svn commit: r21454 - /dev/struts/2.5.13/ /release/struts/2.5.13/
Author: lukaszlenart Date: Tue Sep 5 09:16:03 2017 New Revision: 21454 Log: Vote passed, Struts 2.5.13 is out Added: release/struts/2.5.13/ - copied from r21453, dev/struts/2.5.13/ Removed: dev/struts/2.5.13/
struts-site git commit: Adds TOCs
Repository: struts-site Updated Branches: refs/heads/master 04d894c47 -> c036f9f02 Adds TOCs Project: http://git-wip-us.apache.org/repos/asf/struts-site/repo Commit: http://git-wip-us.apache.org/repos/asf/struts-site/commit/c036f9f0 Tree: http://git-wip-us.apache.org/repos/asf/struts-site/tree/c036f9f0 Diff: http://git-wip-us.apache.org/repos/asf/struts-site/diff/c036f9f0 Branch: refs/heads/master Commit: c036f9f02051f7ce3dc81b1be338abac42d16ccd Parents: 04d894c Author: Lukasz Lenart Authored: Tue Sep 5 11:31:52 2017 +0200 Committer: Lukasz Lenart Committed: Tue Sep 5 11:31:52 2017 +0200 -- _config.yml | 3 + .../core-developers/parameters-interceptor.md | 6 +- source/getting-started/http-session.md | 84 +--- 3 files changed, 65 insertions(+), 28 deletions(-) -- http://git-wip-us.apache.org/repos/asf/struts-site/blob/c036f9f0/_config.yml -- diff --git a/_config.yml b/_config.yml index de8e65c..ffbe528 100644 --- a/_config.yml +++ b/_config.yml @@ -21,3 +21,6 @@ beta_release_date_short: 20160126 # Allows directly edit pages on GitHub repository_url: https://github.com/apache/struts-site + +# Used to generate links to Struts Core ApiDocs +apidocs: /maven/struts2-core/apidocs http://git-wip-us.apache.org/repos/asf/struts-site/blob/c036f9f0/source/core-developers/parameters-interceptor.md -- diff --git a/source/core-developers/parameters-interceptor.md b/source/core-developers/parameters-interceptor.md index f944af3..9f6a428 100644 --- a/source/core-developers/parameters-interceptor.md +++ b/source/core-developers/parameters-interceptor.md @@ -4,6 +4,10 @@ title: Parameters Interceptor --- # Parameters Interceptor +{:.no_toc} + +* Will be replaced with the ToC, excluding a header +{:toc} This interceptor sets all parameters on the value stack. @@ -116,7 +120,7 @@ Error setting expression 'search' with value ['search', ] - [unknown location] Thus is expected behaviour to allow developer to spot missing setter or typo in either parameter name or setter. -###Examples +### Examples ```xml http://git-wip-us.apache.org/repos/asf/struts-site/blob/c036f9f0/source/getting-started/http-session.md -- diff --git a/source/getting-started/http-session.md b/source/getting-started/http-session.md index 20bd341..fa874a6 100644 --- a/source/getting-started/http-session.md +++ b/source/getting-started/http-session.md @@ -2,19 +2,29 @@ layout: getting-started title: Http Session --- -## HTTP Session -The example code for this tutorial, http_session, is available at [https://github.com/apache/struts-examples](https://github.com/apache/struts-examples) +# HTTP Session +{:.no_toc} -__Introduction__ +* Will be replaced with the ToC, excluding a header +{:toc} -Your Struts 2 application may need to access the HTTP session object. Struts 2 provides an interface, [SessionAware](https://struts.apache.org/maven/struts2-core/apidocs/org/apache/struts2/interceptor/SessionAware.html), that your Action class should implement to obtain a reference to the HTTP session object. +The example code for this tutorial, http_session, is available at [https://github.com/apache/struts-examples]. -The [Struts 2 user mailing list](http://struts.apache.org/mail.html) is an excellent place to get help. If you are having a problem getting the tutorial example applications to work search the Struts 2 mailing list. If you don't find an answer to your problem, post a question on the mailing list. +## Introduction -__SessionAware Interface__ +Your Struts 2 application may need to access the HTTP session object. Struts 2 provides an interface, +[SessionAware]({{ site.apidocs }}/org/apache/struts2/interceptor/SessionAware.html), that your Action class +should implement to obtain a reference to the HTTP session object. -The SessionAware interface has one method, setSession, that your Action class will need to override. In the example application (see above), the HelloWorldAction class implements the SessionAware interface and includes this code: +The [Struts 2 user mailing list](http://struts.apache.org/mail.html) is an excellent place to get help. If you are +having a problem getting the tutorial example applications to work search the Struts 2 mailing list. If you don't find +an answer to your problem, post a question on the mailing list. + +## SessionAware Interface + +The SessionAware interface has one method, setSession, that your Action class will need to override. In the example +application (see above), the HelloWorldAction class implements the SessionAware interface and includes
struts-site git commit: Updates production by Jenkins
Repository: struts-site Updated Branches: refs/heads/asf-site 611400399 -> b64eab8eb Updates production by Jenkins Project: http://git-wip-us.apache.org/repos/asf/struts-site/repo Commit: http://git-wip-us.apache.org/repos/asf/struts-site/commit/b64eab8e Tree: http://git-wip-us.apache.org/repos/asf/struts-site/tree/b64eab8e Diff: http://git-wip-us.apache.org/repos/asf/struts-site/diff/b64eab8e Branch: refs/heads/asf-site Commit: b64eab8eb57594c4fd83ea1c015503fafc9f233b Parents: 6114003 Author: jenkins Authored: Tue Sep 5 09:32:32 2017 + Committer: jenkins Committed: Tue Sep 5 09:32:32 2017 + -- .../core-developers/parameters-interceptor.html | 14 ++- content/getting-started/http-session.html | 97 +--- 2 files changed, 74 insertions(+), 37 deletions(-) -- http://git-wip-us.apache.org/repos/asf/struts-site/blob/b64eab8e/content/core-developers/parameters-interceptor.html -- diff --git a/content/core-developers/parameters-interceptor.html b/content/core-developers/parameters-interceptor.html index 13b5cef..0934dcf 100644 --- a/content/core-developers/parameters-interceptor.html +++ b/content/core-developers/parameters-interceptor.html @@ -125,7 +125,17 @@ << back to Core Developers Guide https://github.com/apache/struts-site/edit/master/source/core-developers/parameters-interceptor.md"; title="Edit this page on GitHub">Edit on GitHub -Parameters Interceptor +Parameters Interceptor + + + Parameters + Excluding parameters + Extending the Interceptor + Warning on missing parameters + Examples + + + This interceptor sets all parameters on the value stack. @@ -244,7 +254,7 @@ Error setting expression 'search' with value ['search', ] - [unknown location] Thus is expected behaviour to allow developer to spot missing setter or typo in either parameter name or setter. -###Examples +Exampleshttp://git-wip-us.apache.org/repos/asf/struts-site/blob/b64eab8e/content/getting-started/http-session.html -- diff --git a/content/getting-started/http-session.html b/content/getting-started/http-session.html index 9c4d1ef..f497c2d 100644 --- a/content/getting-started/http-session.html +++ b/content/getting-started/http-session.html @@ -125,19 +125,33 @@ << back to Getting Started https://github.com/apache/struts-site/edit/master/source/getting-started/http-session.md"; title="Edit this page on GitHub">Edit on GitHub -HTTP Session +HTTP Session -The example code for this tutorial, http_session, is available at https://github.com/apache/struts-examples";>https://github.com/apache/struts-examples + + Introduction + SessionAware Interface + Using the HTTP Session Object In The Action Class + Accessing HTTP Session Objects In The View + Best Practices When Using SessionAware + Summary + -Introduction +The example code for this tutorial, http_session, is available at [https://github.com/apache/struts-examples]. -Your Struts 2 application may need to access the HTTP session object. Struts 2 provides an interface, https://struts.apache.org/maven/struts2-core/apidocs/org/apache/struts2/interceptor/SessionAware.html";>SessionAware, that your Action class should implement to obtain a reference to the HTTP session object. +Introduction -The http://struts.apache.org/mail.html";>Struts 2 user mailing list is an excellent place to get help. If you are having a problem getting the tutorial example applications to work search the Struts 2 mailing list. If you donât find an answer to your problem, post a question on the mailing list. +Your Struts 2 application may need to access the HTTP session object. Struts 2 provides an interface, +SessionAware, that your Action class +should implement to obtain a reference to the HTTP session object. -SessionAware Interface +The http://struts.apache.org/mail.html";>Struts 2 user mailing list is an excellent place to get help. If you are +having a problem getting the tutorial example applications to work search the Struts 2 mailing list. If you donât find +an answer to your problem, post a question on the mailing list. -The SessionAware interface has one method, setSession, that your Action class will need to override. In the example application (see above), the HelloWorldAction class implements the SessionAware interface and includes this code: +SessionAware Interface + +The SessionAware interface has one method, setSession, that your Action class will need to override. In the example +application (see above), the HelloWorldAction class implements the SessionAware interface a
struts-site git commit: Updates production by Jenkins
Repository: struts-site Updated Branches: refs/heads/asf-site b64eab8eb -> 29713114c Updates production by Jenkins Project: http://git-wip-us.apache.org/repos/asf/struts-site/repo Commit: http://git-wip-us.apache.org/repos/asf/struts-site/commit/29713114 Tree: http://git-wip-us.apache.org/repos/asf/struts-site/tree/29713114 Diff: http://git-wip-us.apache.org/repos/asf/struts-site/diff/29713114 Branch: refs/heads/asf-site Commit: 29713114c2cd076deb44bfa1bbf3729cf6003f33 Parents: b64eab8 Author: jenkins Authored: Tue Sep 5 13:08:40 2017 + Committer: jenkins Committed: Tue Sep 5 13:08:40 2017 + -- content/announce.html | 65 + content/download.html | 46 content/downloads.html | 2 +- content/index.html | 10 +++ 4 files changed, 94 insertions(+), 29 deletions(-) -- http://git-wip-us.apache.org/repos/asf/struts-site/blob/29713114/content/announce.html -- diff --git a/content/announce.html b/content/announce.html index 96c12ac..0158c00 100644 --- a/content/announce.html +++ b/content/announce.html @@ -127,6 +127,7 @@ Announcements + 05 September 2017 - Struts 2.5.13 General Availability 09 August 2017 - S2-049 Security Bulletin update 07 July 2017 - Struts 2.3.33 General Availability 06 July 2017 - Struts 2.5.12 General Availability @@ -142,6 +143,70 @@ Skip to: Announcements - 2016 +05 September 2017 - Struts 2.5.13 General Availability + +The Apache Struts group is pleased to announce that Struts 2.5.13 is available as a âGeneral Availabilityâ +release. The GA designation is our highest quality grade. + +Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. +The framework is designed to streamline the full development cycle, from building, to deploying, +to maintaining applications over time. + +This release contains fixes for the following potential security vulnerabilities: + + + S2-050 + A regular expression Denial of Service when using URLValidator (similar to S2-044 & S2-047) + S2-051 +A remote attacker may create a DoS attack by sending crafted xml request when using the Struts REST plugin + S2-052 +Possible Remote Code Execution attack when using the Struts REST plugin with XStream handler to handle XML payloads + + +Except the above this release also contains several improvements just to mention few of them: + + + Struts2 JSON Plugin: Send Map with Strings as Key to JSON Action is ignored, Numeric Keys will work and mapped + NP with TextProvider and wildcardmapping + Threads get blocked due to unnecessary synchronization in OgnlRuntime + Default Multipart validation regex is invalid + Not fully initialized ObjectFactory tries to create beans + http://struts.apache.org/dtds/struts-2.5.dtd missing + Set a global resource bundle in class + Override TextProvider doesnot work in struts 2.5.12 + Array-of-null parameters are converted to string ânullâ + JakartaStreamMultiPartRequest Should Honor âstruts.multipart.maxSizeâ + Build Fails Due to Unused com.sun Import + Struts2.5.12 - NPE in DeligatingValidatorContext + Struts 2 Fails to Initialize with JRebel + Allow define more than one Action suffix + Remove jQuery from debugging interceptor views + update dependencies page on the struts site + Improve RegEx used to validate URLs + Make REST ContentHandlers configurable + expose Freemarker incompatible_improvements into FreemarkerManager and StrutsBeansWrapper + Upgrade Commons Collections to 3.2.2 + Upgrade Commons IO to 2.5 + Upgrade to ASM version 5.2 + Upgrade to OGNL 3.1.15 + Upgrade xstream to the latest version + Upgrade to struts-master 11 + + + + Please read the Version Notes to find more details about performed bug fixes and improvements. + + +All developers are strongly advised to perform this action. + +The 2.5.x series of the Apache Struts framework has a minimum requirement of the following specification versions: +Servlet API 2.4, JSP API 2.0, and Java 7. + +Should any issues arise with your use of any version of the Struts framework, please post your comments +to the user list, and, if appropriate, file a tracking ticket. + +You can download this version from our download page. + 09 August 2017 - S2-049 Security Bulletin update This is an update of the recently announced Security Bulletin - S2-049. http://git-wip-us.apache.org/repos/asf/struts-site/blob/29713114/content/download.html -- diff --git a/content/download.html b/content/download.html index 6a39e13..a6c20f4 100644 --- a/content/download.html +++ b/content/download.html @@ -183,27 +183,27 @@ Full Releases - -Struts
struts-site git commit: Adds announcement about 2.5.13
Repository: struts-site Updated Branches: refs/heads/master c036f9f02 -> 1a34e6a1b Adds announcement about 2.5.13 Project: http://git-wip-us.apache.org/repos/asf/struts-site/repo Commit: http://git-wip-us.apache.org/repos/asf/struts-site/commit/1a34e6a1 Tree: http://git-wip-us.apache.org/repos/asf/struts-site/tree/1a34e6a1 Diff: http://git-wip-us.apache.org/repos/asf/struts-site/diff/1a34e6a1 Branch: refs/heads/master Commit: 1a34e6a1be6f71ad8cd7f61f95bbb60c58df7f58 Parents: c036f9f Author: Lukasz Lenart Authored: Tue Sep 5 15:07:57 2017 +0200 Committer: Lukasz Lenart Committed: Tue Sep 5 15:07:57 2017 +0200 -- _config.yml| 8 +++ source/announce.md | 58 + 2 files changed, 62 insertions(+), 4 deletions(-) -- http://git-wip-us.apache.org/repos/asf/struts-site/blob/1a34e6a1/_config.yml -- diff --git a/_config.yml b/_config.yml index ffbe528..8e96c6c 100644 --- a/_config.yml +++ b/_config.yml @@ -10,13 +10,13 @@ kramdown: syntax_highlighter: rouge # Simplifies introducing changes related to the latest release -current_version: 2.5.12 -current_version_short: 2512 +current_version: 2.5.13 +current_version_short: 2513 archetype_version: 2.5.5 current_beta_version: 2.5-BETA3 current_beta_version_short: 25B3 -release_date: 06 July 2017 -release_date_short: 20170706 +release_date: 05 September 2017 +release_date_short: 20170905 beta_release_date_short: 20160126 # Allows directly edit pages on GitHub http://git-wip-us.apache.org/repos/asf/struts-site/blob/1a34e6a1/source/announce.md -- diff --git a/source/announce.md b/source/announce.md index eb63245..b25b124 100644 --- a/source/announce.md +++ b/source/announce.md @@ -12,6 +12,64 @@ title: Announcements Skip to: Announcements - 2016 + 05 September 2017 - Struts 2.5.13 General Availability {#a20170905} + +The Apache Struts group is pleased to announce that Struts 2.5.13 is available as a "General Availability" +release. The GA designation is our highest quality grade. + +Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. +The framework is designed to streamline the full development cycle, from building, to deploying, +to maintaining applications over time. + +This release contains fixes for the following potential security vulnerabilities: + + - [S2-050](/docs/s2-050.html) +A regular expression Denial of Service when using URLValidator (similar to S2-044 & S2-047) + - [S2-051](/docs/s2-051.html) + A remote attacker may create a DoS attack by sending crafted xml request when using the Struts REST plugin + - [S2-052](/docs/s2-052.html) + Possible Remote Code Execution attack when using the Struts REST plugin with XStream handler to handle XML payloads + +Except the above this release also contains several improvements just to mention few of them: + + - Struts2 JSON Plugin: Send Map with Strings as Key to JSON Action is ignored, Numeric Keys will work and mapped + - NP with TextProvider and wildcardmapping + - Threads get blocked due to unnecessary synchronization in OgnlRuntime + - Default Multipart validation regex is invalid + - Not fully initialized ObjectFactory tries to create beans + - http://struts.apache.org/dtds/struts-2.5.dtd missing + - Set a global resource bundle in class + - Override TextProvider doesnot work in struts 2.5.12 + - Array-of-null parameters are converted to string "null" + - JakartaStreamMultiPartRequest Should Honor "struts.multipart.maxSize" + - Build Fails Due to Unused com.sun Import + - Struts2.5.12 - NPE in DeligatingValidatorContext + - Struts 2 Fails to Initialize with JRebel + - Allow define more than one Action suffix + - Remove jQuery from debugging interceptor views + - update dependencies page on the struts site + - Improve RegEx used to validate URLs + - Make REST ContentHandlers configurable + - expose Freemarker incompatible_improvements into FreemarkerManager and StrutsBeansWrapper + - Upgrade Commons Collections to 3.2.2 + - Upgrade Commons IO to 2.5 + - Upgrade to ASM version 5.2 + - Upgrade to OGNL 3.1.15 + - Upgrade xstream to the latest version + - Upgrade to struts-master 11 + +> Please read the [Version Notes](/docs/version-notes-2513.html) to find more details about performed bug fixes and improvements. + +**All developers are strongly advised to perform this action.** + +The 2.5.x series of the Apache Struts framework has a minimum requirement of the following specification versions: +Servlet API 2.4, JSP API 2.0, and Java 7. + +Should any issues arise with your use of any version of the Struts framework, please post your comments +to
[01/14] struts-site git commit: Updates exported docs
Repository: struts-site Updated Branches: refs/heads/asf-site 29713114c -> b16cc4ef7 http://git-wip-us.apache.org/repos/asf/struts-site/blob/b16cc4ef/content/docs/webxml.html -- diff --git a/content/docs/webxml.html b/content/docs/webxml.html index 8f40240..2666810 100644 --- a/content/docs/webxml.html +++ b/content/docs/webxml.html @@ -34,20 +34,6 @@ under the License. color: #666; } - - - - - - - - - - - -SyntaxHighlighter.defaults['toolbar'] = false; -SyntaxHighlighter.all(); - var hide = null; var show = null; @@ -139,17 +125,7 @@ under the License.-- -The
web.xml
web application descriptor file represents the core of the Java web application, so it is appropriate that it is also part of the core of the Struts framework. In theweb.xml
file, Struts defines its FilterDispatcher, the Servlet Filter class that initializes the Struts framework and handles all requests. This filter can contain initialization parameters that affect what, if any, additional configuration files are loaded and how the framework should behave.Simple Example
Configuring
web.xml
for the framework is a matter of adding a filter and filter-mapping.Filter Example (web.xml)-<web-app id="MyStrutsApp" version="2.4" +The
web.xml
web application descriptor file represents the core of the Java web application, so it is appropriate that it is also part of the core of the Struts framework. In theweb.xml
file, Struts defines its FilterDispatcher, the Servlet Filter class that initializes the Struts framework and handles all requests. This filter can contain initialization parameters that affect what, if any, additional configuration files are loaded and how the framework should behave.Simple Example
Configuring
web.xml
for the framework is a matter of adding a filter and filter-mapping.Filter Example (web.xml) <web-app id="MyStrutsApp" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> @@ -167,9 +143,7 @@ div.rbtoc1488973941985 li {margin-left: 0px;padding-left: 0px;} <!-- ... --> </web-app> - - Changed filter package in Struts >= 2.5
As from Struts 2.5 all filters were moved to top package, if you are using older version you must use the old package, see example:
-<web-app id="WebApp_9" version="2.4" +[05/14] struts-site git commit: Updates exported docs
http://git-wip-us.apache.org/repos/asf/struts-site/blob/b16cc4ef/content/docs/result-annotation.html -- diff --git a/content/docs/result-annotation.html b/content/docs/result-annotation.html index 2fdccc6..2eb38fa 100644 --- a/content/docs/result-annotation.html +++ b/content/docs/result-annotation.html @@ -34,20 +34,6 @@ under the License. color: #666; } - - - - - - - - - - - -SyntaxHighlighter.defaults['toolbar'] = false; -SyntaxHighlighter.all(); - var hide = null; var show = null; @@ -141,17 +127,18 @@ under the License.The
-@Result
annotation allows the definition ofAction
results in theAction
class rather than an XML file.+-The
@Result
annotation lives at theAction
class level and not the method level. This matches what is found in an XML-basedAction
configuration. Do not be tempted to annotate yourAction
's methods; it will not work.+ The
@Result
annotation lives at theAction
class level and not the method level. This matches what is found in an XML-basedAction
configuration. Do not be tempted to annotate yourAction
's methods; it will not work.In order for
@Result
and@Results
annotations to be configured correctly you must set theactionPackages
filterinit-param
to a comma-separated list of packages containing the annotatedAction
classes. See Zero Configuration for further information; there areAction
class naming conventions if you don't implement theAction
interface and other tidbits there.- +
@Result
Annotation Parameters{float:right|width=300px} + {info} +See org.apache.struts2.config.Result annotation JavaDocs. + {info} +{float}
- name - Result name; default
Action.SUCCESS
- value - Value of result (result destination)
- type - Type of result; default
NullResult
. For example:@@ -162,21 +149,18 @@ under the License.
NullResult.class
FreemarkerResult.class
PlainTextResult.class
VelocityResult.class
ServletDispatcherResult.class
ServletRedirectResult.class
ServletActionRedirectResult.class
- equivalent to theredirectAction
type in XML configTilesResult.class
- .. (for more result, please consult the API docs, and look for implementations of the XWork
Result
interface)Map the "success" result (explicitly named) to a Tile definition named "/home.page".
-+Defining a Single Result-+-Defining a Single Result @Result(name="success", value="/home.page", type=TilesResult.class) public class HomeAction extends ActionSupport { // ... } -
@Results
– Defining Multiple ResultsDefines a set of results for an
-Action
.Defining Multiple Results-
[10/14] struts-site git commit: Updates exported docs
http://git-wip-us.apache.org/repos/asf/struts-site/blob/b16cc4ef/content/docs/execute-and-wait-interceptor.html -- diff --git a/content/docs/execute-and-wait-interceptor.html b/content/docs/execute-and-wait-interceptor.html index 7a80995..3a9cf48 100644 --- a/content/docs/execute-and-wait-interceptor.html +++ b/content/docs/execute-and-wait-interceptor.html @@ -203,7 +203,7 @@ background process extension, extend ExecuteAndWaitInterceptor and implement the Examples -http://git-wip-us.apache.org/repos/asf/struts-site/blob/b16cc4ef/content/docs/expression-validator.html -- diff --git a/content/docs/expression-validator.html b/content/docs/expression-validator.html index 2ac8ac4..e4b8d48 100644 --- a/content/docs/expression-validator.html +++ b/content/docs/expression-validator.html @@ -150,7 +150,7 @@ under the License.Examples
-