We Keep Coding

JSF Performance Session Scope vs Requested Scoped - Permission

I would like to improve the performance of my JSF Web application.
Currently I stored a lot of permisson fields in the database as String.
I´m using a lot ot "rendered" in the JSF page to check if the user is allowed to see the link / datatable.
For each "rendered" I have a request to my JSF bean (this is RequestedScoped).
My question is:
Is it better to use instead of RequestedScoped a SessionScoped which holds the Permission object?
Currently:
<p:menuitem value="Test"
rendered="#{permissionCheckController.checkPermission(null, 'CREATE_COMMENT')}" />
checkPermission() includes round about 80 if conditions to check if the user is allowed to see/use the functionality and return true or false. In this example for "CREATE_COMMENT".
Is it better to use for example (and set the Bean to SessionScoped):
<p:menuitem value="Test"
rendered="#{permissionCheckController.myPermissionobject.createComment}" />
Thank you fr any feedback

Other Statergies to implemment <sql:query>

I have been using JSTL to fetch values from my database and display it in my jsp page using a similar code as shown below.
<sql:setDataSource
var="myDS"
driver="com.mysql.jdbc.Driver"
url="jdbc:mysql://localhost:3306/mydb"
user="root" password="secret"
/>
<sql:query var="list_users" dataSource="${myDS}">
SELECT * FROM users;
</sql:query>
<c:forEach var="user" items="${listUsers.rows}">
<c:out value="${user.name}" />
<c:out value="${user.email}" />
<c:out value="${user.profession}" />
</c:forEach>
My team leader advised me that it is not a good practice to put queries in the jsp page directly. Since there is a database name and username and password in this code I'm not sure if this code implements proper security. I would like to know your thoughts on the matter, and if there is any alternative to do this using JSTL itself.

Since JSTL is executed on server side, there's no security hole because the query cannot be seen by clients of the application. There are other problems with this approach:
The query is not reusable. If you need it in other pages, you will need to repeat the query. When you have simple queries like this one you cannot check the problem, but this arises with more complex statements that needs parameters as well.
You're creating a connection manually per page! This will slow your application. Use a proper datasource for a database connection pool configured as a resource or programatically (C3PO or BoneCP, for example)
Move all your database code into proper Data Access Layer classes. And use <sql> for JSTL for learning purposes only, not for real world applications.
More info:
How to use JSTL sql tag
Retrieve values from JDBC and use JSTL tags to call the methods
Should a database connection stay open all the time or only be opened when needed?

You should really do your query in your java class, not in the jsp, like your team leader advised.
On the security side it doesn't really matter, all the code is available on the server, jsp or java. The sql tag shouldn't output that information in the generated page.
But really the question is more about the right use of the technologies:
jsp is used as a template, it should take data and show them to the end user. Some basic operation can be done life looping on data list or formating data, but this should be only specific to the view you want to make
java controler is used to recuperate data and configure the view as needed like which jsp to use and which data to send in that jsp

How to set a bean property before uploading a file using rich:fileUpload?

My application has a modal panel where the user can upload files and choose a "document type" in a drop-down select.
I was using an <f:setPropertyActionListener> to set the document type value during the upload event, but sometimes the property is set after the upload has been processed. Probably it's happening because another request is being generated, and this request is handled by another web container thread.
<rich:modalPanel id="attachFiles" autosized="true">
<h:form id="formUpload" enctype="multipart/form-data">
<h:selectOneMenu id="docType" value="#{myMB.docType}" required="true" >
<f:selectItems value="#{myMB.docTypesSelectItems}" />
</h:selectOneMenu>`
<rich:fileUpload id="upload" fileUploadListener="#{myMB.handleUpload}">
<a4j:support event="onupload">
<f:setPropertyActionListener value="#{myMB.docType}"
target="#{myMB.docType}" />
</a4j:support>
</rich:fileUpload>
</rich:modalPanel>
When it happens, the value of myMB.docTypeis null during the execution of myMB.handleUpload, which is not expected, since the field is supposed to be required.
Is there a way to assure that the method myMB.handleUpload is executed only after the property of docType has been set?

I had a similar issue.
Change
<a4j:support event="onupload">
to
<a4j:support event="onclick">
The set document type action will be executed before upload file. Exactly when the explorer file system is opened

<f:setPropertyActionListener value="#{myMB.docType}" target="#{myMB.docType}" />
I don't get you. The target is the same as the value. You're basically setting the target's value with self. Isn't the value itself simply already null?
Anyway, I don't do RichFaces, so I can't go in detail, but I know that it's using Flash under the covers for the upload component and that such a construction usually fires a separate (and standalone) request which doesn't take all other HTML form parameters into account. The "normal" JSF inputs comes thereafter in a separate HTTP request. So you're kind of lost here without bringing in some nasty JS/ajax hacks. At least, in theory.
Your best bet is to get hold of the uploaded file as a bean propery in the listener method and then process that further in the normal bean's action method (the one attached to some UICommand component in the same form).

I would add Ajax capability to the select component instead. This way, the bean value is immediately updated each time the user changes the value of the select. Inside your file uploading method you can then rely on the bean value to represent the most recent selection the user has made.
You would only have to take care of the case, where the user starts the file upload without touching the select. Either you would need to have a sensible default value or you would have to take care of a non-selection and make the select field somehow required before uploading a file.

How to hide application context from urls?

I am using JSTL c:url tag to define my URL's in the application, something like:
<c:url value"/home" />
But the problem is that it appends the application context to the url, so the link becomes http://appName.come/appName/page while it should be http://appName.come/page.
The link had to be with slash, because it's not relative. I want to prevent the application context from being added or something like that, any ideas?

That's just the sole purpose of c:url: adding the context root and if necessary jsessionid whenever client doesn't support cookies. It also has support for URL-encoding the query parameters by c:param. If you don't want to have that, then just don't use c:url but use a plain HTML <a> element instead.
home
Update: as per the comment you seem to want to have the jsessionid in the URL (do you realize that the sessions are by default not shared between contexts and that you have to configure the serletcontainer accordingly?). In that case, manually set the context attribute.
<c:url context="/" value="/home" />

Passing customized messages from Servlet to a JSP page?

I am new to JSP and Servlets.
What i want to know is the best way to pass some customized message to client web pages.
For example suppose i have a web page say student.jsp which has a form,to register a new student to our online application.after successfully inserting all the fields of the form,
user submits the form and data is submitted to our servlet for further processing.Now,Servlet validates it and add it to our database.so,now servlet should send a message indicating a
successful insertion of data entered by end user to end user (In our case student.jsp).
So,i could i pass this type of message to any client web page.
I don't want to pass this message as URL query String.
is there ant other better and secure way to pass these type of messages ...

use request.setAttribute("message", yourMessage) and then forward (request.getRequestDispatcher("targetPage.jsp").forward()) to the result page.
Then you can read the message in the target page via JSTL (<c:out value="${message}" />) or via request.getAttribute(..) (this one is not preferable - scriptlets should be avoided in jsp)
If you really need response.sendRedirect(..), then you can place the message in the session, and remove it after it is retrieved. For that you might have a custom tag, so that your jsp code doesn't look too 'ugly'.

I think it looks like this in JSTL:
<c:remove var="message" scope="session" />
I also think that, if "message" is a Java String, it can be set to the empty string after it's been used like this:
<c:set var="message" scope="session" value="" />
Actually, it also looks like it works if "message" is an array of Java Strings: String[]...