You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Filip Hanik - Dev <de...@hanik.com> on 2004/06/01 21:40:33 UTC
session facade not used for event
Quick question,
is there a reason the user code has access to the internal session instead of the session facade on session events?
>event = new HttpSessionBindingEvent(this,name,value); //inside StandardSession
as opposed to this code, which would give the user a facade?
event = new HttpSessionBindingEvent(new SessionFacade(this),name,value);
Filip
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
RE: session facade not used for event
Posted by "Filip Hanik (lists)" <de...@hanik.com>.
ok, I can do this tomorrow.
Filip
-----Original Message-----
From: Remy Maucherat [mailto:remm@apache.org]
Sent: Tuesday, June 01, 2004 5:09 PM
To: Tomcat Developers List
Subject: Re: session facade not used for event
Filip Hanik - Dev wrote:
>>>Facading is likely worthless for sessions,
>
> you think so, you don't think session.setPrincipal is a security issue?
Missed that one ;)
As Jean-François said, the security manager will avoid the problem. I
think it won't hurt replacing the "this"s with "getSession()"s in the
event constructors, though.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.692 / Virus Database: 453 - Release Date: 5/28/2004
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.692 / Virus Database: 453 - Release Date: 5/28/2004
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: session facade not used for event
Posted by Remy Maucherat <re...@apache.org>.
Filip Hanik - Dev wrote:
>>>Facading is likely worthless for sessions,
>
> you think so, you don't think session.setPrincipal is a security issue?
Missed that one ;)
As Jean-François said, the security manager will avoid the problem. I
think it won't hurt replacing the "this"s with "getSession()"s in the
event constructors, though.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: session facade not used for event
Posted by Jeanfrancois Arcand <jf...@apache.org>.
Filip Hanik - Dev wrote:
>>>Facading is likely worthless for sessions,
>>>
>>>
>
>you think so, you don't think session.setPrincipal is a security issue?
>
>
Try it by turning the Security Manager on ;-)
-- Jeanfrancois
>Filip
>
>----- Original Message -----
>From: "Remy Maucherat" <re...@apache.org>
>To: "Tomcat Developers List" <to...@jakarta.apache.org>
>Sent: Tuesday, June 01, 2004 3:02 PM
>Subject: Re: session facade not used for event
>
>
>
>
>>Filip Hanik - Dev wrote:
>>
>>
>>>Quick question, is there a reason the user code has access to the
>>>internal session instead of the session facade on session events?
>>>
>>>
>>>
>>>>event = new HttpSessionBindingEvent(this,name,value); //inside
>>>>StandardSession
>>>>
>>>>
>>>as opposed to this code, which would give the user a facade? event =
>>>new HttpSessionBindingEvent(new SessionFacade(this),name,value);
>>>
>>>
>>Yes, but no.
>>Facading is likely worthless for sessions, as we're (fortunately) not
>>recycling them anymore. The session manager will prevent accessing any
>>of the extra methods (and even then, I'm not sure there's any public
>>methods worth exploiting).
>>
>>Rémy
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>>
>>
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: session facade not used for event
Posted by Filip Hanik - Dev <de...@hanik.com>.
>> Facading is likely worthless for sessions,
you think so, you don't think session.setPrincipal is a security issue?
Filip
----- Original Message -----
From: "Remy Maucherat" <re...@apache.org>
To: "Tomcat Developers List" <to...@jakarta.apache.org>
Sent: Tuesday, June 01, 2004 3:02 PM
Subject: Re: session facade not used for event
> Filip Hanik - Dev wrote:
> > Quick question, is there a reason the user code has access to the
> > internal session instead of the session facade on session events?
> >
> >> event = new HttpSessionBindingEvent(this,name,value); //inside
> >> StandardSession
> >
> > as opposed to this code, which would give the user a facade? event =
> > new HttpSessionBindingEvent(new SessionFacade(this),name,value);
>
> Yes, but no.
> Facading is likely worthless for sessions, as we're (fortunately) not
> recycling them anymore. The session manager will prevent accessing any
> of the extra methods (and even then, I'm not sure there's any public
> methods worth exploiting).
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: session facade not used for event
Posted by Remy Maucherat <re...@apache.org>.
Filip Hanik - Dev wrote:
> Quick question, is there a reason the user code has access to the
> internal session instead of the session facade on session events?
>
>> event = new HttpSessionBindingEvent(this,name,value); //inside
>> StandardSession
>
> as opposed to this code, which would give the user a facade? event =
> new HttpSessionBindingEvent(new SessionFacade(this),name,value);
Yes, but no.
Facading is likely worthless for sessions, as we're (fortunately) not
recycling them anymore. The session manager will prevent accessing any
of the extra methods (and even then, I'm not sure there's any public
methods worth exploiting).
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org