Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Lukasz Lenart
2014-04-25 17:39 GMT+02:00 Emi Lu : > On 04/25/2014 10:56 AM, Lukasz Lenart wrote: >> >> You can create one abstract package and all other packages can inherit >> from it - the same as you inherit from "tiles-default" >>> >>> So, another way to do the change would be: >>> >>> >>> . //Coding f

Re: struts 2.3.17

2014-04-25 Thread Lukasz Lenart
Let me finish 2.3.16.2 ;-) 2014-04-26 6:08 GMT+02:00 Amol Ghotankar : > Any update here? > > > > On Sat, Apr 5, 2014 at 1:54 AM, Lukasz Lenart wrote: > >> Next week, I haven't had time to work on it this week >> >> 2014-04-04 20:16 GMT+02:00 Manuel López Blasi : >> > By any chance does anybody has

Re: struts 2.3.17

2014-04-25 Thread Amol Ghotankar
Any update here? On Sat, Apr 5, 2014 at 1:54 AM, Lukasz Lenart wrote: > Next week, I haven't had time to work on it this week > > 2014-04-04 20:16 GMT+02:00 Manuel López Blasi : > > By any chance does anybody has an estimate of when struts version 2.3.17 > > will be available? > > Thanks in adv

Re: CRUD through RESTful

2014-04-25 Thread Antonio Sánchez
Right: "struts2-rest-showcase" works fine with tomcat 7 and 8.0.5. Thank you :) El vie 25 abr 2014 12:41:16 CEST, Lukasz Lenart escribió: 2014-04-25 10:28 GMT+02:00 Antonio Sánchez : 1. So, RESTful plug-in is just for implementing web services in Struts2, isn't it? Basically yes, how you wil

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Emi Lu
On 04/25/2014 10:56 AM, Lukasz Lenart wrote: You can create one abstract package and all other packages can inherit from it - the same as you inherit from "tiles-default" So, another way to do the change would be: . //Coding for [1] .. Is it correct? This is the preferred appro

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Lukasz Lenart
2014-04-25 16:48 GMT+02:00 Emi Lu : > On 04/25/2014 10:23 AM, Lukasz Lenart wrote: >> >> You can create one abstract package and all other packages can inherit >> from it - the same as you inherit from "tiles-default" > > So, another way to do the change would be: > > > . //Coding for [1] >

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Emi Lu
On 04/25/2014 10:23 AM, Lukasz Lenart wrote: You can create one abstract package and all other packages can inherit from it - the same as you inherit from "tiles-default" So, another way to do the change would be: . //Coding for [1] .. Is it correct? Or, if I keep "extends=tile

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Lukasz Lenart
You can create one abstract package and all other packages can inherit from it - the same as you inherit from "tiles-default" 2014-04-25 15:52 GMT+02:00 : > Hello List, > > Need your confirmation for [1] mitigation. For example, package: p1, p2... > pN, for each package, I should do the following

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread emilu
Hello List, Need your confirmation for [1] mitigation. For example, package: p1, p2... pN, for each package, I should do the following, right? Do I miss anything or is there a way that can patch one place and cover all packages instead of doing p1... PN? (a) struts1.xml

Re: CRUD through RESTful

2014-04-25 Thread Lukasz Lenart
2014-04-25 10:28 GMT+02:00 Antonio Sánchez : > 1. So, RESTful plug-in is just for implementing web services in Struts2, > isn't it? Basically yes, how you will use it is up to you :-) > 2. IMHO, a more detailed documentation would help newbies understand how-to > use REST plugin. Specially, expla

Re: CRUD through RESTful

2014-04-25 Thread Antonio Sánchez
1. So, RESTful plug-in is just for implementing web services in Struts2, isn't it? 2. IMHO, a more detailed documentation would help newbies understand how-to use REST plugin. Specially, explain the use of HTTPHeader instances. From a newbie perspective it is difficult to understand, because

Antwort: Detect abuse of parameterInterceptor / Zero-Day issue?

2014-04-25 Thread Christoph Nenning
> > I'd like to begin monitoring the server's request log and system logs to be > able to detect abuse of today's 0-day, if possible. Is it possible to > search for GET requests or Struts log statements to determine if this issue > is being exploited? As far as I see it the problem are speci