seaside-dev March 2009

seaside-dev@lists.squeakfoundation.org

13 participants
31 discussions

hot to not use continuations
by Sebastian Sastre 09 Apr '09

09 Apr '09

hi there, I'm testing not to use continuations in an app. I've set: - Main Class: WAMain - Action Phase Continuation Class: WAActionPhaseContinuation interestingly, after setting that, the non stopping halt previously mentioned started to halt. Also I'm seeing in a filter (I've made for testing) this: handleFiltered: aRequestContext (super handleFiltered: aRequestContext) ifNotNilDo:[:response| self halt. ^ response]. it halts as expected but response has not aWAResponse, it has aFilter (itself). What I'm missing about not using continuations? thanks sebastian PD: that app is for testing. It's trivial: is just a component that renders a title. No tasks, no #call:

4 13

it wont halt
by Sebastian Sastre 06 Apr '09

06 Apr '09

hi there, if I make a filter implementing: handleFiltered: aRequestContext (super handleFiltered: aRequestContext) ifNotNilDo:[:response| self halt. ^ response]. can someone clarify why this won't halt? (s2.9a3 with flow) sebastian

3 3

[ANN] 369 SUFormElement fails to enable/disable (with fix)
by Sebastian Sastre 04 Apr '09

04 Apr '09

I've submitted a fix for it: http://code.google.com/p/seaside/issues/detail?id=369&can=4&colspec=ID%20Ty… Status%20Priority%20Version%20Platform%20Owner%20Summary%20Milestone sebastian

1 2

Enhancement to select tag
by Louis LaBrunda 30 Mar '09

30 Mar '09

Hi All, I have a need to have the values of options that are the list of a select tag be the same as the keys from a collection of associations and the labels to be the values of the associations. So both Smalltalk and javascript code can do work based upon the selected value. I only need the key of the selected item returned. And want it linked to the setter/getter of the component that generates the select tag. I have extended #WACollectionTag with: connectTo: aSelector of: anObject "Connect the instance variable represented by the selector symbol (setter/getter) of the object to the result of the selection." self name: (canvas callbacks registerCallback: (MessageSend receiver: anObject selector: aSelector asMutator)). to aid in this effort. I don't really like the name of the method (#connectTo:of:) but it works. I use the following code to render the select and option tags. Using the symbol of the getter/setter for both the default value and the result of the select. renderConnectToSelectOn: html for: anOrderedCollection to: aSymbol "Render a connectTo select for the collection on the canvas (html) connected to the symbol." | defaultSelectionValue | defaultSelectionValue := self perform: aSymbol. html select connectTo: aSymbol of: self; with: [ anOrderedCollection do: [:a | html option value: a key; label: a value; selected: (a key = defaultSelectionValue). ]. ]. Attached are fileouts of the extension to #WACollectionTag and a sample component that demonstrates its use. My thanks to Lukas for putting me on this track. I would like to submit my extension to #WACollectionTag, (maybe with a better method name) to aid others to use the select tag in the same way. I am confused as to why Seaside needs to generate the names/values for the option tags of a select tag. I can see that the name for the select tag needs to be controlled by Seaside like other inputs. Lukas explained that Seaside needed to generate the names/values for the option tag: "Seaside takes care of the value attribute of option tags, similar as it does with all other names on a page. This is to ensure uniqueness, even if different components or multiple instances of the same component are displayed at once." I am a NOOB to both Seaside and HTML, and I have great respect for all the developers of Seaside, so I will take his word for it. As there is only one value returned for the select (not counting multi-selects) and linked to one set of a getter/setter and the values of all the options are not returned, and are not linked to any getter/setters, why does Seaside need to control their values in the way it controls other input field names? Respectively, maybe someone who know a lot more than me can revisit the choice of Seaside generating the option values/names for a select. If there really isn't a need for Seaside to generate the option values instead of using the keys from associations, the rendering of the select tag and its use by developers could be simplified. Thanks you for your time and thoughts and if I am way off on this, please set me straight. Lou ----------------------------------------------------------- Louis LaBrunda Keystone Software Corp. SkypeMe callto://PhotonDemon mailto:Lou@Keystone-Software.com http://www.Keystone-Software.com

2 3

Re: JQueryInstance>>id
by Lukas Renggli 30 Mar '09

30 Mar '09

> The "id" of a JQueryInstance object is stored as first element > in its arguments collection (see JQueryInstance>>id: method) > and by default there is no accessor to retrieve the original > id again. As you can see in the jQuery documentation (http://docs.jquery.com/Core) there are 4 distinct cases of what can be stored in the arguments collection of the JQueryInstance object: a CSS selector (String), a HTML string (String), a array of elements (Array or JQueryInstance) or a function (Object). I think that it is not appropriate to add an #id read accessor as in most cases it will be impossible to get it back, unless you exactly know what and how you set it in your particular context. Cheers, Lukas PS: Could you please post such requests to seaside-dev(a)lists.squeakfoundation.org, so that it can be discussed with the community? -- Lukas Renggli http://www.lukas-renggli.ch

1 0

Using seaside.builder.st right from your image
by Torsten Bergmann 25 Mar '09

25 Mar '09

Thanks to Lukas there is a new feature in the builder.seaside.st allowing you to directly load a builder configuration within the image itself. (see conversation below). Using the three URL parameters (distribution, packages and download) you can now write: (HTTPSocket httpGet: 'http://builder.seaside.st/?distribution=Seaside%202.9.0-alpha3&packages=all…') fileIn to load Seaside29alpha3 package right from the (pharo) image. Tip: If you need a different configuration, use builder.seaside.st and have a look at the comment in the generated load script. At the beginning you will find the specific URL with all your packages. That should make loading Seaside even easier and help to automate loading/integration tests. Keep on talking small Torsten -------- Original-Nachricht -------- Datum: Tue, 24 Mar 2009 17:08:46 +0100 Von: Lukas Renggli <YYY(a)ZZZ.com> An: Torsten Bergmann <YYY(a)ZZZ.de> Betreff: Re: Seaside Builder Installer script I've added two new features: - The parameter 'download' directly downloads the chosen definition. The value of the parameter is the label on the download link in the UI, including whitespace. Example: ?download=Load%20Script - The parameter 'package' also allows the value 'all' to automatically select all available packages. The latest deployment is based on Seaside 2.9a3 and noticeably faster (mainly because of the new JQuery libraries). Lukas On Tue, Mar 24, 2009 at 4:26 PM, Torsten Bergmann <YYY(a)ZZZ.de> wrote: > Very helpful, thanks! > > Bye > Torsten > > -------- Original-Nachricht -------- >> Datum: Tue, 24 Mar 2009 15:20:33 +0100 >> Von: Lukas Renggli <YYY(a)ZZZ.com> >> An: Torsten Bergmann <YYY(a)ZZZ.de> >> Betreff: Re: Seaside Builder Installer script > >> > But is it also possible to get the script using this parameter >> > convention? If so this would be helpful to directly >> > load a specific configuration right from the image: >> > >> > something in the like of: >> > >> > (HTTPDocument getURL: >> "http://builder.seaside.st/?distribution=allmyselectedSS29Packages?script=lo…) fileIn >> >> Yes, that would be easy to add. >> >> I need to do a new deployment on based on Seaside 2.9a3 anyway (it is >> still running on Seaside 2.9a2). I will add that ASAP. >> >> Lukas >> >> -- >> Lukas Renggli >> http://www.lukas-renggli.ch > > -- > Aufgepasst: Sind Ihre Daten beim Online-Banking auch optimal geschützt? > Jetzt absichern: https://homebanking.gmx.net/?mc=mail@footer.hb > -- Lukas Renggli http://www.lukas-renggli.ch -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger01

1 0

Session Cookie Security
by Boris Popov 24 Mar '09

24 Mar '09

Hey, Our auditors had recently completed comprehensive penetration testing of our Seaside-based applications and one of the medium-priority recommendations they had was to flag session cookies with 'HTTPOnly' and 'Secure' (latter only applies to secure sites, i.e. #serverProtocol = #https). To be honest, I haven't had a chance to make a patch on 2.8 yet, simply because we don't use cookies for session tracking in production right now, but I figured someone here might be interested enough to pick this up anyway. http://www.owasp.org/index.php/HTTPOnly http://www.owasp.org/index.php/OWASP_AppSec_FAQ#What_are_these_secure_co okies.3F There's plenty more on Google about these two. Cheers! -Boris -- +1.604.689.0322 DeepCove Labs Ltd. 4th floor 595 Howe Street Vancouver, Canada V6C 2T5 http://tinyurl.com/r7uw4 boris(a)deepcovelabs.com CONFIDENTIALITY NOTICE This email is intended only for the persons named in the message header. Unless otherwise indicated, it contains information that is private and confidential. If you have received it in error, please notify the sender and delete the entire message including any attachments. Thank you.

2 5

2.9a3 encoding broken?
by Sebastian Sastre 23 Mar '09

23 Mar '09

hi there, is the encoding broken for 2.9a3? I've migrated and found problems about diacritics. After seeing that I've went to the WAEncodingFunctionalTest. It works for the heading but does not for the text. When uses #renderCharacterByCharacter: diacritics are broken I'm missing something? sebastian

3 5

RE: Rekeying Sessions
by Boris Popov 20 Mar '09

20 Mar '09

It looks like the following is needed when using cookies, rekey self application changeKeyForHandler: self. self useSessionCookie ifTrue: [self redirectWithCookie: self sessionCookie]. -Boris -- +1.604.689.0322 DeepCove Labs Ltd. 4th floor 595 Howe Street Vancouver, Canada V6C 2T5 http://tinyurl.com/r7uw4 boris(a)deepcovelabs.com CONFIDENTIALITY NOTICE This email is intended only for the persons named in the message header. Unless otherwise indicated, it contains information that is private and confidential. If you have received it in error, please notify the sender and delete the entire message including any attachments. Thank you. -----Original Message----- From: Boris Popov Sent: Tuesday, March 17, 2009 3:18 PM To: 'seaside-dev(a)lists.squeakfoundation.org' Subject: Rekeying Sessions Hey, Our auditors had recently completed comprehensive penetration testing of our Seaside-based applications and one of the medium-priority recommendations they had was to issue different session id after login (see attached comments). It later became "low priority" when we demonstrated that attacker's source IP needed to match because we used session protector. Here's a snippet for 2.8 that appears to do the trick (not very well tested yet), but I thought this might be worth including in base for 2.9? WASession>>rekey self application changeKeyForHandler: self. WARegistry>>changeKeyForHandler: anObject self mutex critical: [(keysByHandler at: anObject ifAbsent: [nil]) ifNotNil: [:key | keysByHandler removeKey: anObject. handlersByKey removeKey: key]]. ^self ensureKeyForHandler: anObject. This all comes together in a task, LoginTask>>go login := Login new. [self login] whileFalse. self session rekey. self call: menu. Hope this helps, -Boris -- +1.604.689.0322 DeepCove Labs Ltd. 4th floor 595 Howe Street Vancouver, Canada V6C 2T5 http://tinyurl.com/r7uw4 boris(a)deepcovelabs.com CONFIDENTIALITY NOTICE This email is intended only for the persons named in the message header. Unless otherwise indicated, it contains information that is private and confidential. If you have received it in error, please notify the sender and delete the entire message including any attachments. Thank you.

6 18

tasks aren't receiving #initialRequest: ?
by Sebastian Sastre 19 Mar '09

19 Mar '09

hi there, well is basically that. I'm not seeing tasks to be receiving #initialRequests in 2.9a3 is that expected? sebastian

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

seaside-dev March 2009