Security vulnerability process for EOL versions

2017-09-13 Thread Lehmer, Jason
In cases where the Struts community is notified or discovers a security vulnerability in a supported version, does the evaluation process include identifying unsupported versions that may be impacted as well? I realize the recommendation will likely be to upgrade to a supported version but I jus

Re: No container in actions after upgrading to 2.5.13

2017-09-13 Thread LAW Andy
That looks more relevant. I’ll look into it some more tomorrow morning. Thanks for your help so far. > On 13 Sep 2017, at 17:04, Yasser Zamani wrote: > > Maybe you have a similar issue of [1]. > > Say you have X that extends ActionSupport. Please make sure if every X > has been instantiated

Re: No container in actions after upgrading to 2.5.13

2017-09-13 Thread Yasser Zamani
Maybe you have a similar issue of [1]. Say you have X that extends ActionSupport. Please make sure if every X has been instantiated not manually (e.g. X = new X() inside your java files). They should be instantiated via Strut's object factory ( e.g. https://issues.apache.org/jira/browse/WW-4813

Re: No container in actions after upgrading to 2.5.13

2017-09-13 Thread LAW Andy
> On 13 Sep 2017, at 14:17, Lukasz Lenart wrote: > > 2017-09-13 11:02 GMT+02:00 LAW Andy : >> Using version 2.5.13 on Tomcat 8.0.21. >> >> I’ve attached it to this message as a text file. > > How do you fetch action in > "my.domain.controller.ActionOption.getAction(ActionOption.java:138)" ? >

Re: No container in actions after upgrading to 2.5.13

2017-09-13 Thread Lukasz Lenart
2017-09-13 11:02 GMT+02:00 LAW Andy : > Using version 2.5.13 on Tomcat 8.0.21. > > I’ve attached it to this message as a text file. How do you fetch action in "my.domain.controller.ActionOption.getAction(ActionOption.java:138)" ? Do you construct those actions manually? at my.domain.controller.A

Re: No container in actions after upgrading to 2.5.13

2017-09-13 Thread LAW Andy
Using version 2.5.13 on Tomcat 8.0.21. I’ve attached it to this message as a text file. Later, Andy > On 12 Sep 2017, at 15:56, Yasser Zamani wrote: > > Each one you're more comfortable or is more important for you. > > On 9/12/2017 7:08 PM, LAW Andy wrote: >> >>> On 12 Sep 2017, at 14:46, Y

Re: Error Struts 2.3.33

2017-09-13 Thread Yasser Zamani
On 9/12/2017 11:09 PM, Yasser Zamani wrote: > I should correct myself; You can write it in both #session['foo'] or > #session.foo > > So, now you should examine that previousBusinessStateList exists in > session on that action call which return that jsp including s:select tag. > Also I remem