jsf-2.2

What are jftfdi jffi doing to my query string?

天大地大妈咪最大 提交于 2019-11-30 19:54:59
We are using JavaServer Faces 2.2 (Mojarra 2.2.1) in our project. I noticed something odd. On a page called reporting.xhtml where I use f:metadata with the new f:viewAction my browser, Safari in this case, shows the following query string: reporting.jsf?jftfdi=&jffi=reporting%3Ffaces-redirect%3Dtrue What wizardry is this? What are the parameters jftfdi and jiffi doing? What is their purpose? It's part of the new JSF 2.2 feature as described by spec issue 949 . Basically, it enables JSF to identify the client window. It's basically the same as cid in CDI's @ConversationScoped and windowId in

PrimeFaces nested form inside p:dialog with appendTo=\"@(body)

偶尔善良 提交于 2019-11-30 19:47:15
I have this fragment: <h:form id="form"> <!-- other content --> <p:panel id="panel" header="test"> <p:inputText id="input1" value="#{viewScope.prop1}" required="true" /> <p:commandButton id="button1" process="@form" update="@form @widgetVar(dialog)" oncomplete="PF('dialog').show()" value="ok" /> </p:panel> <!-- other content --> </h:form> <p:dialog id="dialog" header="dialog" widgetVar="dialog" modal="true"> <h:form id="form2"> <p:inputText id="input2" value="#{viewScope.prop1}" required="true" /> <p:commandButton id="button2" process="@form" update="@form" value="ok" /> </h:form> </p:dialog>

Invoking a JavaScript function from oncomplete handler of p:remoteCommand - simulating the same using some JavaScript code

半城伤御伤魂 提交于 2019-11-30 19:11:35
Caution : Although this question covers long textual information with a mess of Java code snippets, it is merely targeted to JavaScript/jQuery and a bit of PrimeFaces stuff (just <p:remoteCommand> ) as mentioned in the introductory part in the beginning. I am receiving a JSON message from WebSockets (Java EE 7 / JSR 356 WebSocket API) as follows. if (window.WebSocket) { var ws = new WebSocket("wss://localhost:8181/ContextPath/AdminPush"); ws.onmessage = function (event) { jsonMsg=event.data; var json = JSON.parse(jsonMsg); var msg=json["jsonMessage"]; if (window[msg]) { window[msg](); //It is

Prevent CSRF in JSF2 with client side state saving

纵饮孤独 提交于 2019-11-30 17:41:35
问题 I'm Using MyFaces 2.2.3 with client side state saving + PrimeFaces After asking how to prevent the re-use of a ViewState in different sessions I was told by BalusC , that I can inject my own CSRF token by override the from renderer to let the value be a CSRF token , I'm looking for a solution that wont force me to modify my xhtml pages at all :) BalusC has suggested a better way to prevent CSRF attack by extending ViewHandlerWrapper , and it works great, I only had to modify a bit the

Implications of saving session on the client with javax.faces.STATE_SAVING_METHOD

三世轮回 提交于 2019-11-30 16:17:23
My first JSF page was throwing javax.faces.application.ViewExpiredException . while I searched I got this solution which solved my problem. <context-param> <param-name>javax.faces.STATE_SAVING_METHOD</param-name> <param-value>client</param-value> </context-param> But I am concerned about the security implication. BalusC This doesn't save the "session" in client side at all. This only saves the JSF view state in client side. This is in JSF 2.2 always AES-encrypted with a key which is generated on application startup. This however invalidates once you restart the application, hereby causing all

Conditional rendering of f:param in JSF

给你一囗甜甜゛ 提交于 2019-11-30 13:08:02
I'm using an <h:outputLink> as follows. <c:set var="cid" value="1"/> <c:set var="sid" value="2"/> <h:outputLink value="Test.jsf"> <h:outputText value="Link"/> <f:param name="cid" value="#{cid}"/> <f:param name="sid" value="#{sid}"/> </h:outputLink> This is just an example. Both of the query-string parameters are dynamic. So, <c:set> used here is just for the sake of demonstration. At any time, either one, both or none of the parameters may be present. In case, if only one or none of them is present then, parameter/s are unnecessarily appended to the URL which should not happen. Preventing

JavaScript/jQuery event listeners do not work after JSF component is updated via Ajax

旧街凉风 提交于 2019-11-30 09:20:12
I'm executing the following jQuery function on <p:dataTable> filter (whose id is id ) that allows users to enter only digits in the filter component. $(document).ready(function() { $("#form\\:dataTable\\:id\\:filter").keydown(function(event) { //Allow: tab, escape, and enter if(event.keyCode===9||event.keyCode===27||event.keyCode===13|| //Allow: Ctrl+A, Ctrl+C (event.keyCode===65&&event.ctrlKey===true)||(event.keyCode===67&&event.ctrlKey===true)|| //Allow: home, end, left, right (event.keyCode>=35&&event.keyCode<=39)){ //let it happen, don't do anything event.preventCapture(); return; }/

The metadata component needs to be nested within a f:metadata tag. Suggestion: enclose the necessary components within <f:metadata>

柔情痞子 提交于 2019-11-30 05:58:02
问题 I went through different sources like: Error saying I need to use f:metadata even though I do http://docs.oracle.com/javaee/7/javaserverfaces/2.2/vdldocs/facelets/f/metadata.html and it seems to be issue has been fixed in jsf 2.2.1, where as When I tried to use, I am facing issue, below are my configurations: template.xhtml: <!DOCTYPE html> <html lang="#{languageBean.language}" xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core" xmlns:h="http://xmlns.jcp.org/jsf/html"

Reusing ViewState value in other session (CSRF)

北慕城南 提交于 2019-11-30 05:31:05
问题 I'm using a *myfaces-api-2.2.3 with javax.faces.STATE_SAVING_METHOD set to client , I got the following scenario, 1) User X logs into the system and adds user XXX (using jsf f:ajax action) , while inspecting the chrome dev tools you can see the form that being submitted along with the ViewState value. 2) Copy that ViewState value (from chrome dev tools --> network tab) --> place it into html file with form (that mimics my original add user X ) 3) Logout from user X session (session being

What are jftfdi jffi doing to my query string?

天涯浪子 提交于 2019-11-30 04:19:03
问题 We are using JavaServer Faces 2.2 (Mojarra 2.2.1) in our project. I noticed something odd. On a page called reporting.xhtml where I use f:metadata with the new f:viewAction my browser, Safari in this case, shows the following query string: reporting.jsf?jftfdi=&jffi=reporting%3Ffaces-redirect%3Dtrue What wizardry is this? What are the parameters jftfdi and jiffi doing? What is their purpose? 回答1: It's part of the new JSF 2.2 feature as described by spec issue 949. Basically, it enables JSF to