Re: HTML5 Button Component for tapetry 5.4.x

2019-09-13 Thread Luca Arzeni
Hi Chris, see the reply to Thiago for my use case. Thanks, Luca > Sent: Wednesday, September 11, 2019 at 2:58 PM > From: "Chris Poulsen" > To: "Tapestry users" > Subject: Re: HTML5 Button Component for tapetry 5.4.x > > We usually just style the various Tapestry link components to get buttons >

Re: HTML5 Button Component for tapetry 5.4.x

2019-09-13 Thread Luca Arzeni
Hi Thiago, I was trying to use html5 client validation. Tapestry docs says that you can enable it in AppModule, adding: configuration.add(SymbolConstants.ENABLE_HTML5_SUPPORT, "true"); And this works fine, but then, at least in Chromium and Firefox, you need a in the form to trigger it. You c

Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure

2019-09-13 Thread Thiago H. de Paula Figueiredo
I'm afraid I've mad an error. It should have been CVE-2019-10071: New Issue in Fix for CVE-2014-1972 On Fri, Sep 13, 2019 at 11:39 AM Thiago H. de Paula Figueiredo < thiag...@gmail.com> wrote: > CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability > Severity: important > Vendor: The

CVE-2019-10071: Apache Tapestry vulnerability disclosure

2019-09-13 Thread Thiago H. de Paula Figueiredo
CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability Severity: important Vendor: The Apache Software Foundation Versions affected: all Apache Tapestry versions between 5.4.0, including its betas, and 5.4.3. Description: The code which checks HMAC in form submissions used String.equals

CVE-2019-0207: Apache Tapestry vulnerability disclosure

2019-09-13 Thread Thiago H. de Paula Figueiredo
CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability Severity: important Vendor: The Apache Software Foundation Versions affected: all Apache Tapestry versions between 5.4.0, including its betas, and 5.4.4 Description: Tapestry processes assets `/assets/ctx` using classes chain `Stati

[CVE-2019-0195] Apache Tapestry vulnerability disclosure

2019-09-13 Thread Thiago H. de Paula Figueiredo
CVE-2019-0195: File reading Leads Java Deserialization Vulnerability Severity: important Vendor: The Apache Software Foundation Versions affected: all Apache Tapestry versions between 5.4.0, including its betas, and 5.4.3 Description: Manipulating classpath asset file URLs, an attacker could guess