.. only:: html

 .. contents:: Table of contents
    :depth: 2
    :local:

Main changes in version 1.0.5 are following.

• Updated the Spring Framework to 3.2.17
• Improved blank projects

From version 1.0.5, Spring Framework has been updated to 3.2.17.RELEASE.

At version 1.0.5, the content of the following has been improved for blank projects.

• [single#201] [multi#244] Add workaround settings for CVE-2016-5007(Path Matching Inconsistency)

Migration procedures are as follows.

Note

Legend

Required : This procedure is mandatory.

Required by case : This procedure is mandatory, if conditions match.

Optional : This procedure is recommended. Perform it if you feel the need.

- : This procedure is not required.

[General]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

[Spring Security]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

[Apache Commons Fileupload]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

Update TERASOLUNA Global Framework Common Library and dependency libraries.

.. tabularcolumns:: |p{0.35\linewidth}|p{0.25\linewidth}|p{0.25\linewidth}|p{0.15\linewidth}|

[Procedure's required cases]

This procedure is required.

This update procedure is for the projects which are generated by using mvn archetype.

Update pom file in your parent project. ($YOUR_MULTIPLE_PROJECT_ROOT/pom.xml)

[Before correction]

<parent>
    <groupId>org.terasoluna.gfw</groupId>
    <artifactId>terasoluna-gfw-parent</artifactId>
    <version>1.0.4.RELEASE</version> <!-- ### Need to edit ### -->
</parent>

[After correction]

<parent>
    <groupId>org.terasoluna.gfw</groupId>
    <artifactId>terasoluna-gfw-parent</artifactId>
    <version>1.0.5.RELEASE</version> <!-- ### Need to edit ### -->
</parent>

This update procedure is for projects that are generated by using mvn archetype or downloaded from the release site.

Update pom file in your project. ($YOUR_SINGLE_PROJECT/pom.xml)

[Before correction]

<parent>
    <groupId>org.terasoluna.gfw</groupId>
    <artifactId>terasoluna-gfw-parent</artifactId>
    <version>1.0.4.RELEASE</version> <!-- ### Need to edit ### -->
</parent>

[After correction]

<parent>
    <groupId>org.terasoluna.gfw</groupId>
    <artifactId>terasoluna-gfw-parent</artifactId>
    <version>1.0.5.RELEASE</version> <!-- ### Need to edit ### -->
</parent>

This update procedure is for Eclipse WTP project which is downloaded from the release site.

For update procedures, refer to Update libraries for using Eclipse WTP Project .

Change settings for removing the security vulnerability [CVE-2016-5007].

[Procedure's required cases]

This procedure is required.

Note that if URLs contain a space intentionally, your application may not operate as expected when this procedure is applied.

[Modification method]

Add the following settings to the spring-mvc.xml.

[Before correction]

<mvc:annotation-driven>
   <!-- omitted -->
</mvc:annotation-driven>

[After correction]

<mvc:annotation-driven>
   <!-- omitted -->
   <mvc:path-matching path-matcher="pathMatcher" />
</mvc:annotation-driven>


<bean id="pathMatcher" class="org.springframework.util.AntPathMatcher">
    <property name="trimTokens" value="false" />
</bean>

For the detail, please refer to the warning of [Setting <sec:intercept-url> element] in Access authorization. ( English or Japanese )

It may be necessary to apply this procedure for removing the security vulnerability [CVE-2016-3092].

[Procedure's required cases]

Modification is required when Apache Commons Fileupload(version 1.3.1 or lower) is used.

For the detail, please refer to the warning File Upload. ( English or Japanese )

[Modification method]

Upgrade Apache Commons Fileuploadto 1.3.2 or later.

[Before correction]

<dependency>
    <groupId>commons-fileupload</groupId>
    <artifactId>commons-fileupload</artifactId>
    <version>1.3.1</version>
</dependency>

[After correction]

<dependency>
    <groupId>commons-fileupload</groupId>
    <artifactId>commons-fileupload</artifactId>
    <version>1.3.2</version>
</dependency>

This update procedure is for Eclipse WTP project which is downloaded from the release site.

Note

Legend

[Table Header]

Non : Blank project for none O/R Mapper

JPA : Blank project for JPA

MB2 : Blank project for MyBatis 2

[Marks]

* : target for operations

Download the Eclipse WTP Project of 1.0.5.RELEASE.

If Eclipse is running, stop the Eclipse.

Update(delete and add) jar files in $YOUR_ECLIPSE_WTP_PROJECT/src/main/webapp/WEB-INF/lib.

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|

Update(delete and add) jar files in $YOUR_ECLIPSE_WTP_PROJECT/testlib.

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|

Update(delete and add) source jar files in $YOUR_ECLIPSE_WTP_PROJECT/libsrc.

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|

Update the referenced libraries in all of the following files, using replace string.

• $YOUR_ECLIPSE_WTP_PROJECT/.classpath
• $YOUR_ECLIPSE_WTP_PROJECT/build.xml

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|