You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@struts.apache.org by Lukasz Lenart <lu...@apache.org> on 2016/03/18 21:46:59 UTC
[VOTE] Struts 2.3.28
The Apache Struts 2.3.28 test build is now available. With this release:
- Possible XSS vulnerability in pages not using UTF-8 was fixed, read
more details in S2-028
- Prevents possible RCE when reusing user input in tag's attributes,
see more details in S2-029
- I18NInterceptor narrows selected locale to those available in JVM to
reduce possibility of another XSS vulnerability, see more details in
S2-030
- New Configurationprovider type was introduced -
ServletContextAwareConfigurationProvider, see WW-4410
- Setting status code in HttpHeaders isn't ignored anymore, see WW-4545
- Spring BeanPostProcessor(s) are called only once to constructed
objects., see WW-4554
- OGNL was upgraded to version 3.0.13, see WW-4562
- Tiles 2 Plugin was upgraded to latest available Tiles 2 version, see WW-4568
- A dedicated assembly with minimal set of jars was defined, see WW-4570
- Struts2 Rest plugin properly handles JSESSIONID with DMI, see WW-4585
- Improved the Struts2 Rest plugin to honor Accept header, see WW-4588
- MessageStoreInterceptor was refactored to use PreResultListener to
store messages, see WW-4605
- A new annotation was added to support configuring Tiles -
@TilesDefinition, see WW-4606
and few other small improvements, please see the release notes
Security note:
This release fixes three potential security vulnerabilities as
mentioned in the Version Notes
Release notes:
* https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.3.28
Distribution:
* https://dist.apache.org/repos/dist/dev/struts/2.3.28/
Maven 2 staging repository:
* https://repository.apache.org/content/repositories/staging/
Once you have had a chance to review the test build, please respond
with a vote on its quality:
[ ] Leave at test build
[ ] Alpha
[ ] Beta
[ ] General Availability (GA)
Everyone who has tested the build is invited to vote. Votes by PMC
members are considered binding. A vote passes if there are at least
three binding +1s and more +1s than -1s.
The vote will remain open for at least 72 hours, longer upon request.
A vote can be amended at any time to upgrade or downgrade the quality
of the release based on future experience. If an initial vote
designates the build as "Beta", the release will be submitted for
mirroring and announced to the user list. Once released as a public
beta, subsequent quality votes on a build may be held on the user
list.
As always, the act of voting carries certain obligations. A binding
vote not only states an opinion, but means that the voter is agreeing
to help do the work.
Kind regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [VOTE] Struts 2.3.28
Posted by Lukasz Lenart <lu...@apache.org>.
2016-03-18 21:46 GMT+01:00 Lukasz Lenart <lu...@apache.org>:
> [ ] Leave at test build
> [ ] Alpha
> [ ] Beta
> [X] General Availability (GA)
+1 (binding)
Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: [VOTE] Struts 2.3.28
Posted by Johannes Geppert <jo...@apache.org>.
[ ] Leave at test build
[ ] Alpha
[ ] Beta
[X] General Availability (GA)
+1 binding
Best Regards
Johannes
#################################################
web: http://www.jgeppert.com
twitter: http://twitter.com/jogep
2016-03-19 12:07 GMT+01:00 Greg Huber <gr...@gmail.com>:
> Thanks, redirect messages and interceptor switching correctly now.
>
> [ ] Leave at test build
> [ ] Alpha
> [ ] Beta
> [x] General Availability (GA)
>
> +1 binding
>
> On 18 March 2016 at 20:46, Lukasz Lenart <lu...@apache.org> wrote:
>
> > The Apache Struts 2.3.28 test build is now available. With this release:
> > - Possible XSS vulnerability in pages not using UTF-8 was fixed, read
> > more details in S2-028
> > - Prevents possible RCE when reusing user input in tag's attributes,
> > see more details in S2-029
> > - I18NInterceptor narrows selected locale to those available in JVM to
> > reduce possibility of another XSS vulnerability, see more details in
> > S2-030
> > - New Configurationprovider type was introduced -
> > ServletContextAwareConfigurationProvider, see WW-4410
> > - Setting status code in HttpHeaders isn't ignored anymore, see WW-4545
> > - Spring BeanPostProcessor(s) are called only once to constructed
> > objects., see WW-4554
> > - OGNL was upgraded to version 3.0.13, see WW-4562
> > - Tiles 2 Plugin was upgraded to latest available Tiles 2 version, see
> > WW-4568
> > - A dedicated assembly with minimal set of jars was defined, see WW-4570
> > - Struts2 Rest plugin properly handles JSESSIONID with DMI, see WW-4585
> > - Improved the Struts2 Rest plugin to honor Accept header, see WW-4588
> > - MessageStoreInterceptor was refactored to use PreResultListener to
> > store messages, see WW-4605
> > - A new annotation was added to support configuring Tiles -
> > @TilesDefinition, see WW-4606
> >
> > and few other small improvements, please see the release notes
> >
> > Security note:
> > This release fixes three potential security vulnerabilities as
> > mentioned in the Version Notes
> >
> > Release notes:
> > * https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.3.28
> >
> > Distribution:
> > * https://dist.apache.org/repos/dist/dev/struts/2.3.28/
> >
> > Maven 2 staging repository:
> > * https://repository.apache.org/content/repositories/staging/
> >
> > Once you have had a chance to review the test build, please respond
> > with a vote on its quality:
> >
> > [ ] Leave at test build
> > [ ] Alpha
> > [ ] Beta
> > [ ] General Availability (GA)
> >
> > Everyone who has tested the build is invited to vote. Votes by PMC
> > members are considered binding. A vote passes if there are at least
> > three binding +1s and more +1s than -1s.
> >
> > The vote will remain open for at least 72 hours, longer upon request.
> > A vote can be amended at any time to upgrade or downgrade the quality
> > of the release based on future experience. If an initial vote
> > designates the build as "Beta", the release will be submitted for
> > mirroring and announced to the user list. Once released as a public
> > beta, subsequent quality votes on a build may be held on the user
> > list.
> >
> > As always, the act of voting carries certain obligations. A binding
> > vote not only states an opinion, but means that the voter is agreeing
> > to help do the work.
> >
> >
> > Kind regards
> > --
> > Łukasz
> > + 48 606 323 122 http://www.lenart.org.pl/
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail: dev-help@struts.apache.org
> >
> >
>
Re: [VOTE] Struts 2.3.28
Posted by Greg Huber <gr...@gmail.com>.
Thanks, redirect messages and interceptor switching correctly now.
[ ] Leave at test build
[ ] Alpha
[ ] Beta
[x] General Availability (GA)
+1 binding
On 18 March 2016 at 20:46, Lukasz Lenart <lu...@apache.org> wrote:
> The Apache Struts 2.3.28 test build is now available. With this release:
> - Possible XSS vulnerability in pages not using UTF-8 was fixed, read
> more details in S2-028
> - Prevents possible RCE when reusing user input in tag's attributes,
> see more details in S2-029
> - I18NInterceptor narrows selected locale to those available in JVM to
> reduce possibility of another XSS vulnerability, see more details in
> S2-030
> - New Configurationprovider type was introduced -
> ServletContextAwareConfigurationProvider, see WW-4410
> - Setting status code in HttpHeaders isn't ignored anymore, see WW-4545
> - Spring BeanPostProcessor(s) are called only once to constructed
> objects., see WW-4554
> - OGNL was upgraded to version 3.0.13, see WW-4562
> - Tiles 2 Plugin was upgraded to latest available Tiles 2 version, see
> WW-4568
> - A dedicated assembly with minimal set of jars was defined, see WW-4570
> - Struts2 Rest plugin properly handles JSESSIONID with DMI, see WW-4585
> - Improved the Struts2 Rest plugin to honor Accept header, see WW-4588
> - MessageStoreInterceptor was refactored to use PreResultListener to
> store messages, see WW-4605
> - A new annotation was added to support configuring Tiles -
> @TilesDefinition, see WW-4606
>
> and few other small improvements, please see the release notes
>
> Security note:
> This release fixes three potential security vulnerabilities as
> mentioned in the Version Notes
>
> Release notes:
> * https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.3.28
>
> Distribution:
> * https://dist.apache.org/repos/dist/dev/struts/2.3.28/
>
> Maven 2 staging repository:
> * https://repository.apache.org/content/repositories/staging/
>
> Once you have had a chance to review the test build, please respond
> with a vote on its quality:
>
> [ ] Leave at test build
> [ ] Alpha
> [ ] Beta
> [ ] General Availability (GA)
>
> Everyone who has tested the build is invited to vote. Votes by PMC
> members are considered binding. A vote passes if there are at least
> three binding +1s and more +1s than -1s.
>
> The vote will remain open for at least 72 hours, longer upon request.
> A vote can be amended at any time to upgrade or downgrade the quality
> of the release based on future experience. If an initial vote
> designates the build as "Beta", the release will be submitted for
> mirroring and announced to the user list. Once released as a public
> beta, subsequent quality votes on a build may be held on the user
> list.
>
> As always, the act of voting carries certain obligations. A binding
> vote not only states an opinion, but means that the voter is agreeing
> to help do the work.
>
>
> Kind regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>
Re: [VOTE] Struts 2.3.28
Posted by Christoph Nenning <Ch...@lex-com.net>.
> [ ] Leave at test build
> [ ] Alpha
> [ ] Beta
> [X] General Availability (GA)
+1 (binding)
Regards
Christoph
This Email was scanned by Sophos Anti Virus