why sec:authorize doesn't work? - jsf-2

I have a JSF 2 page based on Facelets and use Spring Security 3 behind the application. When I put some tags like this within my page:
<sec:authorize access="hasRole('SS')" >
<h:outputText value="X" /></sec:authorize>
the X will display at runtime anyway. The auto completion feature of eclipse work correctly to show the "sec:" tags and their properties at programming time. what's the problem?

Have you got:
<%# taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
at the top of the file?
Also, you need use-expressions="true" in the http tag in securityBeans.xml. Doing this means that any old style access="ROLE_BLAH" tags in securityBeans or wherever also need to change to use expressions.

Related

Primefaces/JSF2 : updating change ui:insert dynamically [duplicate]

I'm just learning JSF 2 thanks to this site I had learned a lot in such a short time.
My question is regarding how to implement a common layout to all my JSF 2 pages and have only the content part of the page refresh not the whole page whenever I click a link/menu from a different panel. I am using the Facelets approach it does what I want except that each time I click a link from a panel (e.g. menu items from left panel) the whole page is refreshed. What I am looking for is a way to refresh only the content part of my page. To illustrate this below is my target pagelayout.
Did not post my code because I'm not sure if Facelets can do this . Are there other approach more suited for my requirement other than Facelets?
A straightforward approach would be the following view:
<h:panelGroup id="header" layout="block">
<h1>Header</h1>
</h:panelGroup>
<h:panelGroup id="menu" layout="block">
<h:form>
<f:ajax render=":content">
<ul>
<li><h:commandLink value="include1" action="#{bean.setPage('include1')}" /></li>
<li><h:commandLink value="include2" action="#{bean.setPage('include2')}" /></li>
<li><h:commandLink value="include3" action="#{bean.setPage('include3')}" /></li>
</ul>
</f:ajax>
</h:form>
</h:panelGroup>
<h:panelGroup id="content" layout="block">
<ui:include src="/WEB-INF/includes/#{bean.page}.xhtml" />
</h:panelGroup>
With this bean:
#ManagedBean
#ViewScoped
public class Bean implements Serializable {
private String page;
#PostConstruct
public void init() {
page = "include1"; // Default include.
}
// +getter+setter.
}
In this example, the actual include templates are include1.xhtml, include2.xhtml and include3.xhtml in /WEB-INF/includes folder (folder and location is fully free to your choice; the files are just placed in /WEB-INF in order to prevent direct access by guessing the URL in browser's address bar).
This approach works in all MyFaces 2.x versions, but requires in case of Mojarra a minimum of 2.3.x. In case you're using a Mojarra version older than 2.3.0, then this all fails when the <ui:include> page in turn contains a <h:form>. Any postback will fail because it is totally missing the view state. You can solve this by upgrading to minimally Mojarra 2.3.0 or with a script found in this answer h:commandButton/h:commandLink does not work on first click, works only on second click. Or, if you're already using PrimeFaces and exclusively use <p:xxx> ajax, then it's already transparently taken into account.
Also, make sure that you're using minimally Mojarra 2.1.18 as older versions will fail in keeping the view scoped bean alive, causing the wrong include being used during postback. If you can't upgrade, then you'd need to fall back to the below (relatively clumsy) approach of conditionally rendering the view instead of conditionally building the view:
...
<h:panelGroup id="content" layout="block">
<ui:fragment rendered="#{bean.page eq 'include1'}">
<ui:include src="include1.xhtml" />
</ui:fragment>
<ui:fragment rendered="#{bean.page eq 'include2'}">
<ui:include src="include2.xhtml" />
</ui:fragment>
<ui:fragment rendered="#{bean.page eq 'include3'}">
<ui:include src="include3.xhtml" />
</ui:fragment>
</h:panelGroup>
The disadvantage is that the view would become relatively large and that all associated managed beans may be unnecessarily initialized even though when they would not be used as per the rendered condition. See also JSTL in JSF2 Facelets... makes sense? for an in depth explanation on <ui:include src="#{...}"> vs <x:someComponent rendered="#{...}">.
As to positioning of the elements, that's just a matter of applying the right CSS. That's beyond the scope of JSF :) At least, <h:panelGroup layout="block"> renders a <div>, so that should be good enough.
Last but not least, this SPA (Single Page Application) approach is not SEO friendly. All the pages are not indexable by searchbots nor bookmarkable by endusers, you may need to fiddle around with HTML5 history in client and provide a server side fallback. Moreover, in case of pages with forms, the very same view scoped bean instance would be reused across all pages, resulting in unintuitive scoping behavior when you navigate back to a previously visited page. I'd suggest to go with templating approach instead as outlined in 2nd part of this answer: How to include another XHTML in XHTML using JSF 2.0 Facelets? See also How to navigate in JSF? How to make URL reflect current page (and not previous one).
If you only want to refresh part of the page, there are only 2 ways to go (for the web in general, not just JSF). You have to use frames or Ajax. JSF 2 supports ajax natively, check out the f:ajax tag to update just 1 component without reloading the entire page.
Netbeans provides a wizard that create the proposed layout with minimal effort using JSF. So, the best way to start is take a look at Facelets Template Wizard and look at the generated source.

EL is not working in a jsp page

I have a JSP page,In that page,I am trying to use the page scope attributes using jstl and struts2 tags.
The following piece of code is,
<%# taglib uri="/struts-tags" prefix="s" %>
<%# taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<c:set var="test" value="ramesh"/>
<c:set var="test1" value="${test}"/>
<s:set var="test2" value="${test}" />
the <s:set> tag yields the following exception " According to TLD or attribute directive in tag file, attribute value does not accept any expressions".
I have two questions.
1)${test} works when it is used in <c:set> tag.
2)${test} does not works when it is used in <s:set> tag. Why?
EL and JSTL are now in Java EE standards, so they can cooperate well, I think.
However, when in struts 2 tags, because struts 2 have their expression language - OGNL,
so I think they prefer to use OGNL to EL in their tags, and that is the reason why they do not support EL. These are my guess.
From Apache link
From Apache FAQ link
As of Struts version 2.0.9 the JSTL/JSP expression language (EL) has been disabled for Struts tag attributes which evaluate OGNL. This is a precaution against security vulnerabilities that can result from the double-evaluation that occurs when an attribute is first processed as a JSTL/JSP EL expression and then the result is processed as an OGNL expression. The solution is to express all dynamic attribute values in Struts tags using OGNL expressions directly.

JSF2 - How to create a link containing parameters and anchor?

I want to produce a link looking like this:
http://domain.com/page.jsf?test=12#top
I tried using <h:outputLink> :
<h:outputLink value="/page.jsf#top">
<f:param name="test" value="12" />
My link
</h:outputLink>
But it failed and produced the link http://domain.com/page.jsf#top?test=12, which is wrong.
Is there a way to do this using JSF, or do I have to create this kind of links "manually"?
Since JSF 2.0 there is an <h:link> component that takes a JSF navigation case outcome through its outcome attribute, thus making it a perfect candidate for navigation within a JSF-based application. The component you used, <h:outputLink> is best used for navigation to the external world. You can of course use it to handle JSF navigation but it will feel plain clumsy.
If you decide to switch to <h:link> you can make use of its fragment attribute to attach your anchor (always look at the documentation - linked above):
The identifier of the page fragment which should be brought into focus when the target page is rendered. The value of this attribute is appended to the end of target URL following a hash (#) mark. This notation is part of the standard URL syntax.
All in all, your link should come as:
<h:link value="My link" outcome="/page" fragment="top">
<f:param name="test" value="12" />
</h:link>
It will produce the HTML that you desire.
Further point of reference:
When should I use h:outputLink instead of h:commandLink?

wrong ids when render h:panelGroup's inside c:forEach

I have page where I render some h:panelGroup panels. Those panels are realized as plugins registered in a plugin registry on startup.
Part of the plugins api is a custom jsf component where I get the registered plugins for extension point and include their facelet templates by path:
<c:forEach items="#{pluginRegistry.getPlugins(point)}" var="extension">
<ui:include src="#{extension.path}" />
</c:forEach>
The page where I include the panels looks like:
<h:panelGrid id="dashboard" columns="3">
<cmf:insertPageFragments point="dashboardExtensionPoint" />
</h:panelGrid>
For every panel there are facelet templates like the one below:
<rich:panel id="caseDetailsPanel" header="panel label">
<!-- panel content -->
</rich:panel>
Now, the problem is that the very first panel in the list returned by the pluginsRegistry is rendered in the page with the provided id like formId:caseDetailsPanel for example. The rest of them have generated ids like formId:j_idt223 !!! Obviously if I want to rerender some of the panels, I can't do that.
That happens when environment is jboss AS 7.1 with JSF 2.1, richfaces 4.2.3.Final.
When deployed on jboss-eap-6.1 everything looks fine but for now I can't use this jboss version.
Any suggestions on how to workaround this issue?
There can not be multiple JSF components with the same ID. Each JSF component must have an unique ID. When dynamically creating JSF components using JSTL, you need to manually assign and ensure an unique ID, otherwise JSF will discard the provided ID and autogenerate an unique ID.
There are several ways to achieve this, depending on the concrete functional requirement and the existing code.
Use use the iteration index of <c:forEach>.
<c:forEach ... varStatus="loop">
...
<rich:panel id="caseDetailsPanel_#{loop.index}" ...>
This will generate caseDetailsPanel_0, caseDetailsPanel_1, etc depending on the current iteration index.
Use the unique identifier of the currently iterated item. It isn't clear based on the information provided so far if you have any, so here's just a fictive example assuming that the class behind #{extension} has an id property representing the technical DB identifier.
<c:forEach ... var="extension">
...
<rich:panel id="caseDetailsPanel_#{extension.id}" ...>
Wrap #1 or #2 if necessary in a <f:subview> with an unique identifier, so that you don't need to modify the includes.
<c:forEach ... varStatus="loop">
<f:subview id="panel_#{loop.index}">
<ui:include ... />
The <f:subview> creates a new NamingContainer around it, so you end up getting formId:panel_0:caseDetailsPanel, formId:panel_1:caseDetailsPanel and so on.
A completely different alternative would be to use <ui:repeat> instead of <c:forEach>. The <ui:repeat> does not run during view build time, but during view render time. This way there's physically only one <rich:panel id="caseDetailsPanel"> component in the component tree which is reused multiple times during generating HTML whereby JSF will take care of generating the right IDs with the <ui:repeat> index like so formId:repeatId:0:caseDetailsPanel. However, this in turn may cause trouble with <ui:include> as it also runs during view build time and thus can't get the #{extension} at hands.

f:verbatim tag stops working when inside a dataTable

I posted this to the PrimeFaces user forum but I think they are too busy to look into it, so I thought I would try here.
I have server-side string that has markup in it, so when I want it rendered I do this:
<p:panel>
<f:verbatim>
#{daBean.markedUpString}
</f:verbatim>
</p:panel>
This works fine, but not if the same tag is used inside a p:dataTable -- either with or without the p:panel enclosure. What gets rendered is a div class="ui-dt-c" element with nothing in it. To test, if I take out the f:verbatim tag the marked-up text gets escaped and rendered.
I don't know if this should be considered a bug or not, but does anyone know of a work-around for this? This is with PrimeFaces 3.0.M3.
The <f:verbatim> tag is intented to hold plain text/HTML, not JSF components nor EL expressions. The tag is a leftover from JSF 1.0/1.1 ages when it was not possible to inline plain text/HTML between JSF components. The tag is deprecated in JSF2. You do not need it anymore.
Your concrete functional requirement is thus displaying some HTML string from a managed bean unescaped. For that you should use <h:outputText> with escape="false".
<h:outputText value="#{daBean.markedUpString}" escape="false" />
See also:
Getters inside f:verbatim called before form submission
JSF/Facelets: why is it not a good idea to mix JSF/Facelets with HTML tags?
What are the main disadvantages of Java Server Faces 2.0?

Resources