Struts 2.3 Upgrading Issue
版本升级原因:struts2.0漏洞
http://struts.apache.org/download.cgi#struts221
http://struts.apache.org/release/2.3.x/docs/s2-014.html
升级方法和问题:
https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=30743764
http://bbs.csdn.net/topics/390598510
http://stackoverflow.com/questions/11543959/struts-2-3-upgrading-ognl-issue
Step 1 - 更新Struts 2的jar文件到Class Path
【Struts2.0的jar依赖包】
asm.jar
commons-fileupload-1.2.1.jar
commons-io-1.3.2.jar
freemarker-2.3.8.jar
ognl-2.6.11.jar
struts2-core-2.0.14.jar
xwork-2.0.7.jar
commons-lang-2.5.jar(保留)
【Struts2.3的jar依赖包】
工具:maven、jar_search等
我们添加Struts 2最小需求的jar包。我们将把这些jar包拷贝到WEB-INF\lib这个文件夹中。
找到并拷贝这些文件
asm-3.3.jar
asm-commons-3.3.jar
asm-tree-3.3.jar
commons-fileupload-1.3.1.jar
commons-io-2.2.jar
commons-lang3-3.1.jar
freemarker-2.3.19.jar
ognl-3.0.6.jar
struts2-core-2.3.16.3.jar
xwork-core-2.3.16.3.jar
Step 2 - 更新Struts 2 Servlet Filter
【truts2.0的servlet过滤器】
<filter>
<filter-name>struts2</filter-name>
<filter-class>org.apache.struts2.dispatcher.FilterDispatcher</filter-class>
</filter>
<filter-mapping>
<filter-name>struts2</filter-name>
<url-pattern>*.action</url-pattern>
<url-pattern>*.jsp</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
【struts2.3的servlet过滤器】
为了要Struts 2 框架在你的web应用中工作,你需要在web.xml文件中添加Servlet Filter类和Filter mappingr。下面是你要添加的内容。
<filter>
<filter-name>struts2</filter-name>
<filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>struts2</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Step 3 - 创建struts.xml文件
【打开DMI】
2.3+默认DMI是关闭的,动态方法调用官方推荐的做法是,使用通配符的形式,因可能存在安全隐患:
<constant name="struts.enable.DynamicMethodInvocation" value="true" />
否则总是跳转到default action execute中或报错:TTP Status 404 - There is no Action mapped for namespace [/] and action name [login!login.action] associated with context path [/]
Step 4 - 关闭开发模式
struts.xml :
<constant name="struts.devMode" value="false" />
否则表单提交时action中没有bean的set方法就会报错如:
http://localhost/login!login.action?test=2
Error setting expression 'test' with value ['2', ]
或者给每个提交的properties在action中添加bean和get/set方法。
Step 5 - 提高log4j级别
log4j.properties :
#The problem is that the page including the inventory search has several other fields
#which are not related to the inventory search (and do not have a getter/settter
#in the inventorySearch action). Under Struts 2.0, these extra fields are ignored
#by the inventorySearch action. However, Struts 2.3 throws the above exception
#when these extra fields are posted with the form.
log4j.logger.com.opensymphony.xwork2=ERROR
否则报类似错误:
[STDOUT] WARN [com.opensymphony.xwork2.ognl.OgnlValueStack] - CommonsLogger.warn(60) | Error setting expression 'nonInventoryRelatedField' with value '[Ljava.lang.String;@833d35'
ognl.OgnlException: target is null for setProperty(null, "9", [Ljava.lang.String;@833d35)
Step 6 - Spring代理调度job时I18N资源文件无法取到值
系统管理>任务管理 通过页面按钮action手动启动调度job是可以取到资源文件的内容的,可以正常跑该任务。
但spring代理调度该job时无法取得properties的资源文件,struts2.3出现此问题,struts2.0的版本没问题。
BagProcessJob.java L55
String job_cd = this.baseAction.getRes("job.cd.bag") ;
BaseAction.java:524
return ResourceBundle.getBundle(APP, this.getLocale()).getString(key);
Locale com.opensymphony.xwork2.ActionSupport.getLocale() = null
解决方案:
/**
* 重写方法:取得I18N国际化资源文件用Locale对象。
* 【原因】通过页面按钮action手动启动调度job是可以取到资源文件的内容的,可以正常跑该任务。
* 但spring代理调度该job时无法取得properties的资源文件,struts2.3出现此问题,struts2.0的版本没问题。
* com.opensymphony.xwork2.ActionSupport.getLocale() = null
* 【方式】手动创建中文 Locale,Action上下文生效时替换真实browser的locale
*
* add by jeffen@pactera at 20140718
* @return
*/
public Locale getLocale(){
Locale l = new Locale("zh_CN", "CN");
ActionContext ctx = ActionContext.getContext();
if (ctx != null && ctx.getLocale() != null) {
l = ctx.getLocale();
}
return l;
}
Step 7 - s:debug标签无效需要Jetty容器支持
Struts2.3.16 s:debug新特性:<s:debug/> tag was improved and now works properly under Jetty, see WW-4223
http://www.kankanews.com/ICkengine/archives/89289.shtml
否则报错,org.apache.jasper.JasperException: An exception occurred processing JSP
ognl/ObjectPropertyAccessor.java
ognl.NoSuchPropertyException:
分享到:
相关推荐
Oracle 安装升级迁移Different Upgrade Methods For Upgrading Your Database(11.2)官方英文版
Oracle 安装升级迁移Different Upgrade Methods For Upgrading Your Database(11.1)官方英文版
Upgrading to DB2 Version 9.7
Upgrading and Repairing Servers Pages: 1128
完全的PC升级与维护手册,保持在PC界解决重大问题的权威地位。用简明易懂的语言向读者阐明怎样防止计算机故障和修理出现的故障,说明怎样最大限度地发挥用户计算机的功能和延长它的使用寿命。根据本书作者Mark ...
有关此新版本中主要更改的简短指南,包括经过改进的引擎(Zend Engine 3),一系列新功能以及大量的语言清除。 您将了解基本的语言更改,不推荐使用的功能,Unicode增强等。
mp3固件升级工具(Mp3player Firmware Upgrading Tool)中文绿色版
Upgrading Oracle Applications
This book is the world famous work about upgrading and repairing PCs and laptops.
官方资料:[英文]白皮书:Upgrading to Oracle Database 12c (12.1.0.2)升级到ORACLE12c (12.1.0.2) Comparing Upgrade and Migration;Database Upgrade;Database Migration.;Multitenant Architecture;...
1. Download and install the Xamarin Installer 2.0 from the Official Website. 2. Download and Run MFxPatcher. 3. Click Patch. ENJOY! If you like the software, buy it! PREREQUISITES & NOTES - This ...
For 25 years, Upgrading and Repairing PCs has been the world’s #1 guide to PC hardware: The single source for reliable information on troubleshooting and fixing problems, adding hardware, optimizing ...
Upgrading to Visual Basic .NET Upgrading to Visual Basic .NET Upgrading to Visual Basic .NET
Upgrading and Repairing PCs, 19th Edition 2010。2011年,就是上学期我刚学完的,我专业networking。这是第一学期的基础课。很好的资源,我买的正版。根大家分享。PDF版。
MP3Player固件升级工具是一款非常好用的mp3固件升级工具,可以帮助用户升级MP3中player的固件,从而使MP3使用更流畅,歌曲播放更清晰,有需要的朋友可以下载。功能介绍1,解决在“收音机”中选择去除立体声(即改为单...
升级到Spring Boot 2.0 介绍 该项目显示了从Spring Boot 1.5到2.0的迁移路径示例。 该应用程序提供单个Mustache视图和几个Web端点,这些端点从MongoDB数据库以XML / JSON格式返回数据。 这个应用程序很小(而且是...
Problems Upgrading code from v6 to .NET Problems Upgrading code from v6 to .NET
Upgrading to Office SharePoint Server 2007.
MS Press - Upgrading Visual Basic 6.0 to VB.NET
WELCOME TO TURBO C 2.0 ---------------------- This README file contains important, last minute information about Turbo C 2.0. The HELPME!.DOC file on the COMMAND LINE/UTILITIES disk also answers ...