cookies from action to response (Since 
2.3.15.)</p></td></tr><tr><t
 d colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="conversion-error-interceptor.html">Conversion Error 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>conversionError</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Adds conversion errors from the ActionContext to the 
Action's field errors</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="create-session-interceptor.html">Create Session 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>createSession</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Create an HttpSession automatically, useful with 
certain Interceptors that require a HttpSession to work properly (like the 
TokenInterceptor)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="debugginginterceptor.html">DebuggingInterceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>debugging</p
 ></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Provides several 
 >different debugging screens to provide insight into the data behind the 
 >page.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
 >shape="rect" href="execute-and-wait-interceptor.html">Execute and Wait 
 >Interceptor</a></p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p>execAndWait</p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p>Executes the Action in the background and then sends 
 >the user off to an intermediate waiting page.</p></td></tr><tr><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
 >href="exception-interceptor.html">Exception Interceptor</a></p></td><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p>exception</p></td><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p>Maps exceptions to a 
 >result.</p></td></tr><tr><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><a shape="rect" 
 >href="file-upload-interceptor.html">File Upload Interceptor</a></
 p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>fileUpload</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>An Interceptor that adds easy access to file upload 
support.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="i18n-interceptor.html">I18n 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>i18n</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Remembers the locale selected for a user's 
session.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="logger-interceptor.html">Logger 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>logger</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Outputs the name of the Action.</p></td></tr><tr><td 
colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="message-store-interceptor.html">Message Store Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="
 confluenceTd"><p>store</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Store and retrieve action messages / errors / field 
errors for action that implements ValidationAware interface into 
session.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="model-driven-interceptor.html">Model Driven Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>modelDriven</p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>If the Action implements 
ModelDriven, pushes the <code>getModel</code> Result onto the Value 
Stack.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="scoped-model-driven-interceptor.html">Scoped Model Driven 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>scopedModelDriven</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>If the Action implements ScopedModelDriven, the 
interceptor retrieves and stores the model from a scop
 e and sets it on the action calling 
<code>setModel</code>.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="parameters-interceptor.html">Parameters Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>params</p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Sets the request parameters onto the 
Action.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="prepare-interceptor.html">Prepare 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>prepare</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>If the Action implements Preparable, calls its 
<code>prepare</code> method.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="scope-interceptor.html">Scope 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>scope</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Simple mech
 anism for storing Action state in the session or application 
scope.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="servlet-config-interceptor.html">Servlet Config 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>servletConfig</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Provide access to Maps representing HttpServletRequest 
and HttpServletResponse.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="static-parameters-interceptor.html">Static Parameters 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>staticParams</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Sets the <code>struts.xml</code> defined parameters 
onto the action. These are the &lt;param&gt; tags that are direct children of 
the &lt;action&gt; tag.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="roles-interceptor.htm
 l">Roles Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>roles</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Action will only be executed if the user has the 
correct JAAS role.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="timer-interceptor.html">Timer 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>timer</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Outputs how long the Action takes to execute (including 
nested Interceptors and View)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="token-interceptor.html">Token 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>token</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Checks for valid token presence in Action, prevents 
duplicate form submission.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" hr
 ef="token-session-interceptor.html">Token Session Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>tokenSession</p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>Same as Token Interceptor, but 
stores the submitted data in session when handed an invalid 
token</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="validation-interceptor.html">Validation 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>validation</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Performs validation using the validators defined in 
<em>action</em>-validation.xml</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="default-workflow-interceptor.html">Default Workflow 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>workflow</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Calls the <code>validate</code> method in your Actio
 n class. If Action errors are created then it returns the <code>INPUT</code> 
view.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="parameter-filter-interceptor.html">Parameter Filter 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>N/A</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Removes parameters from the list of those available to 
Actions</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="profiling-interceptor.html">Profiling 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>profiling</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Activate profiling through 
parameter</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="multiselect-interceptor.html">Multiselect Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>multiselect</p></td><td 
colspan="1" rowspan="1"
  class="confluenceTd"><p>Like the checkbox interceptor detects that no value 
was selected for a field with multiple values (like a select) and adds an empty 
parameter</p></td></tr></tbody></table></div><div 
class="confluence-information-macro confluence-information-macro-warning"><span 
class="aui-icon aui-icon-small aui-iconfont-error 
confluence-information-macro-icon"></span><div 
class="confluence-information-macro-body"><p>Since 2.0.7, Interceptors and 
Results with hyphenated names were converted to camelCase. (The former 
model-driven is now modelDriven.) The original hyphenated names are retained as 
"aliases" until Struts 2.1.0. For clarity, the hyphenated versions are not 
listed here, but might be referenced in prior versions of the 
documentation.</p></div></div><h3 id="Interceptors-MethodFiltering">Method 
Filtering</h3><p>
+</div></div>Since the <code>struts-default.xml</code> is included in the 
application's configuration by default, all of the predefined interceptors and 
stacks are available "out of the box".<h2 
id="Interceptors-FrameworkInterceptors">Framework 
Interceptors</h2><p>Interceptor classes are also defined using a key-value pair 
specified in the Struts configuration file. The names specified below come 
specified in <a shape="rect" 
href="struts-defaultxml.html">struts-default.xml</a>. If you extend the 
<code>struts-default</code> package, then you can use the names below. 
Otherwise, they must be defined in your package with a name-class pair 
specified in the &lt;interceptors&gt; tag.</p><div class="table-wrap"><table 
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Interceptor</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Name</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Description</p></th></tr><tr><td colspan="1" rowspan="
 1" class="confluenceTd"><p><a shape="rect" href="alias-interceptor.html">Alias 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>alias</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Converts similar parameters that may be named 
differently between requests.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="chaining-interceptor.html">Chaining Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>chain</p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Makes the previous Action's properties 
available to the current Action. Commonly used together with &lt;result 
type="chain"&gt; (in the previous Action).</p></td></tr><tr><td colspan="1" 
rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="checkbox-interceptor.html">Checkbox Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>checkbox</p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>Adds 
 automatic checkbox handling code that detect an unchecked checkbox and add it 
as a parameter with a default (usually 'false') value. Uses a specially named 
hidden field to detect unsubmitted checkboxes. The default unchecked value is 
overridable for non-boolean value'd checkboxes.</p></td></tr><tr><td 
colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="cookie-interceptor.html">Cookie Interceptor</a></p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>cookie</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Inject cookie with a certain configurable name / value 
into action. (Since 2.0.7.)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="cookieprovider-interceptor.html">CookieProvider 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>cookieProvider</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Transfer cookies from action to response (Since 
2.3.15.)</p></td></tr><tr><t
 d colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="conversion-error-interceptor.html">Conversion Error 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>conversionError</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Adds conversion errors from the ActionContext to the 
Action's field errors</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="create-session-interceptor.html">Create Session 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>createSession</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Create an HttpSession automatically, useful with 
certain Interceptors that require a HttpSession to work properly (like the 
TokenInterceptor)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="debugginginterceptor.html">DebuggingInterceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>debugging</p
 ></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Provides several 
 >different debugging screens to provide insight into the data behind the 
 >page.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
 >shape="rect" href="execute-and-wait-interceptor.html">Execute and Wait 
 >Interceptor</a></p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p>execAndWait</p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p>Executes the Action in the background and then sends 
 >the user off to an intermediate waiting page.</p></td></tr><tr><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
 >href="exception-interceptor.html">Exception Interceptor</a></p></td><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p>exception</p></td><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p>Maps exceptions to a 
 >result.</p></td></tr><tr><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><a shape="rect" 
 >href="file-upload-interceptor.html">File Upload Interceptor</a></
 p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>fileUpload</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>An Interceptor that adds easy access to file upload 
support.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="i18n-interceptor.html">I18n 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>i18n</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Remembers the locale selected for a user's 
session.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="logger-interceptor.html">Logger 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>logger</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Outputs the name of the Action.</p></td></tr><tr><td 
colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" 
href="message-store-interceptor.html">Message Store Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="
 confluenceTd"><p>store</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Store and retrieve action messages / errors / field 
errors for action that implements ValidationAware interface into 
session.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="model-driven-interceptor.html">Model Driven Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>modelDriven</p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>If the Action implements 
ModelDriven, pushes the <code>getModel</code> Result onto the Value 
Stack.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="scoped-model-driven-interceptor.html">Scoped Model Driven 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>scopedModelDriven</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>If the Action implements ScopedModelDriven, the 
interceptor retrieves and stores the model from a scop
 e and sets it on the action calling 
<code>setModel</code>.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="parameters-interceptor.html">Parameters Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>params</p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Sets the request parameters onto the 
Action.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="prepare-interceptor.html">Prepare 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>prepare</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>If the Action implements Preparable, calls its 
<code>prepare</code> method.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="scope-interceptor.html">Scope 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>scope</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Simple mech
 anism for storing Action state in the session or application 
scope.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="servlet-config-interceptor.html">Servlet Config 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>servletConfig</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Provide access to Maps representing HttpServletRequest 
and HttpServletResponse.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="static-parameters-interceptor.html">Static Parameters 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>staticParams</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Sets the <code>struts.xml</code> defined parameters 
onto the action. These are the &lt;param&gt; tags that are direct children of 
the &lt;action&gt; tag.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="roles-interceptor.htm
 l">Roles Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>roles</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Action will only be executed if the user has the 
correct JAAS role.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="timer-interceptor.html">Timer 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>timer</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Outputs how long the Action takes to execute (including 
nested Interceptors and View)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" href="token-interceptor.html">Token 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>token</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Checks for valid token presence in Action, prevents 
duplicate form submission.</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" hr
 ef="token-session-interceptor.html">Token Session Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>tokenSession</p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>Same as Token Interceptor, but 
stores the submitted data in session when handed an invalid 
token</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="validation-interceptor.html">Validation 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>validation</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Performs validation using the validators defined in 
<em>action</em>-validation.xml</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="default-workflow-interceptor.html">Default Workflow 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>workflow</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Calls the <code>validate</code> method in your Actio
 n class. If Action errors are created then it returns the <code>INPUT</code> 
view.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="parameter-filter-interceptor.html">Parameter Filter 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>N/A</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Removes parameters from the list of those available to 
Actions</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><a 
shape="rect" href="profiling-interceptor.html">Profiling 
Interceptor</a></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>profiling</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Activate profiling through 
parameter</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><a shape="rect" 
href="multiselect-interceptor.html">Multiselect Interceptor</a></p></td><td 
colspan="1" rowspan="1" class="confluenceTd"><p>multiselect</p></td><td 
colspan="1" rowspan="1"
  class="confluenceTd"><p>Like the checkbox interceptor detects that no value 
was selected for a field with multiple values (like a select) and adds an empty 
parameter</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><a 
shape="rect" href="noop-interceptor.html">NoOp Interceptor</a></td><td 
colspan="1" rowspan="1" class="confluenceTd">noop</td><td colspan="1" 
rowspan="1" class="confluenceTd">Does nothing, just passes invocation further, 
used in empty stack</td></tr></tbody></table></div><div 
class="confluence-information-macro confluence-information-macro-warning"><span 
class="aui-icon aui-icon-small aui-iconfont-error 
confluence-information-macro-icon"></span><div 
class="confluence-information-macro-body"><p>Since 2.0.7, Interceptors and 
Results with hyphenated names were converted to camelCase. (The former 
model-driven is now modelDriven.) The original hyphenated names are retained as 
"aliases" until Struts 2.1.0. For clarity, the hyphenated versions are not 
listed 
 here, but might be referenced in prior versions of the 
documentation.</p></div></div><h3 id="Interceptors-MethodFiltering">Method 
Filtering</h3><p>
 </p><p></p><p>
 MethodFilterInterceptor is an abstract <code>Interceptor</code> used as
 a base class for interceptors that will filter execution based on method 
@@ -716,6 +722,9 @@ thisWillRunFirstInterceptor
                     <span class="smalltext">(Apache Struts 2 
Documentation)</span>
                     <br>
                                     $page.link($child)
+                    <span class="smalltext">(Apache Struts 2 
Documentation)</span>
+                    <br>
+                                    $page.link($child)
                     <span class="smalltext">(Apache Struts 2 
Documentation)</span>
                     <br>
                                     $page.link($child)

Added: websites/production/struts/content/docs/noop-interceptor.html
==============================================================================
--- websites/production/struts/content/docs/noop-interceptor.html (added)
+++ websites/production/struts/content/docs/noop-interceptor.html Wed May 10 
06:35:13 2017
@@ -0,0 +1,138 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
"http://www.w3.org/TR/html4/loose.dtd";>
+<!-- 
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License. 
+-->
+<html>
+<head>
+    <link type="text/css" rel="stylesheet" 
href="https://struts.apache.org/css/default.css";>
+    <style type="text/css">
+        .dp-highlighter {
+            width:95% !important;
+        }
+    </style>
+    <style type="text/css">
+        .footer {
+            background-image:      
url('https://cwiki.apache.org/confluence/images/border/border_bottom.gif');
+            background-repeat:     repeat-x;
+            background-position:   left top;
+            padding-top:           4px;
+            color:                 #666;
+        }
+    </style>
+    <script type="text/javascript" language="javascript">
+        var hide = null;
+        var show = null;
+        var children = null;
+
+        function init() {
+            /* Search form initialization */
+            var form = document.forms['search'];
+            if (form != null) {
+                form.elements['domains'].value = location.hostname;
+                form.elements['sitesearch'].value = location.hostname;
+            }
+
+            /* Children initialization */
+            hide = document.getElementById('hide');
+            show = document.getElementById('show');
+            children = document.all != null ?
+                    document.all['children'] :
+                    document.getElementById('children');
+            if (children != null) {
+                children.style.display = 'none';
+                show.style.display = 'inline';
+                hide.style.display = 'none';
+            }
+        }
+
+        function showChildren() {
+            children.style.display = 'block';
+            show.style.display = 'none';
+            hide.style.display = 'inline';
+        }
+
+        function hideChildren() {
+            children.style.display = 'none';
+            show.style.display = 'inline';
+            hide.style.display = 'none';
+        }
+    </script>
+    <title>NoOp Interceptor</title>
+</head>
+<body onload="init()">
+<table border="0" cellpadding="2" cellspacing="0" width="100%">
+    <tr class="topBar">
+        <td align="left" valign="middle" class="topBarDiv" align="left" nowrap>
+            &nbsp;<a href="home.html">Home</a>&nbsp;&gt;&nbsp;<a 
href="guides.html">Guides</a>&nbsp;&gt;&nbsp;<a 
href="core-developers-guide.html">Core Developers Guide</a>&nbsp;&gt;&nbsp;<a 
href="interceptors.html">Interceptors</a>&nbsp;&gt;&nbsp;<a 
href="noop-interceptor.html">NoOp Interceptor</a>
+        </td>
+        <td align="right" valign="middle" nowrap>
+            <form name="search" action="https://www.google.com/search"; 
method="get">
+                <input type="hidden" name="ie" value="UTF-8" />
+                <input type="hidden" name="oe" value="UTF-8" />
+                <input type="hidden" name="domains" value="" />
+                <input type="hidden" name="sitesearch" value="" />
+                <input type="text" name="q" maxlength="255" value="" />
+                <input type="submit" name="btnG" value="Google Search" />
+            </form>
+        </td>
+    </tr>
+</table>
+
+<div id="PageContent">
+    <div class="pageheader" style="padding: 6px 0px 0px 0px;">
+        <!-- We'll enable this once we figure out how to access (and save) the 
logo resource -->
+        <!--img src="/wiki/images/confluence_logo.gif" style="float: left; 
margin: 4px 4px 4px 10px;" border="0"-->
+        <div style="margin: 0px 10px 0px 10px" class="smalltext">Apache Struts 
2 Documentation</div>
+        <div style="margin: 0px 10px 8px 10px"  class="pagetitle">NoOp 
Interceptor</div>
+
+        <div class="greynavbar" align="right" style="padding: 2px 10px; 
margin: 0px;">
+            <a 
href="https://cwiki.apache.org/confluence/pages/editpage.action?pageId=69407923";>
+                <img 
src="https://cwiki.apache.org/confluence/images/icons/notep_16.gif";
+                     height="16" width="16" border="0" align="absmiddle" 
title="Edit Page"></a>
+            <a 
href="https://cwiki.apache.org/confluence/pages/editpage.action?pageId=69407923";>Edit
 Page</a>
+            &nbsp;
+            <a 
href="https://cwiki.apache.org/confluence/pages/listpages.action?key=WW";>
+                <img 
src="https://cwiki.apache.org/confluence/images/icons/browse_space.gif";
+                     height="16" width="16" border="0" align="absmiddle" 
title="Browse Space"></a>
+            <a 
href="https://cwiki.apache.org/confluence/pages/listpages.action?key=WW";>Browse 
Space</a>
+            &nbsp;
+            <a 
href="https://cwiki.apache.org/confluence/pages/createpage.action?spaceKey=WW&fromPageId=69407923";>
+                <img 
src="https://cwiki.apache.org/confluence/images/icons/add_page_16.gif";
+                     height="16" width="16" border="0" align="absmiddle" 
title="Add Page"></a>
+            <a 
href="https://cwiki.apache.org/confluence/pages/createpage.action?spaceKey=WW&fromPageId=69407923";>Add
 Page</a>
+            &nbsp;
+            <a 
href="https://cwiki.apache.org/confluence/pages/createblogpost.action?spaceKey=WW&fromPageId=69407923";>
+                <img 
src="https://cwiki.apache.org/confluence/images/icons/add_blogentry_16.gif";
+                     height="16" width="16" border="0" align="absmiddle" 
title="Add News"></a>
+            <a 
href="https://cwiki.apache.org/confluence/pages/createblogpost.action?spaceKey=WW&fromPageId=69407923";>Add
 News</a>
+        </div>
+    </div>
+
+    <div class="pagecontent">
+        <div class="wiki-content">
+            <div 
id="ConfluenceContent"><p><code>org.apache.struts2.interceptor.NoOpInterceptor</code>
 is in the&#160;<code>emptyStack</code> and it performs no computation, it is 
there to allow create an empty stack that can be used with actions that do not 
required receiving request parameters or are fully stateless, i.e. when 
producing a JSON response on public endpoints.</p></div>
+        </div>
+
+        
+    </div>
+</div>
+<div class="footer">
+    Generated by CXF SiteExporter
+</div>
+</body>
+</html>

Modified: websites/production/struts/content/docs/s2-028.html
==============================================================================
--- websites/production/struts/content/docs/s2-028.html (original)
+++ websites/production/struts/content/docs/s2-028.html Wed May 10 06:35:13 2017
@@ -125,7 +125,7 @@ under the License.
 
     <div class="pagecontent">
         <div class="wiki-content">
-            <div id="ConfluenceContent"><h2 
id="S2-028-Summary">Summary</h2>Use of a JRE with broken URLDecoder 
implementation may lead to XSS vulnerability in Struts 2 based web 
applications.<div class="table-wrap"><table 
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Who should read this</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>All Struts 2 developers and 
users</p></td></tr><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Impact of vulnerability</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Affects of a cross-site scripting 
vulnerability.</p></td></tr><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Maximum security rating</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Important</p></td></tr><tr><th colspan="1" 
rowspan="1" class="confluenceTh"><p>Recommendation</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Upgrade runtime JRE to a recent major 
version, preferably 1.8. 
 Alternatively upgrade to <a shape="rect" href="version-notes-2328.html">Struts 
2.3.28</a></p></td></tr><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Affected Software</p></th><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Struts 2.0.0 - Struts <span style="color: 
rgb(23,35,59);">Struts 2.3.24.1</span></p></td></tr><tr><th colspan="1" 
rowspan="1" class="confluenceTh"><p>Reporter</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>WhiteHat Security (<a shape="rect" 
class="external-link" href="http://whitehatsec.com"; 
rel="nofollow">whitehatsec.com</a>)</p></td></tr><tr><th colspan="1" 
rowspan="1" class="confluenceTh"><p>CVE Identifier</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p><span style="color: 
rgb(34,34,34);">-</span></p></td></tr></tbody></table></div><h2 
id="S2-028-Problem">Problem</h2><p>When using a single byte page encoding such 
as ISO-8895-1, an attacker might submit a non-spec URL-encoded parameter value 
including multi-byte characters.
 </p><p>Struts 2 used the standard JRE URLDecoder to decode parameter 
values.&#160;<span>Especially JRE 1.5's URLDecoder implementation seems to be 
broken to the point that this non-spec encoding isn't rejected / filtered. In 
later JREs the issue was fixed, best known solution is found in JRE 
1.8.</span></p><h2 id="S2-028-Solution">Solution</h2><p>Upgrade runtime 
JRE/JDK, preferably to the most recent 1.8 
version.</p><p>Alternatively&#160;<span style="line-height: 1.42857;">upgrade 
to Struts 2.3.28, which includes and uses a safe URLDecoder implementation from 
Apache Tomcat</span></p><h2 id="S2-028-Backwardcompatibility">Backward 
compatibility</h2><p>No issues expected when upgrading to Struts 2.3.28</p><h2 
id="S2-028-Workaround">Workaround</h2><p>Use UTF-8 for page and parameter 
encoding.</p><h2 id="S2-028-FurtherReference">Further Reference</h2><p><style>
+            <div id="ConfluenceContent"><h2 
id="S2-028-Summary">Summary</h2>Use of a JRE with broken URLDecoder 
implementation may lead to XSS vulnerability in Struts 2 based web 
applications.<div class="table-wrap"><table 
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Who should read this</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>All Struts 2 developers and 
users</p></td></tr><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Impact of vulnerability</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Affects of a cross-site scripting 
vulnerability.</p></td></tr><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Maximum security rating</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Important</p></td></tr><tr><th colspan="1" 
rowspan="1" class="confluenceTh"><p>Recommendation</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Upgrade runtime JRE to a recent major 
version, preferably 1.8. 
 Alternatively upgrade to <a shape="rect" href="version-notes-2328.html">Struts 
2.3.28</a></p></td></tr><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Affected Software</p></th><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Struts 2.0.0 - Struts <span style="color: 
rgb(23,35,59);">Struts 2.3.24.1</span></p></td></tr><tr><th colspan="1" 
rowspan="1" class="confluenceTh"><p>Reporter</p></th><td colspan="1" 
rowspan="1" class="confluenceTd"><p>WhiteHat Security (<a shape="rect" 
class="external-link" href="http://whitehatsec.com"; 
rel="nofollow">whitehatsec.com</a>)</p></td></tr><tr><th colspan="1" 
rowspan="1" class="confluenceTh"><p>CVE Identifier</p></th><td colspan="1" 
rowspan="1" 
class="confluenceTd"><p>CVE-2016-0759</p></td></tr></tbody></table></div><h2 
id="S2-028-Problem">Problem</h2><p>When using a single byte page encoding such 
as ISO-8895-1, an attacker might submit a non-spec URL-encoded parameter value 
including multi-byte characters.</p><p>Struts 2 used the standa
 rd JRE URLDecoder to decode parameter values.&#160;<span>Especially JRE 1.5's 
URLDecoder implementation seems to be broken to the point that this non-spec 
encoding isn't rejected / filtered. In later JREs the issue was fixed, best 
known solution is found in JRE 1.8.</span></p><h2 
id="S2-028-Solution">Solution</h2><p>Upgrade runtime JRE/JDK, preferably to the 
most recent 1.8 version.</p><p>Alternatively&#160;<span style="line-height: 
1.42857;">upgrade to Struts 2.3.28, which includes and uses a safe URLDecoder 
implementation from Apache Tomcat</span></p><h2 
id="S2-028-Backwardcompatibility">Backward compatibility</h2><p>No issues 
expected when upgrading to Struts 2.3.28</p><h2 
id="S2-028-Workaround">Workaround</h2><p>Use UTF-8 for page and parameter 
encoding.</p><h2 id="S2-028-FurtherReference">Further Reference</h2><p><style>
     .jira-issue {
         padding: 0 0 0 2px;
         line-height: 20px;

Modified: websites/production/struts/content/docs/spring-plugin.html
==============================================================================
--- websites/production/struts/content/docs/spring-plugin.html (original)
+++ websites/production/struts/content/docs/spring-plugin.html Wed May 10 
06:35:13 2017
@@ -140,11 +140,11 @@ under the License.
     <div class="pagecontent">
         <div class="wiki-content">
             <div id="ConfluenceContent"><p><style type="text/css">/*<![CDATA[*/
-div.rbtoc1490016578158 {padding: 0px;}
-div.rbtoc1490016578158 ul {list-style: disc;margin-left: 0px;}
-div.rbtoc1490016578158 li {margin-left: 0px;padding-left: 0px;}
+div.rbtoc1494398046744 {padding: 0px;}
+div.rbtoc1494398046744 ul {list-style: disc;margin-left: 0px;}
+div.rbtoc1494398046744 li {margin-left: 0px;padding-left: 0px;}
 
-/*]]>*/</style></p><div class="toc-macro rbtoc1490016578158">
+/*]]>*/</style></p><div class="toc-macro rbtoc1494398046744">
 <ul class="toc-indentation"><li><a shape="rect" 
href="#SpringPlugin-Description">Description</a>
 <ul class="toc-indentation"><li><a shape="rect" 
href="#SpringPlugin-Features">Features</a></li></ul>
 </li><li><a shape="rect" href="#SpringPlugin-Usage">Usage</a>
@@ -224,7 +224,7 @@ div.rbtoc1490016578158 li {margin-left:
 </div></div></li></ol><p>Letting the reloading class loader handle all the 
classes can lead to ClassCastException(s) because instances of the same classes 
loaded by different class loaders can not be assigned to each other. To prevent 
this problem we suggest that <code>struts.class.reloading.acceptClasses</code> 
is used to limit the classes loaded by the reloading class loader, so only 
actions are handled by it. This constant supports a comma separated list of 
regular expressions:</p><div class="code panel pdl" style="border-width: 
1px;"><div class="codeContent panelContent pdl">
 <pre class="brush: java; gutter: false; theme: Default" 
style="font-size:12px;">&lt;constant 
name="struts.class.reloading.acceptClasses" 
value="com\.myproject\.example\.actions\..*" /&gt;
 </pre>
-</div></div><div class="confluence-information-macro 
confluence-information-macro-warning"><span class="aui-icon aui-icon-small 
aui-iconfont-error confluence-information-macro-icon"></span><div 
class="confluence-information-macro-body"><p>This feature is experimental, and 
<strong>should never</strong> be used in production systems.</p></div></div><h4 
id="SpringPlugin-Settings">Settings</h4><p>The following settings can be 
customized. See the <a shape="rect" class="external-link" 
href="http://cwiki.apache.org/confluence/display/WW/Configuration+Files";>developer
 guide</a>.</p><div class="table-wrap"><table 
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Setting</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Description</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Possible Values</p></th></tr><tr><td colspan="1" 
rowspan="1" class="confluenceTd"><p><code
 >struts.objectFactory.spring.autoWire</code></p></td><td colspan="1" 
 >rowspan="1" class="confluenceTd"><p>The autowire strategy</p></td><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p><code>name</code></p></td><td 
 >colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>name</code>,<code>type</code>,<code>auto</code>,
 > or <code>constructor</code></p></td></tr><tr><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>struts.objectFactory.spring.autoWire.alwaysRespect</code></p></td><td
 > colspan="1" rowspan="1" class="confluenceTd"><p>Whether the autowire 
 >strategy should always be used, or if the framework should try to guess the 
 >best strategy based on the situation</p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>false</code> for 
 >backwards-compatibility</p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>true</code> or 
 ><code>false</code></p></td></tr><tr><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>struts.objectFactory.spring.useClassCach
 e</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Whether 
to have Spring use its class cache or not</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code> or 
<code>false</code></p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.class.reloading.watchList</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>List of jar files or 
directories to watch for changes</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Comma separated list of absolute or relative paths to 
jars or directories</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.class.reloading.acceptClasses</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>List of regular expressions of 
accepted class names</p></td><td colspan="1" rows
 pan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Comma separated list of regular expressions 
of classes that will be loaded by the reloading class loader(we suggest to add 
regular expressions so only action classes are handled by the reloading class 
loader)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.class.reloading.reloadConfig</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>Reload the runtime 
configuration (action mappings, results etc) when a change is detected in one 
of the watched directories</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>false</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code> or 
<code>false</code></p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.class.spring.enableAopSupport</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>Uses different log
 ic to construct beans to allow support AOP</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>false</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code> or 
<code>false</code></p></td></tr></tbody></table></div><h4 
id="SpringPlugin-Installation">Installation</h4><p>This plugin can be installed 
by copying the plugin jar into your application's <code>/WEB-INF/lib</code> 
directory. No other files need to be copied or created.</p></div>
+</div></div><div class="confluence-information-macro 
confluence-information-macro-warning"><span class="aui-icon aui-icon-small 
aui-iconfont-error confluence-information-macro-icon"></span><div 
class="confluence-information-macro-body"><p>This feature is experimental, and 
<strong>should never</strong> be used in production systems.</p></div></div><h4 
id="SpringPlugin-Settings">Settings</h4><p>The following settings can be 
customized. See the <a shape="rect" class="external-link" 
href="http://cwiki.apache.org/confluence/display/WW/Configuration+Files";>developer
 guide</a>.</p><div class="table-wrap"><table 
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Setting</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Description</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Default</p></th><th colspan="1" rowspan="1" 
class="confluenceTh"><p>Possible Values</p></th></tr><tr><td colspan="1" 
rowspan="1" class="confluenceTd"><p><code
 >struts.objectFactory.spring.autoWire</code></p></td><td colspan="1" 
 >rowspan="1" class="confluenceTd"><p>The autowire strategy</p></td><td 
 >colspan="1" rowspan="1" class="confluenceTd"><p><code>name</code></p></td><td 
 >colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>name</code>,<code>type</code>,<code>auto</code>,
 > or <code>constructor</code></p></td></tr><tr><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>struts.objectFactory.spring.autoWire.alwaysRespect</code></p></td><td
 > colspan="1" rowspan="1" class="confluenceTd"><p>Whether the autowire 
 >strategy should always be used, or if the framework should try to guess the 
 >best strategy based on the situation</p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>false</code> for 
 >backwards-compatibility</p></td><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>true</code> or 
 ><code>false</code></p></td></tr><tr><td colspan="1" rowspan="1" 
 >class="confluenceTd"><p><code>struts.objectFactory.spring.useClassCach
 e</code></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>Whether 
to have Spring use its class cache or not</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code> or 
<code>false</code></p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.class.reloading.watchList</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>List of jar files or 
directories to watch for changes</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>null</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p>Comma separated list of absolute or relative paths to 
jars or directories</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.class.reloading.acceptClasses</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>List of regular expressions of 
accepted class names</p></td><td colspan="1" rows
 pan="1" class="confluenceTd"><p><code>null</code></p></td><td colspan="1" 
rowspan="1" class="confluenceTd"><p>Comma separated list of regular expressions 
of classes that will be loaded by the reloading class loader(we suggest to add 
regular expressions so only action classes are handled by the reloading class 
loader)</p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.class.reloading.reloadConfig</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>Reload the runtime 
configuration (action mappings, results etc) when a change is detected in one 
of the watched directories</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>false</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code> or 
<code>false</code></p></td></tr><tr><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>struts.objectFactory.spring.enableAopSupport</code></p></td><td
 colspan="1" rowspan="1" class="confluenceTd"><p>Uses diffe
 rent logic to construct beans to allow support AOP, it uses an old approach to 
create a bean, switch this flag if you have problems with Spring beans and 
AOP</p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>false</code></p></td><td colspan="1" rowspan="1" 
class="confluenceTd"><p><code>true</code> or 
<code>false</code></p></td></tr></tbody></table></div><h4 
id="SpringPlugin-Installation">Installation</h4><p>This plugin can be installed 
by copying the plugin jar into your application's <code>/WEB-INF/lib</code> 
directory. No other files need to be copied or created.</p></div>
         </div>
 
                     <div class="tabletitle">

Reply via email to