Clone Tools
  • last updated 18 mins ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Improved: Cannot find the declaration of element 'web-app' in version 3.0 files. (OFBIZ-6993)

I missed to backport changes web.xml (was OK in plugins)

  1. … 24 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Reverted: "Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)"

This reverts commit 3075027df7c82bcb381810d9d438150ef696254f.

  1. … 24 more files in changeset.
Reverted: "Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)"

This reverts commit a93b1fcb7859a754ba84b810c4736e7ef6778689.

  1. … 24 more files in changeset.
Revert "Improved: Update “web.xml” files version 3.0 → 4.0 (OFBIZ-6993)"

This reverts commit 226e901981b68941bbcf3e1025d2208061d28db6.

  1. … 24 more files in changeset.
Reverted: "Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)"

This reverts commit d1c037dca1ea14caf545c85c3741bb9af093f3c9.

  1. … 24 more files in changeset.
Improved: Update “web.xml” files version 3.0 → 4.0 (OFBIZ-6993)

  1. … 24 more files in changeset.
Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)

these declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: Add XML declaration in “web.xml” files (OFBIZ-6993)

These declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)

these declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: Add XML declaration in “web.xml” files (OFBIZ-6993)

These declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)

these declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Reverted: JSON entity data import and export utility (OFBIZ-10966)

Implementation was not matching OFBiz code quality requirements.

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1867342 13f79535-47bb-0310-9956-ffa450edef68

  1. … 17 more files in changeset.
Implemented: JSON entity data import and export utility (OFBIZ-10966)

Currently, we support import/export entity data in XML format.

Nowadays JSON is widely used in industry, we can have support for JSON format

which looks quite similar to XML support.

Here is example of XML data and it's JSON version

<Party partyId="123456" partyTypeId="PERSON" statusId="PARTY_ENABLED"/>

{“Party”: {"partyId":"123456","partyTypeId":"PERSON","statusId":"PARTY_ENABLED”}}

Design Proposal

We can write entityImportJson and entityImportDirJson services for importing

JSON from screen and directory respectively.

And the entityExportAllJson service for exporting entity data in JSON.

Import Design

The import service will perform following operations:

1.) Validate the input JSON data

2.) On successful validation, convert JSON to OFBiz's entity model

(GenericValue)

3.) The GenericValue will be inserted in database by some handler class for e.g

we can write JsonDataHandler, it will convert given JSON to

List<GenericValue>, and finally write it to database

(Similar pattern is used in XML import).

Export Design

Based on existing XML pattern the writeXmlText method of GenericEntity class

write the exported data in XML format.

In the similar way, we can implement writeJsonText to export data in JSON format.

jleroux: I fixed 2 trivials things and at my request in last patch Jayansh added

"JSON Data Export All" and "JSON Data Import Dir

Thanks: Jayansh Shinde

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1862206 13f79535-47bb-0310-9956-ffa450edef68

  1. … 17 more files in changeset.
"Applied fix from trunk for revision: 1851068 " ------------------------------------------------------------------------ r1851068 | jleroux | 2019-01-11 17:12:01 +0100 (ven. 11 janv. 2019) | 12 lignes

Fixed: Add session tracking mode and make cookie secure

(OFBIZ-6655)

Following "Session timeout for webapps" discussion on dev ML

https://markmail.org/message/p6fbiojjrwb2ybxd

We decided to put back the session-timeout value in web.xml files and to remove

the line

session.setMaxInactiveInterval(60*60); //in seconds

from ControlEventListener.java

Thanks: Deepak Nigam for report and Girish Vasmatkar for discussion

------------------------------------------------------------------------

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/branches/release17.12@1851071 13f79535-47bb-0310-9956-ffa450edef68

  1. … 15 more files in changeset.
"Applied fix from trunk for revision: 1851068 " ------------------------------------------------------------------------ r1851068 | jleroux | 2019-01-11 17:12:01 +0100 (ven. 11 janv. 2019) | 12 lignes

Fixed: Add session tracking mode and make cookie secure

(OFBIZ-6655)

Following "Session timeout for webapps" discussion on dev ML

https://markmail.org/message/p6fbiojjrwb2ybxd

We decided to put back the session-timeout value in web.xml files and to remove

the line

session.setMaxInactiveInterval(60*60); //in seconds

from ControlEventListener.java

Thanks: Deepak Nigam for report and Girish Vasmatkar for discussion

------------------------------------------------------------------------

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/branches/release18.12@1851070 13f79535-47bb-0310-9956-ffa450edef68

  1. … 15 more files in changeset.
Fixed: Add session tracking mode and make cookie secure (OFBIZ-6655)

Following "Session timeout for webapps" discussion on dev ML

https://markmail.org/message/p6fbiojjrwb2ybxd

We decided to put back the session-timeout value in web.xml files and to remove

the line

session.setMaxInactiveInterval(60*60); //in seconds

from ControlEventListener.java

Thanks: Deepak Nigam for report and Girish Vasmatkar for discussion

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1851068 13f79535-47bb-0310-9956-ffa450edef68

  1. … 15 more files in changeset.
Improved: Add session tracking mode and make cookie secure (OFBIZ-6655)

Programmatically replaces the web.xml <session-config> declarations and uses

the @WebListener annotation to start the process. This avoid to duplicates

things everywhere in web.xml files. Since the web.xml files have precedence

on annotations, the setting can be easily overridden when necessary.

Now that we also use HTTPS in ecommerce the ecommerce session cookie is

also secured.

I also noted that we had 8 weird <session-timeout> declarations:

in solr component: <session-timeout>2</session-timeout>

in themes: <session-timeout>1</session-timeout>

Also in Rainbowstone we lacked the <cookie-config> and <tracking-mode>

declarations. I think it's not good.

I resolve these points by simply removing the <session-config> in web.xml files

of themes and Solr.

Thanks: Pradhan Yash Sharma for review

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1811041 13f79535-47bb-0310-9956-ffa450edef68

  1. … 27 more files in changeset.
Fixed: Consistency and Readability improvements for view-map tag (OFBIZ-9110) Consistency on the attribute order for view-map element as : name, type, page Thanks to Ankush Upadhyay and Devanshu Vyas for the issue and the corrective patch

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1805892 13f79535-47bb-0310-9956-ffa450edef68

  1. … 9 more files in changeset.
Implemented: removed the "controller" related logic, that is now provided by the new ControlFilter, from the ContextFilter; modified existing applications to use the two filters in a chain; removed from the other specialized filters all the logic that was duplicated or extended from ContextFilter.

A web application, in order to leverage the OFBiz framework, requires that a

series of objects are in its contexts (servlet context, session and request)

such as "delegator", "delegatorName", "dispatcher", "security" etc. etc...

This setup is performed by the logic contained in the servlet filter implemented

by the ContextFilter class.

The execution of this logic is required for the application to run properly.

However, before this commit, in the ContextFilter there was other logic, related

to access control and redirection rules (some of them performed in coordination

with the ControlServlet), making it difficult to deploy this filter in all the

web applications, especially the ones that implement special handling of paths.

In fact, this filter was deployed in most but not all the web application in the

OFBiz codebase: specifically it was not deployed in web applications that

require the execution of other filters (e.g. CatalogUrlFilter, etc...) like the

ones in the "ecommerce" and "solr" components.

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1761304 13f79535-47bb-0310-9956-ffa450edef68

  1. … 50 more files in changeset.
Applied patch from jira issue - OFBIZ-8091 - Clean up commented out code in XML for Common component. Thanks Aman for the contribution.

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1759152 13f79535-47bb-0310-9956-ffa450edef68

  1. … 4 more files in changeset.
(OFBIZ-6274) Renamed OFBiz artefacts from org.ofbiz.* to org.apache.ofbiz.*.Thanks to Taher for working on it.

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1752920 13f79535-47bb-0310-9956-ffa450edef68

  1. … 3610 more files in changeset.
OFBIZ-7763 Removed a series of artifacts dependent on the old Beanshell jar that is going to be removed from the project; specifically: * removed the code that implemented the deprecated "call-bsh" operation in Minilang * removed the BeanShellContainer (it has been disabled a long time ago) * removed the BeanShell service engine, no more used

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1751947 13f79535-47bb-0310-9956-ffa450edef68

  1. … 18 more files in changeset.
Fixes a "typo" in last commit for "Autocompletion for Compound Widget" - https://issues.apache.org/jira/browse/OFBIZ-7061

We used targetNamespace (should only be used in schema) instead of xsi:schemaLocation

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1749634 13f79535-47bb-0310-9956-ffa450edef68

  1. … 771 more files in changeset.
Completes and finish "Autocompletion for Compound Widget" - https://issues.apache.org/jira/browse/OFBIZ-7061

This is the 2nd step: puts back the original names, so it will be transparent for remaining references in xml catalogs, Java code, etc.

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1749489 13f79535-47bb-0310-9956-ffa450edef68

  1. … 786 more files in changeset.
Completes and finish "Autocompletion for Compound Widget" - https://issues.apache.org/jira/browse/OFBIZ-7061 by replacing xsd files references in xml files by -ns.xsd files and removing the concerned xsd files

This is a 1st step, in a 2nd I will put back the original names, so it will be transparent for remaining reference in xml catalogs, Java code, etc.

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1749488 13f79535-47bb-0310-9956-ffa450edef68

  1. … 779 more files in changeset.
(OFBIZ-7222) Relocate .groovy files in the commonext component

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@1747751 13f79535-47bb-0310-9956-ffa450edef68

    • -41
    • +0
    ./actions/GetProductStoreAndWebSite.groovy
  1. … 6 more files in changeset.