You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@wicket.apache.org by Martijn Dashorst <ma...@gmail.com> on 2007/04/20 00:52:36 UTC
[vote] Release Wicket 1.2.6
This is a vote to release Wicket 1.2.6 this weekend.
There are still some issues open, but I hope they can be solved either
for we release, or we should just postpone them to 1.2.7
Open issues:
WICKET-268 NPE in ListView.renderItem(ListItem)
WICKET-349 ListView can't undo changes to model
WICKET-475 NPE in WebClientInfo when user-agent header is not sent
WICKET-438 File handles are leaked when loading images from a jar
file, Tomcat crashes
The list of fixes is quite long, and contains a security related
issue. Therefore I issue this vote to release Wicket 1.2.6 this
weekend (build will be done on sunday).
[ ] Release wicket 1.2.6 regardless if these four issues are resolved
[ ] Release wicket 1.2.6 but I'll make sure these get fixed
[ ] Don't release wicket 1.2.6 until these four issues are resolved
Wicket 1.2.6 will be released on our old SF.net hardware, and will not
be endorsed by the ASF, just as 1.2.4 and 1.2.5 were released.
This is a vote by majority, and lasts until sunday noon CET (for Euros: 12:00).
Martijn
ps. I hope I still remember how to build a 1.2 style release.
--
Learn Wicket at ApacheCon Europe: http://apachecon.com
Join the wicket community at irc.freenode.net: ##wicket
Wicket 1.2.5 will keep your server alive. Download Wicket now!
http://wicketframework.org
Re: [vote] Release Wicket 1.2.6
Posted by Igor Vaynberg <ig...@gmail.com>.
On 4/20/07, Jean-Baptiste Quenot <jb...@apache.org> wrote:
>
> Which one of these 4 issues is a security issue?
>
> And those issues are not "Fixed":
if you read carefully you will see that martijn was listing those as open
issues, not as the changelog.
-igor
Re: [vote] Release Wicket 1.2.6
Posted by Martijn Dashorst <ma...@gmail.com>.
On 4/20/07, Jean-Baptiste Quenot <jb...@apache.org> wrote:
> Which one of these 4 issues is a security issue?
That one is already fixed (WICKET-476).
Basically it is Wicket not cleaning up a thread local at the end of a
request under very rare circumstances, messing up wicket's
administration and *can* result in a page being displayed coming from
the history of another session (but doesn't necessarily have to).
Whether you will be experiencing this behavior depends on a number of factors:
* you have to trigger the non-cleaning up
* thread pool size
* type of requests
* activity of users
* session timeouts
* pagemap size
This is not remote exploitable: it isn't triggered by a particular
external stimulus, and you can't rely on the behavior (the thread pool
of the application server determines this).
The thread local clearing logic has been altered so that it *always*
is cleared at the end of the request.
In our system we were able to track the problem (though not find a
particular request or usecase to be the source of the troubles). Since
we applied this patch, we haven't seen the cross session pollination
happen any more (we're at 1.3-something).
Martijn
--
Learn Wicket at ApacheCon Europe: http://apachecon.com
Join the wicket community at irc.freenode.net: ##wicket
Wicket 1.2.5 will keep your server alive. Download Wicket now!
http://wicketframework.org
Re: [vote] Release Wicket 1.2.6
Posted by Johan Compagner <jc...@gmail.com>.
we can't do much about 438 at this moment.
none of them is a security issue.
johan
On 4/20/07, Jean-Baptiste Quenot <jb...@apache.org> wrote:
>
> * Martijn Dashorst:
>
> > Open issues:
> >
> > WICKET-268 NPE in ListView.renderItem(ListItem)
> > WICKET-349 ListView can't undo changes to model
> > WICKET-475 NPE in WebClientInfo when user-agent header is not sent
> > WICKET-438 File handles are leaked when loading images from a jar
> > file, Tomcat crashes
> >
> > The list of fixes is quite long, and contains a security related
> > issue. Therefore I issue this vote to release Wicket 1.2.6 this
> > weekend (build will be done on sunday).
>
> Which one of these 4 issues is a security issue?
>
> And those issues are not "Fixed":
>
> WICKET-268 is marked as Cannot Reproduce
> WICKET-438 is marked as Reopened
>
> > [x] Release wicket 1.2.6 regardless if these four issues are resolved
> > [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> > [ ] Don't release wicket 1.2.6 until these four issues are resolved
> --
> Jean-Baptiste Quenot
> aka John Banana Qwerty
> http://caraldi.com/jbq/
>
Re: [vote] Release Wicket 1.2.6
Posted by Jean-Baptiste Quenot <jb...@apache.org>.
* Martijn Dashorst:
> Open issues:
>
> WICKET-268 NPE in ListView.renderItem(ListItem)
> WICKET-349 ListView can't undo changes to model
> WICKET-475 NPE in WebClientInfo when user-agent header is not sent
> WICKET-438 File handles are leaked when loading images from a jar
> file, Tomcat crashes
>
> The list of fixes is quite long, and contains a security related
> issue. Therefore I issue this vote to release Wicket 1.2.6 this
> weekend (build will be done on sunday).
Which one of these 4 issues is a security issue?
And those issues are not "Fixed":
WICKET-268 is marked as Cannot Reproduce
WICKET-438 is marked as Reopened
> [x] Release wicket 1.2.6 regardless if these four issues are resolved
> [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> [ ] Don't release wicket 1.2.6 until these four issues are resolved
--
Jean-Baptiste Quenot
aka John Banana Qwerty
http://caraldi.com/jbq/
Re: [vote] Release Wicket 1.2.6
Posted by Frank Bille <fr...@gmail.com>.
On 4/20/07, Martijn Dashorst <ma...@gmail.com> wrote:
>
> [x] Release wicket 1.2.6 regardless if these four issues are resolved
>
Frank
Re: [vote] Release Wicket 1.2.6
Posted by Eelco Hillenius <ee...@gmail.com>.
[ x ] Release wicket 1.2.6 regardless if these four issues are resolved
[ ] Release wicket 1.2.6 but I'll make sure these get fixed
[ ] Don't release wicket 1.2.6 until these four issues are resolved
Eelco
Re: [vote] Release Wicket 1.2.6
Posted by Igor Vaynberg <ig...@gmail.com>.
[x] Release wicket 1.2.6 regardless if these four issues are resolved
-igor
On 4/19/07, Martijn Dashorst <ma...@gmail.com> wrote:
>
> This is a vote to release Wicket 1.2.6 this weekend.
>
> There are still some issues open, but I hope they can be solved either
> for we release, or we should just postpone them to 1.2.7
>
> Open issues:
>
> WICKET-268 NPE in ListView.renderItem(ListItem)
> WICKET-349 ListView can't undo changes to model
> WICKET-475 NPE in WebClientInfo when user-agent header is not sent
> WICKET-438 File handles are leaked when loading images from a jar
> file, Tomcat crashes
>
> The list of fixes is quite long, and contains a security related
> issue. Therefore I issue this vote to release Wicket 1.2.6 this
> weekend (build will be done on sunday).
>
> [ ] Release wicket 1.2.6 regardless if these four issues are resolved
> [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> [ ] Don't release wicket 1.2.6 until these four issues are resolved
>
> Wicket 1.2.6 will be released on our old SF.net hardware, and will not
> be endorsed by the ASF, just as 1.2.4 and 1.2.5 were released.
>
> This is a vote by majority, and lasts until sunday noon CET (for Euros:
> 12:00).
>
> Martijn
>
> ps. I hope I still remember how to build a 1.2 style release.
>
> --
> Learn Wicket at ApacheCon Europe: http://apachecon.com
> Join the wicket community at irc.freenode.net: ##wicket
> Wicket 1.2.5 will keep your server alive. Download Wicket now!
> http://wicketframework.org
>
Re: [vote] Release Wicket 1.2.6
Posted by Martijn Dashorst <ma...@gmail.com>.
+1 from me (always forget to vote on my own vote threads).
On 4/20/07, Martijn Dashorst <ma...@gmail.com> wrote:
> This is a vote to release Wicket 1.2.6 this weekend.
>
> There are still some issues open, but I hope they can be solved either
> for we release, or we should just postpone them to 1.2.7
>
> Open issues:
>
> WICKET-268 NPE in ListView.renderItem(ListItem)
> WICKET-349 ListView can't undo changes to model
> WICKET-475 NPE in WebClientInfo when user-agent header is not sent
> WICKET-438 File handles are leaked when loading images from a jar
> file, Tomcat crashes
>
> The list of fixes is quite long, and contains a security related
> issue. Therefore I issue this vote to release Wicket 1.2.6 this
> weekend (build will be done on sunday).
>
> [ ] Release wicket 1.2.6 regardless if these four issues are resolved
> [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> [ ] Don't release wicket 1.2.6 until these four issues are resolved
>
> Wicket 1.2.6 will be released on our old SF.net hardware, and will not
> be endorsed by the ASF, just as 1.2.4 and 1.2.5 were released.
>
> This is a vote by majority, and lasts until sunday noon CET (for Euros: 12:00).
>
> Martijn
>
> ps. I hope I still remember how to build a 1.2 style release.
>
> --
> Learn Wicket at ApacheCon Europe: http://apachecon.com
> Join the wicket community at irc.freenode.net: ##wicket
> Wicket 1.2.5 will keep your server alive. Download Wicket now!
> http://wicketframework.org
>
--
Learn Wicket at ApacheCon Europe: http://apachecon.com
Join the wicket community at irc.freenode.net: ##wicket
Wicket 1.2.5 will keep your server alive. Download Wicket now!
http://wicketframework.org
Re: [vote] Release Wicket 1.2.6
Posted by Igor Vaynberg <ig...@gmail.com>.
igor: 3
johan: 0
i left you one so you dont have to feel so bad
-igor
On 4/19/07, Johan Compagner <jc...@gmail.com> wrote:
>
> Release it but i think igor can fix them all first tonight.
>
>
> On 4/20/07, Martijn Dashorst <ma...@gmail.com> wrote:
> >
> > This is a vote to release Wicket 1.2.6 this weekend.
> >
> > There are still some issues open, but I hope they can be solved either
> > for we release, or we should just postpone them to 1.2.7
> >
> > Open issues:
> >
> > WICKET-268 NPE in ListView.renderItem(ListItem)
> > WICKET-349 ListView can't undo changes to model
> > WICKET-475 NPE in WebClientInfo when user-agent header is not sent
> > WICKET-438 File handles are leaked when loading images from a jar
> > file, Tomcat crashes
> >
> > The list of fixes is quite long, and contains a security related
> > issue. Therefore I issue this vote to release Wicket 1.2.6 this
> > weekend (build will be done on sunday).
> >
> > [ ] Release wicket 1.2.6 regardless if these four issues are resolved
> > [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> > [ ] Don't release wicket 1.2.6 until these four issues are resolved
> >
> > Wicket 1.2.6 will be released on our old SF.net hardware, and will not
> > be endorsed by the ASF, just as 1.2.4 and 1.2.5 were released.
> >
> > This is a vote by majority, and lasts until sunday noon CET (for Euros:
> > 12:00).
> >
> > Martijn
> >
> > ps. I hope I still remember how to build a 1.2 style release.
> >
> > --
> > Learn Wicket at ApacheCon Europe: http://apachecon.com
> > Join the wicket community at irc.freenode.net: ##wicket
> > Wicket 1.2.5 will keep your server alive. Download Wicket now!
> > http://wicketframework.org
> >
>
Re: [vote] Release Wicket 1.2.6
Posted by Johan Compagner <jc...@gmail.com>.
Release it but i think igor can fix them all first tonight.
On 4/20/07, Martijn Dashorst <ma...@gmail.com> wrote:
>
> This is a vote to release Wicket 1.2.6 this weekend.
>
> There are still some issues open, but I hope they can be solved either
> for we release, or we should just postpone them to 1.2.7
>
> Open issues:
>
> WICKET-268 NPE in ListView.renderItem(ListItem)
> WICKET-349 ListView can't undo changes to model
> WICKET-475 NPE in WebClientInfo when user-agent header is not sent
> WICKET-438 File handles are leaked when loading images from a jar
> file, Tomcat crashes
>
> The list of fixes is quite long, and contains a security related
> issue. Therefore I issue this vote to release Wicket 1.2.6 this
> weekend (build will be done on sunday).
>
> [ ] Release wicket 1.2.6 regardless if these four issues are resolved
> [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> [ ] Don't release wicket 1.2.6 until these four issues are resolved
>
> Wicket 1.2.6 will be released on our old SF.net hardware, and will not
> be endorsed by the ASF, just as 1.2.4 and 1.2.5 were released.
>
> This is a vote by majority, and lasts until sunday noon CET (for Euros:
> 12:00).
>
> Martijn
>
> ps. I hope I still remember how to build a 1.2 style release.
>
> --
> Learn Wicket at ApacheCon Europe: http://apachecon.com
> Join the wicket community at irc.freenode.net: ##wicket
> Wicket 1.2.5 will keep your server alive. Download Wicket now!
> http://wicketframework.org
>
Re: [vote] Release Wicket 1.2.6
Posted by Janne Hietamäki <ja...@apache.org>.
On 20.4.2007, at 1.52, Martijn Dashorst wrote:
>
> [x] Release wicket 1.2.6 regardless if these four issues are resolved
> [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> [ ] Don't release wicket 1.2.6 until these four issues are resolved
Re: [vote] Release Wicket 1.2.6
Posted by Martijn Dashorst <ma...@gmail.com>.
I counted 7 +1 binding votes and no objections.
I'll release this one today.
Martijn
On 4/20/07, Martijn Dashorst <ma...@gmail.com> wrote:
> This is a vote to release Wicket 1.2.6 this weekend.
>
> There are still some issues open, but I hope they can be solved either
> for we release, or we should just postpone them to 1.2.7
>
> Open issues:
>
> WICKET-268 NPE in ListView.renderItem(ListItem)
> WICKET-349 ListView can't undo changes to model
> WICKET-475 NPE in WebClientInfo when user-agent header is not sent
> WICKET-438 File handles are leaked when loading images from a jar
> file, Tomcat crashes
>
> The list of fixes is quite long, and contains a security related
> issue. Therefore I issue this vote to release Wicket 1.2.6 this
> weekend (build will be done on sunday).
>
> [ ] Release wicket 1.2.6 regardless if these four issues are resolved
> [ ] Release wicket 1.2.6 but I'll make sure these get fixed
> [ ] Don't release wicket 1.2.6 until these four issues are resolved
>
> Wicket 1.2.6 will be released on our old SF.net hardware, and will not
> be endorsed by the ASF, just as 1.2.4 and 1.2.5 were released.
>
> This is a vote by majority, and lasts until sunday noon CET (for Euros: 12:00).
>
> Martijn
>
> ps. I hope I still remember how to build a 1.2 style release.
>
> --
> Learn Wicket at ApacheCon Europe: http://apachecon.com
> Join the wicket community at irc.freenode.net: ##wicket
> Wicket 1.2.5 will keep your server alive. Download Wicket now!
> http://wicketframework.org
>
--
Learn Wicket at ApacheCon Europe: http://apachecon.com
Join the wicket community at irc.freenode.net: ##wicket
Wicket 1.2.5 will keep your server alive. Download Wicket now!
http://wicketframework.org