stripesframework / stripes-stuff Goto Github PK

If an Exception is raised in ActionBean and it is not treated locally with try/catch then the Interceptor is not able to intercept LifecycleStage.ResolutionExecution, and will not put the SecurityManager into the request. And by default, the AllowedTag is returnig true if the SecurityManager is not found in the request.
Possible solutions:

1. AllowedTag returns false if SecurityManager is not found.
2. Moving SecurityManager from request to session. This way you only put it once not in every request.

In Context class, the run method throws an UnknownServiceException when the content-type cannot be handled by Java.

A better implement would be to use UrlConnection.getInputStream() and empty the stream.

The test WaitPageTest.requestMessages fails.

It seems the messages are not copied properly from wait page flash scope to final page flash scope.

FreeMarker does not work well with EVAL_BODY_AGAIN that is returned by doStartTag().
It would make more sense to return EVAL_BODY_INCLUDE.

Any chance we can push a release out with the new dependency issue resolved? I don't think we are going to get any other issues in the near future that we can include in this release :)

The 3 javax annotations are missing in the .4 release.

The WaitPageInterceptor uses the identity of the current user and sends another request to start the long process. This implementation cannot work with HTTPS.
The result of using this is that the long process is never started and the user is blocked on the wait page.

A workaround for now it to use Apache HTTP Server and ProxyPass so that Apache process the secured connection and the Java server (ex: Tomcat) will process regular HTTP requests allowing the session id to be stolen by WaitPageInterceptor.