prevent crossjumping in struts web application - java

How can I prevent a user from neglecting the normal work flow of a struts application? For example, I have a list of products. This products have options like view edit whatever. If you click on edit, you will be redirected to a page like /editProductInfo.do and there will be no problem if you go there from List and then click edit a bean will be created with the information of the requested product from database.
Now if you are not logged in and try to access this page /editProductInfo.do you will be asked to log in and if you do so there will be a NullPointerException because the Bean that is needed to fill the form of this /editProductInfo.do is not initialized or even created because the application does not even know which product was requested.
So I want to prevent Users from crossjumping from side to side which has no link to each other. Is this possible in Struts?
Thanks for advice :)

Ah you mention struts 1 :) We successfully used the Struts Workflow Extension for exactly that case. http://www.livinglogic.de/Struts/ It lets you define page flows and lets you react if users atempt to break these flows by reloading, entering URLs, using invalid bookmarks...

Encode the product in the URI; that way you beat both your problem and the problem of two open tabs/windows on different products...

Related

How can i get page URL in single-approver-definition.xml in Kaleo workflow in Liferay?

How can i get the page URL in single-approver-definition.xml in the e-mail template that is used to send an e-mail to the content creator once the reviewer approves or rejects the submission. The existing xml is as follows:
<template>
Your submission has been reviewed and the reviewer has applied the following:
${taskComments}.
</template>
I tried ${serviceContext.getAttribute("contentURL")} and it didn't work.
I want to be able to do - Your submission for ${pageURL} has been reviewed and the reviewier has applied the following: \n ${taskComments}.\n
Any suggestions will be appreciated.
I don't get what variable exactly you want to process in your notification. As I can only assume, you are using it for Web Contents and all interesting variables are stored in two places.
Workflow context variables - they are available directly. Few examples like:
${taskComments}
${entryType}
${userId}
${userName}
...
ServiceContext variables - they are available using $serviceContext. Few examples:
$serviceContext.getAttributes().get("version")
$serviceContext.getAttributes().get("articleId")
${serviceContext.getPortalURL()}
...
For all interesting variables check this url https://www.liferay.com/web/igor.beslic/blog/-/blogs/workflow-in-action-kaleo-workflow-context-variables Some could change already, however most of them is working fine for current version.
Content changes might be made on a page, they can also be triggered through Control Panel (or the API for that matter). When you're in a workflow, you typically don't have this context any more - if you find it somehow I'd not rely on it to be there. A workflow is unrelated to the UI and pages.
Also, an article might be submitted on one page, where it might be replaced/removed before it's even approved. In that case the link wouldn't help.
What might work is to check the concept behind "Web Content Display Pages" (if your article has them configured and you deal with web content). But the mechanics will vary depending on the actual content type you're dealing with. And content that goes through workflow might not be displayed on any page at all (e.g. when submitted through Control Panel) or on many different pages (either explicitly - Web Content Display - or implicitly - Asset Publisher).
#tomic basically provides pointers to what you have, I'm only reasoning why your initial problem is problematic to solve at best - it's not fully specifiable.

Keep object througe pages

I'm working on a web project. The flow is like this
User inputs the parameters
Call to servlet is made (post method)
The servlet loads a large file (300.000 lines , one word per line) in a tree object. Does some calculations.
Redirects to a new page for the results.
My question is this. The user may do this operation more than once. The loading
of the file to the tree object is taking too long. How can I do this, only once?
I've thought to have just one servlet (or jsp) and not redirecting to different pages, but
manipulating the view with javascript. This way I think that I will manage to load the file only once (and whenever the user refreshes). Do you have any suggestions?
EDIT 1. This object is created by a class that is called from the servlet. I'm using apache tomcat 7 and java 1.6 . HTML5 is an option too (someone mentioned the history api).
Is the file specific to the user ? Keep the object in the user's session.
If its common to many users and they only need to read/ view this data keep it in the application object.
If your talking about the view -> browser then yes the way to do is ajax and/or frames and/or iframes
Advantage with frames is you can keep the data in another farme and still access it from other pages, but change the main view area to another page completely
Detail
user's session : available in servlets, filters, jsps etc -> key Object pair. can have any number of keys and objects but remember its all in the RAM, until session expires or if it is explicitly destroyed.
http://docs.oracle.com/cd/E19502-01/819-3669/bnaij/index.html
How to use the "application" object in a Servlet?
Application level http://docs.oracle.com/javaee/5/api/index.html?javax/servlet/jsp/PageContext.html get and setAttribute(String name, Object object)
This object can be read in all pages and jsps. Need to take care if object is already there (getAttribute does not return null) before you do the task of initializing it. Does the main file change? IF so can keep some code that calls a jsps that refreshes it. (like an admin jsp)
Frames/ ajax is for client level and you need to ask a more specific question for this but stack over flow and google have many examples of using this.
You can use ajax for that + html5 history api. So when navigating you will not reload page, but with history api, you will have same visual effect

Spring MVC 3.0 - multiple forms or one?

I'm building a page that has a search box that will populate a grid on the same page. There is also a button the user can select to bring up a "window" (JQuery UI "pop-up" in the same page) that lets the user configure said grid.
These are two separate forms but I don't want what was submitted as part of one to undo the other (so when the user submits to change the grid layout the search needs to re-run as well.
I'd rather not store things in session for this since that brings with it its own issues (search results may be large, shouldn't be saved when the page is re-entered later, etc.).
I've considered doing "one large form" (i.e. surrounding all the inputs) for the entire page that is backed by a form backing bean. I would then use which button is clicked to determine the action to take. There will eventually be other buttons on the page as well to add more functionality. This would be similar to how .NET (non-MVC) handles things.
I'm interested in how others may have solved similar challenges. Are there potential issues with my approach that I'm not seeing? Better ways that work with the framework?
What do you mean with:
but I don't want what was submitted as part of one to undo the other
. Are you referring to posting the form and loading the whole page, which in turn will "reset" the other form?
If that is the case I would still keep one page with two forms and make the posts using Ajax (as you may know jQuery makes this a breeze). Upon receiving a response for either call you will need to update the other form accordingly.
Note that you may still have your forms in two separate views if it helps keeping the code clean and then pull their html with Ajax calls into another view. But my point is that at the end I would still keep both in one page since it sounds like they depend on each other so updating one when the other changes may be easier this way,
Let me know if I misunderstood your question.

Multipage environment in GWT

I have been developing an AJAX web application using GWT. I've read several blogs and forums about this question and left with no clear idea. I understand that GWT is an AJAX application, that supports only stand-alone web application. By stand-alone, I meant GWT to be a single web page that would suffice the user requirements. However the use case I have is pretty complex and I'm stuck in this use case that doesn't let me proceed.
My usecase(s) goes like this:
Usecase #1: There is an order entry form where user will enter a search string to search for a particular item. With GWT, I could display the result in a table (say celltable). However, when I click a column in the cellTable, I want the value of the column to be sent to the server and display another page that will display only the details of the selected column. I'm not sure how to accomplish this.
Usecase #2: Let's say the web application I develop is called "InventoryControl" and I have different requirements such as:
display Available stock
display Order stock
display Manufactured unit
and Using Java servlets, I could just type http://localhost/availableStock?stockId=1234 on my browser to get the "Display available stock" for the given stockId and then http://localhost:orderStock?stockId=1234 to get the "display order stock" and similarly "display manufactured unit". Is the same possible using GWT? i.e. when I type http://localhost/availableStock?stockId=1234, is it possible to read the parameter being passed and then display the corresponding page?
If these are not meant to be guaranteed by GWT, should I stick with Plain old JAVA servlets/JSP?
Thanks in advance.
Ashok - Please note, what filip suggests above does not require multiple "pages" in the sense of additional html host pages. You can build a panel holding your display of the details, and swap it into the rootpanel of your host in the onSuccess() of your rpc call. The GWT history mechanism allows you to assign anchors to these "places" and provide a mechanism to map these anchors to specific display classes in your code.
GWT already has a mechanism for handling multiple page applications. Have a look at Activities and Places. You can define each page as a place in your application, and use the GWT mechanism to go from place to place at any time. Using places also allows you to easily add tokens/query parameters to each "page", in an OO manner, without having to worry about populating/querying the URL directly. Have a good read of the link!

Managing webapp session data/controller flow for multiple tabs

I have a Java web application which stores some data in the session. The data in the session changes as the user interacts with the application (e.g. flow is managed by a controller, each controller has several form pages, on each form page some data is updated in the session and flow goes to the next form page).
The problem is that some users are opening more than one tab to the application, each tab with a different step in the flow. At this point data in the session is messed up since the tabs share the same session (app uses cookie managed sessions).
Telling the users to use different browsers to avoid sharing the same session id (e.g. one Firefox window and one IE window) is not an option since surely at some point somebody will forget to do this and instead use tabs, thus messing up their data.
Adding some verifications that detect that another flow is requested from another tab and display a message to the user saying this is not allowed is not an option either since it pisses of the users and we don't want that do we? :D
The fact is that using another tab is useful for the users because they are more efficient in what they use the application for, so I am keeping this option. But the question now is how best to manage the one session data for the more tabs?
What I thought of, was to have the controller generate a token when it starts the flow and pass this token to each form page which in turn sends it back to identify itself. If another tab requests the same controller action when there is an ongoing flow then generate another token and pass that around.
Basically, I want each flow to have a token and inside the session I won't just keep one set of data but have a set of data for each token and then match requests based on the token.
Now the problem is that this approach will need a lot of rewritings to the application and I was wondering if there is a best practice for managing such a situation or can someone suggest other approaches. I am open to ideas.
Have you encountered this situation? How did you handle it?
This is usually done by assigning a windowId for each tab/window and passing it on each request. Jsf supports this via orchestra. Spring mvc will support it in the next version.
I recently needed this for a simple case, so I implemented it myself. Took half an hour. However, my scope was very limited:
pass a windowId with each request, and return it back for the next request. The first time - generate it.
for any attribute you want to store in the session, put a Map<String, Object> where the key is the windowId
This is exactly what Seam was created to handle. In Seam there's a concept called a Conversation which basically does exactly what you are explaining. Conversations are basically are a way to divide the Session into many pieces that can expire at some timeout. You can look at the source code for org.jboss.seam.core.Manager class to see how it's actually implemented and get inspired ;)
Depending on the complexity of your application, you may want to investigate implementing tabs within your application. This gives you wholesale control over the flow, while still providing users with the functionality they want. I'd argue it's, bugwise, the most robust solution, since you won't have a dependency on the way the browser handles sessions, minimising the number of "known unknowns".
Of course, there'll be potentially a large upfront cost to this, depending on how your application is structured. Without more information about your app, you're the best placed person to decide.
You can also try to wrap your application inside Adobe Air
And then limit your web application to be only accessable from this air. By doing this you dont need to consider the web browser fragmentation and their unique behaviour.

Categories