portals-jetspeed-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David Sean Taylor <da...@bluesunrise.com>
Subject Re: [Bug 18865] - [Enhancement] MVC Portlet Action Life Cycle
Date Mon, 14 Apr 2003 16:10:33 GMT

On Monday, April 14, 2003, at 07:35  AM, Weaver, Scott wrote:

>> Yes, I saw that. It did look hopeful at first, but its not right.
>> Turbine calls the action directly, it totally bypasses the Portlet 
>> MVC.
>> I debugged this straight from Turbine.java, no MVC code in the stack
>> trace of an action-event
>
> AFAIK, portlet actions should only be loaded/invoked from within the 
> portlets themselves and should not be a concern of the Turbine 
> controller servlet.  Am I wrong to think this?  I have always felt 
> that if you need to invoke an action outside the context of the 
> portlet, you should use a regular action event that is not an 
> extension of VelocityPorletAction or GenericMVCAction as they are 
> reserved for use from within the portlet.

Not saying its wrong or right, but I have lots of Jetspeed code that 
uses the Turbine controller to execute actions.
All of my actions extend VelocityPortletAction, which now extends 
GenericMVCAction.

IMO, Turbine actions being executed outside the knowledge of Jetspeed 
portal is a very bad security hole, and one of the worst bugs in 
Jetspeed.
I'd like to completely deprecate them, and I was hoping that the new 
MVC framework would move Jetspeed-1 in that direction.

--
David Sean Taylor
Bluesunrise Software
david@bluesunrise.com
+01 707 773-4646




---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: jetspeed-dev-help@jakarta.apache.org


Mime
View raw message