You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tapestry.apache.org by Paul Ferraro <pm...@columbia.edu> on 2005/03/19 02:18:40 UTC
[VOTE] Release 3.0.3
I finished patching/fixing all of the big issues identified with the
last release. With any luck, this will be the last release for the 3.0
branch.
This vote will run for one week. A +1 vote is to release Tapestry
3.0.3. I will be able to start the release once the votes are tallied.
To summarize, the 3.0.3 release will contain the following changes:
* Fixes security flaw in asset service.
* JanitorThread now terminates explicitly when servlet is destroyed.
Interruption properly terminates thread during sweep operation.
* Fixed bug preventing DatePicker calendar window from closing
automatically if onchange event handler is not specified.
* DatePicker onchange event now only fires when date changes.
* Patch for bad translation in ValidationStrings_zh_TW.properties
* Patch for bad translation in ValidationStrings_zh_CN.properties
* Fixed incorrect test for enabling rendering of element in
FormConditional component.
* Fixes missing type attribute of script tag in Body component.
* Fixes improper engine cleanup when client aborts a request.
* Build scripts are now Java 1.5 friendly.
Paul Ferraro: +1 (binding)
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Paul Ferraro <pm...@columbia.edu>.
There are several reason for storing ResourceChecksumSource in the engine:
1.) So that can be accessed from both the AssetService and from
PrivateAsset.
2.) So that the internal cache of computed checksum values can be reset
when the engine is reset.
2.) So that it can be stored in the servlet context
The engine is really the natural place for it, at least in a
non-HiveMind world.
I hear your concern. Ideally, interface changes should be reserved for
major releases, but due to the severity of the security issue, I think
this fix is in order. I did think about the impact of modifying an
established interface, but concluded that a.) it way the best and most
natural implementation; b) nobody would realistically be impacted.
What do other people think?
Paul
Erik Hatcher wrote:
>
> On Mar 18, 2005, at 9:09 PM, Paul Ferraro wrote:
>
>>> I only vaguely caught the commit messages.... was a method added to
>>> IEngine? I saw it added to the MockEngine with a comment about
>>> IEngine. That seems fairly dramatic if a method was added to an
>>> interface - that could certainly break builds for someone
>>> upgrading. If I'm mistaken, please disregard.
>>
>>
>> A new method was added to the IEngine interface.
>> getResourceChecksumSource() - an 3.0 adaptation from the code in the
>> 3.1 branch that fixes the security hole with the asset service.
>> I would expect that there most developers using custom engines out
>> there extend from BaseEngine, or at least AbstractEngine.
>> AbstractEngine contains the default implementation for this new
>> method, so this would *not* break anyone's build unless their custom
>> engine does not extend from AbstractEngine. I would imagine that
>> there are very few, if any, cases that would fall into that
>> category. Would you agree?
>
>
> I do agree that it is unlikely that anyone is implementing IEngine
> directly, but I come from the Ant world where API compatibility is
> considered mandatory. Is it necessary to add this method there? What
> about using an extension rather than a hook off of IEngine?
>
> I won't block a 3.0.3 based on this one item - it will not affect me
> as I always extend from BaseEngine. But it is worth being nitpicky
> about API changes in general, otherwise we risk starting from scratch
> every time we upgrade and have to adjust our code to account for it.
>
> Erik
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Erik Hatcher <er...@ehatchersolutions.com>.
On Mar 18, 2005, at 9:09 PM, Paul Ferraro wrote:
>> I only vaguely caught the commit messages.... was a method added to
>> IEngine? I saw it added to the MockEngine with a comment about
>> IEngine. That seems fairly dramatic if a method was added to an
>> interface - that could certainly break builds for someone upgrading.
>> If I'm mistaken, please disregard.
>
> A new method was added to the IEngine interface.
> getResourceChecksumSource() - an 3.0 adaptation from the code in the
> 3.1 branch that fixes the security hole with the asset service.
> I would expect that there most developers using custom engines out
> there extend from BaseEngine, or at least AbstractEngine.
> AbstractEngine contains the default implementation for this new
> method, so this would *not* break anyone's build unless their custom
> engine does not extend from AbstractEngine. I would imagine that
> there are very few, if any, cases that would fall into that category.
> Would you agree?
I do agree that it is unlikely that anyone is implementing IEngine
directly, but I come from the Ant world where API compatibility is
considered mandatory. Is it necessary to add this method there? What
about using an extension rather than a hook off of IEngine?
I won't block a 3.0.3 based on this one item - it will not affect me as
I always extend from BaseEngine. But it is worth being nitpicky about
API changes in general, otherwise we risk starting from scratch every
time we upgrade and have to adjust our code to account for it.
Erik
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Paul Ferraro <pm...@columbia.edu>.
Erik Hatcher wrote:
> Paul,
>
> First - kudos for picking up the ball on this one. I strongly believe
> keeping the 3.0.x line of Tapestry alive and healthy is best for the
> community and the fixes you've put in are much needed.
>
> All tests pass?
>
Of course :).
> I only vaguely caught the commit messages.... was a method added to
> IEngine? I saw it added to the MockEngine with a comment about
> IEngine. That seems fairly dramatic if a method was added to an
> interface - that could certainly break builds for someone upgrading.
> If I'm mistaken, please disregard.
A new method was added to the IEngine interface.
getResourceChecksumSource() - an 3.0 adaptation from the code in the 3.1
branch that fixes the security hole with the asset service.
I would expect that there most developers using custom engines out there
extend from BaseEngine, or at least AbstractEngine. AbstractEngine
contains the default implementation for this new method, so this would
*not* break anyone's build unless their custom engine does not extend
from AbstractEngine. I would imagine that there are very few, if any,
cases that would fall into that category. Would you agree?
Paul
>
>
> Erik
>
> On Mar 18, 2005, at 8:18 PM, Paul Ferraro wrote:
>
>> I finished patching/fixing all of the big issues identified with the
>> last release. With any luck, this will be the last release for the
>> 3.0 branch.
>> This vote will run for one week. A +1 vote is to release Tapestry
>> 3.0.3. I will be able to start the release once the votes are tallied.
>>
>> To summarize, the 3.0.3 release will contain the following changes:
>> * Fixes security flaw in asset service.
>> * JanitorThread now terminates explicitly when servlet is destroyed.
>> Interruption properly terminates thread during sweep operation.
>> * Fixed bug preventing DatePicker calendar window from closing
>> automatically if onchange event handler is not specified.
>> * DatePicker onchange event now only fires when date changes.
>> * Patch for bad translation in ValidationStrings_zh_TW.properties
>> * Patch for bad translation in ValidationStrings_zh_CN.properties
>> * Fixed incorrect test for enabling rendering of element in
>> FormConditional component.
>> * Fixes missing type attribute of script tag in Body component.
>> * Fixes improper engine cleanup when client aborts a request.
>> * Build scripts are now Java 1.5 friendly.
>>
>> Paul Ferraro: +1 (binding)
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by "matthew c. mead" <m-...@goof.com>.
public ResourceChecksumSource getResourceChecksumSource();
was added to IEngine to allow an overridable source of message digests
for the asset service. It was also implemented in the AbstractEngine
class with a default of MD5. Howard's corresponding fix to the 3.1 tree
that inspired this patch used dependency injection via HiveMind.
If someone implements IEngine directly, you're right, they could end up
with a compile error because of this addition.
I'm +1 for the release despite this, assuming my vote counts at all. ;)
-matt
Erik Hatcher wrote:
> Paul,
>
> First - kudos for picking up the ball on this one. I strongly believe
> keeping the 3.0.x line of Tapestry alive and healthy is best for the
> community and the fixes you've put in are much needed.
>
> All tests pass?
>
> I only vaguely caught the commit messages.... was a method added to
> IEngine? I saw it added to the MockEngine with a comment about
> IEngine. That seems fairly dramatic if a method was added to an
> interface - that could certainly break builds for someone upgrading.
> If I'm mistaken, please disregard.
>
> Erik
>
> On Mar 18, 2005, at 8:18 PM, Paul Ferraro wrote:
>
>> I finished patching/fixing all of the big issues identified with the
>> last release. With any luck, this will be the last release for the
>> 3.0 branch.
>> This vote will run for one week. A +1 vote is to release Tapestry
>> 3.0.3. I will be able to start the release once the votes are tallied.
>>
>> To summarize, the 3.0.3 release will contain the following changes:
>> * Fixes security flaw in asset service.
>> * JanitorThread now terminates explicitly when servlet is destroyed.
>> Interruption properly terminates thread during sweep operation.
>> * Fixed bug preventing DatePicker calendar window from closing
>> automatically if onchange event handler is not specified.
>> * DatePicker onchange event now only fires when date changes.
>> * Patch for bad translation in ValidationStrings_zh_TW.properties
>> * Patch for bad translation in ValidationStrings_zh_CN.properties
>> * Fixed incorrect test for enabling rendering of element in
>> FormConditional component.
>> * Fixes missing type attribute of script tag in Body component.
>> * Fixes improper engine cleanup when client aborts a request.
>> * Build scripts are now Java 1.5 friendly.
>>
>> Paul Ferraro: +1 (binding)
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Geoff Longman <gl...@gmail.com>.
I think the interface change your spotted Erik is
IEngine.getResourceChecksumSource().
Isn't that the backport of Howards fix for the asset security hole?
Geoff
On Fri, 18 Mar 2005 20:45:11 -0500, Erik Hatcher
<er...@ehatchersolutions.com> wrote:
> Paul,
>
> First - kudos for picking up the ball on this one. I strongly believe
> keeping the 3.0.x line of Tapestry alive and healthy is best for the
> community and the fixes you've put in are much needed.
>
> All tests pass?
>
> I only vaguely caught the commit messages.... was a method added to
> IEngine? I saw it added to the MockEngine with a comment about
> IEngine. That seems fairly dramatic if a method was added to an
> interface - that could certainly break builds for someone upgrading.
> If I'm mistaken, please disregard.
>
> Erik
>
> On Mar 18, 2005, at 8:18 PM, Paul Ferraro wrote:
>
> > I finished patching/fixing all of the big issues identified with the
> > last release. With any luck, this will be the last release for the
> > 3.0 branch.
> > This vote will run for one week. A +1 vote is to release Tapestry
> > 3.0.3. I will be able to start the release once the votes are
> > tallied.
> >
> > To summarize, the 3.0.3 release will contain the following changes:
> > * Fixes security flaw in asset service.
> > * JanitorThread now terminates explicitly when servlet is destroyed.
> > Interruption properly terminates thread during sweep operation.
> > * Fixed bug preventing DatePicker calendar window from closing
> > automatically if onchange event handler is not specified.
> > * DatePicker onchange event now only fires when date changes.
> > * Patch for bad translation in ValidationStrings_zh_TW.properties
> > * Patch for bad translation in ValidationStrings_zh_CN.properties
> > * Fixed incorrect test for enabling rendering of element in
> > FormConditional component.
> > * Fixes missing type attribute of script tag in Body component.
> > * Fixes improper engine cleanup when client aborts a request.
> > * Build scripts are now Java 1.5 friendly.
> >
> > Paul Ferraro: +1 (binding)
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Erik Hatcher <er...@ehatchersolutions.com>.
Paul,
First - kudos for picking up the ball on this one. I strongly believe
keeping the 3.0.x line of Tapestry alive and healthy is best for the
community and the fixes you've put in are much needed.
All tests pass?
I only vaguely caught the commit messages.... was a method added to
IEngine? I saw it added to the MockEngine with a comment about
IEngine. That seems fairly dramatic if a method was added to an
interface - that could certainly break builds for someone upgrading.
If I'm mistaken, please disregard.
Erik
On Mar 18, 2005, at 8:18 PM, Paul Ferraro wrote:
> I finished patching/fixing all of the big issues identified with the
> last release. With any luck, this will be the last release for the
> 3.0 branch.
> This vote will run for one week. A +1 vote is to release Tapestry
> 3.0.3. I will be able to start the release once the votes are
> tallied.
>
> To summarize, the 3.0.3 release will contain the following changes:
> * Fixes security flaw in asset service.
> * JanitorThread now terminates explicitly when servlet is destroyed.
> Interruption properly terminates thread during sweep operation.
> * Fixed bug preventing DatePicker calendar window from closing
> automatically if onchange event handler is not specified.
> * DatePicker onchange event now only fires when date changes.
> * Patch for bad translation in ValidationStrings_zh_TW.properties
> * Patch for bad translation in ValidationStrings_zh_CN.properties
> * Fixed incorrect test for enabling rendering of element in
> FormConditional component.
> * Fixes missing type attribute of script tag in Body component.
> * Fixes improper engine cleanup when client aborts a request.
> * Build scripts are now Java 1.5 friendly.
>
> Paul Ferraro: +1 (binding)
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by David Solis <ds...@gmail.com>.
David Solis: +1 (binding)
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Howard Lewis Ship <hl...@gmail.com>.
Howard Lewis Ship: +1 (binding)
Great work!
On Fri, 18 Mar 2005 17:18:40 -0800, Paul Ferraro <pm...@columbia.edu> wrote:
> I finished patching/fixing all of the big issues identified with the
> last release. With any luck, this will be the last release for the 3.0
> branch.
> This vote will run for one week. A +1 vote is to release Tapestry
> 3.0.3. I will be able to start the release once the votes are tallied.
>
> To summarize, the 3.0.3 release will contain the following changes:
> * Fixes security flaw in asset service.
> * JanitorThread now terminates explicitly when servlet is destroyed.
> Interruption properly terminates thread during sweep operation.
> * Fixed bug preventing DatePicker calendar window from closing
> automatically if onchange event handler is not specified.
> * DatePicker onchange event now only fires when date changes.
> * Patch for bad translation in ValidationStrings_zh_TW.properties
> * Patch for bad translation in ValidationStrings_zh_CN.properties
> * Fixed incorrect test for enabling rendering of element in
> FormConditional component.
> * Fixes missing type attribute of script tag in Body component.
> * Fixes improper engine cleanup when client aborts a request.
> * Build scripts are now Java 1.5 friendly.
>
> Paul Ferraro: +1 (binding)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
>
--
Howard M. Lewis Ship
Independent J2EE / Open-Source Java Consultant
Creator, Jakarta Tapestry
Creator, Jakarta HiveMind
Professional Tapestry training, mentoring, support
and project work. http://howardlewisship.com
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by "Brian K. Wallace" <br...@transmorphix.com>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I agree that this would probably be more appropriate as RC1. As
interested as people have been in 3.0.3, I'm sure it would only be a
prelude to a release but it would be better to go through RC1 than find
out there needs to be a 3.0.4 to readdress issues from 3.0.3.
Excellent work on putting this together. It's very good (community-wise)
to see more committers taking a lead in releases.
+1 (non-binding)
Richard Lewis-Shell wrote:
| Nice work Paul.
|
| I'm +0 for releasing 3.0.3 - mainly because I wonder if releasing this
| as 3.0.3rc1 might be better? Give it a week or two for the impact of
| the security fix to be asssessed (eg. is the computation impact or cache
| size significant? Will the interface change really affect anyone?).
|
| Richard
|
| Paul Ferraro wrote:
|
|> I finished patching/fixing all of the big issues identified with the
|> last release. With any luck, this will be the last release for the
|> 3.0 branch.
|> This vote will run for one week. A +1 vote is to release Tapestry
|> 3.0.3. I will be able to start the release once the votes are tallied.
|>
|> To summarize, the 3.0.3 release will contain the following changes:
|> * Fixes security flaw in asset service.
|> * JanitorThread now terminates explicitly when servlet is destroyed.
|> Interruption properly terminates thread during sweep operation.
|> * Fixed bug preventing DatePicker calendar window from closing
|> automatically if onchange event handler is not specified.
|> * DatePicker onchange event now only fires when date changes.
|> * Patch for bad translation in ValidationStrings_zh_TW.properties
|> * Patch for bad translation in ValidationStrings_zh_CN.properties
|> * Fixed incorrect test for enabling rendering of element in
|> FormConditional component.
|> * Fixes missing type attribute of script tag in Body component.
|> * Fixes improper engine cleanup when client aborts a request.
|> * Build scripts are now Java 1.5 friendly.
|>
|> Paul Ferraro: +1 (binding)
|>
|>
|> ---------------------------------------------------------------------
|> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
|> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
|>
|>
|
| ---------------------------------------------------------------------
| To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
| For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
|
|
|
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (MingW32)
iD8DBQFCPGPDaCoPKRow/gARAgMjAJ9C0MYYa8K0GePrxgA695epWfWPqQCeKLXX
9HprQZh+08NiEvtdwD2qcVY=
=4Bqd
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Tsvetelin Saykov <ts...@rushmore-digital.com>.
Hi,
+1 for 3.0.3
As I can see the changes are bug fixes and I don't think that we need
to start process with RC.
Ceco
PS I don't think that the changes of the IEngine interface at this stage is
a good idea but we can take the risk - acceptable one. In future we need to
avoid this.
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Mind Bridge <mi...@yahoo.com>.
Hi,
+1 for 3.0.3.
I do think however that the code must pass through an RC for a couple of
weeks before the final version is released. If a minor problem pops up, this
approach will at least allow it to be fixed before 3.0.3 is declared final
and will avoid a need for 3.0.4.
Best regards,
-mb
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Erik Hatcher <er...@ehatchersolutions.com>.
On Mar 19, 2005, at 1:46 PM, Paul Ferraro wrote:
> 3.) regarding a release candidate:
> I would have no objections to that. What do others think?
Seems like a good idea, given the handful of changes going into this.
Erik
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Paul Ferraro <pm...@columbia.edu>.
A few quite comments...
1.) regarding computation impact:
Developers can override AbstractEngine.createResourceChecksumSource() to
change/tweak the implementation. The existing ResourceChecksumSourceImp
implementation allows you to specifiy the hash algorithm (default is
MD5) in its constructor. You could easily specify a cheaper algorithm
(e.g. MD2) or more secure algorithm (e.g. SHA-512). A CRC32 or
Adler32-based implementation (I considered including one) will result in
much faster checksum computation.
2.) regarding significance of cache size:
The existing ResourceChecksumSourceImp implementation also allows you to
specifiy the encoding scheme (default is Hex) in its constructor. Using
Base64 encoding would result in smaller strings to cache. It's not
much, but it helps. The checksum values from the
java.util.zip.Checksum classes, when converted to a string, are also
smaller than the encoded digests returned by the default
implementation. Perhaps the map used to cache computed checksum values
could also be a constructor parameter so that a developer can easily
tune the initial size, or even the implementation (e.g. WeakHashMap for
the jdk 1.4 folks).
3.) regarding a release candidate:
I would have no objections to that. What do others think?
Paul
Richard Lewis-Shell wrote:
> Nice work Paul.
>
> I'm +0 for releasing 3.0.3 - mainly because I wonder if releasing this
> as 3.0.3rc1 might be better? Give it a week or two for the impact of
> the security fix to be asssessed (eg. is the computation impact or
> cache size significant? Will the interface change really affect
> anyone?).
>
> Richard
>
> Paul Ferraro wrote:
>
>> I finished patching/fixing all of the big issues identified with the
>> last release. With any luck, this will be the last release for the
>> 3.0 branch.
>> This vote will run for one week. A +1 vote is to release Tapestry
>> 3.0.3. I will be able to start the release once the votes are tallied.
>>
>> To summarize, the 3.0.3 release will contain the following changes:
>> * Fixes security flaw in asset service.
>> * JanitorThread now terminates explicitly when servlet is destroyed.
>> Interruption properly terminates thread during sweep operation.
>> * Fixed bug preventing DatePicker calendar window from closing
>> automatically if onchange event handler is not specified.
>> * DatePicker onchange event now only fires when date changes.
>> * Patch for bad translation in ValidationStrings_zh_TW.properties
>> * Patch for bad translation in ValidationStrings_zh_CN.properties
>> * Fixed incorrect test for enabling rendering of element in
>> FormConditional component.
>> * Fixes missing type attribute of script tag in Body component.
>> * Fixes improper engine cleanup when client aborts a request.
>> * Build scripts are now Java 1.5 friendly.
>>
>> Paul Ferraro: +1 (binding)
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>>
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Richard Lewis-Shell <rl...@mac.com>.
Nice work Paul.
I'm +0 for releasing 3.0.3 - mainly because I wonder if releasing this
as 3.0.3rc1 might be better? Give it a week or two for the impact of
the security fix to be asssessed (eg. is the computation impact or cache
size significant? Will the interface change really affect anyone?).
Richard
Paul Ferraro wrote:
> I finished patching/fixing all of the big issues identified with the
> last release. With any luck, this will be the last release for the 3.0
> branch.
> This vote will run for one week. A +1 vote is to release Tapestry
> 3.0.3. I will be able to start the release once the votes are tallied.
>
> To summarize, the 3.0.3 release will contain the following changes:
> * Fixes security flaw in asset service.
> * JanitorThread now terminates explicitly when servlet is destroyed.
> Interruption properly terminates thread during sweep operation.
> * Fixed bug preventing DatePicker calendar window from closing
> automatically if onchange event handler is not specified.
> * DatePicker onchange event now only fires when date changes.
> * Patch for bad translation in ValidationStrings_zh_TW.properties
> * Patch for bad translation in ValidationStrings_zh_CN.properties
> * Fixed incorrect test for enabling rendering of element in
> FormConditional component.
> * Fixes missing type attribute of script tag in Body component.
> * Fixes improper engine cleanup when client aborts a request.
> * Build scripts are now Java 1.5 friendly.
>
> Paul Ferraro: +1 (binding)
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Jamie Orchard-Hays <ja...@dang.com>.
Jamie Orchard-Hays: +1 (non-binding)
----- Original Message -----
From: "Paul Ferraro" <pm...@columbia.edu>
To: "Tapestry development" <ta...@jakarta.apache.org>
Sent: Friday, March 18, 2005 8:18 PM
Subject: [VOTE] Release 3.0.3
>I finished patching/fixing all of the big issues identified with the
> last release. With any luck, this will be the last release for the 3.0
> branch.
> This vote will run for one week. A +1 vote is to release Tapestry
> 3.0.3. I will be able to start the release once the votes are tallied.
>
> To summarize, the 3.0.3 release will contain the following changes:
> * Fixes security flaw in asset service.
> * JanitorThread now terminates explicitly when servlet is destroyed.
> Interruption properly terminates thread during sweep operation.
> * Fixed bug preventing DatePicker calendar window from closing
> automatically if onchange event handler is not specified.
> * DatePicker onchange event now only fires when date changes.
> * Patch for bad translation in ValidationStrings_zh_TW.properties
> * Patch for bad translation in ValidationStrings_zh_CN.properties
> * Fixed incorrect test for enabling rendering of element in
> FormConditional component.
> * Fixes missing type attribute of script tag in Body component.
> * Fixes improper engine cleanup when client aborts a request.
> * Build scripts are now Java 1.5 friendly.
>
> Paul Ferraro: +1 (binding)
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
Re: [VOTE] Release 3.0.3
Posted by Harish Krishnaswamy <ha...@gmail.com>.
Harish Krishnaswamy: +1
On Fri, 18 Mar 2005 17:18:40 -0800, Paul Ferraro <pm...@columbia.edu> wrote:
> I finished patching/fixing all of the big issues identified with the
> last release. With any luck, this will be the last release for the 3.0
> branch.
> This vote will run for one week. A +1 vote is to release Tapestry
> 3.0.3. I will be able to start the release once the votes are tallied.
>
> To summarize, the 3.0.3 release will contain the following changes:
> * Fixes security flaw in asset service.
> * JanitorThread now terminates explicitly when servlet is destroyed.
> Interruption properly terminates thread during sweep operation.
> * Fixed bug preventing DatePicker calendar window from closing
> automatically if onchange event handler is not specified.
> * DatePicker onchange event now only fires when date changes.
> * Patch for bad translation in ValidationStrings_zh_TW.properties
> * Patch for bad translation in ValidationStrings_zh_CN.properties
> * Fixed incorrect test for enabling rendering of element in
> FormConditional component.
> * Fixes missing type attribute of script tag in Body component.
> * Fixes improper engine cleanup when client aborts a request.
> * Build scripts are now Java 1.5 friendly.
>
> Paul Ferraro: +1 (binding)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-dev-help@jakarta.apache.org