.. only:: html

 .. contents:: Table of contents
    :depth: 2
    :local:

The key changes in 5.1.0 are as below.

• Updated the Spring Framework to 4.2.4
• Updated Apache Commons Collections to 3.2.2
• Updated Spring Security to 4.0.3
• Updated the Spring IO Platform to 2.0.1
• Updated MyBatis Spring to 1.2.3
• Updated MyBatis to 3.3.0

The Spring Framework has been updated to 4.2.4.RELEASE to resolve the security vulnerability from 5.1.0.

• [CVE-2015-5211] RFD Attack in Spring Framework ([SPR-13548] Protect against RFD exploits)
• [CVE-2015-4852] [SPR-13656] SerializableTypeWrapper.MethodInvokeTypeProvider can be exploited for unsafe deserialization

Apache Commons Collections has been updated to 3.2.2 to resolve the security vulnerability from 5.1.0.

• [CVE-2015-4852] [COLLECTIONS-580] Arbitrary remote code execution with InvokerTransformer

The Spring Framework has been updated to 4.0.3 RELEASE from 5.1.0.

The Spring IO Platform has been updated to 2.0.1.RELEASE from 5.1.0. This update has been performed to resolve the above 2 security vulnerabilities and also the following libraries have been updated as a result of it.

• Updated Spring Data Commons to 1.11.2.RELEASE
• Updated Spring Data JPA to 1.9.1.RELEASE
• Updated AspectJ to 1.8.7
• Updated Jackson to 2.6.4
• Updated SLF4J to 1.7.13
• Updated Hibernate ORM to 4.3.11.Final
• Updated Hibernate Validator to 5.2.2.Final
• Updated Jboss Logging to 3.3.0.Final
• Updated Joda Time to 2.8.2
• Updated Apache Commons Dbcp2 to 2.1.1
• Updated Apache Commons Pool2 to 2.4.2
• Updated Apache Commons Collections to 3.2.2

MyBatis has been updated to 3.3.0 to incorporate the following bug fixes from 5.1.0. MyBatis Spring has been updated to 1.2.3 along with this update.

• [#464] Bug fix support for MyBatis unexpected NPE

Function added to common library and some of the specifications changed, from 5.1.0. For implementation of common library, JDK1.6 compatible code was guaranteed. From 5.1.0, JDK1.7 compatible code is guaranteed.

• [#364] Support @AliasFor in @TransactionTokenCheck
• [#367] Add utility to interconvert fullwidth <-> halfwidh
• [#372] Add constraints of Bean Validation
• [#390] Add CodePoint-based validation
• [#401] Add PARAMETER on @ExistInCodeList
• [#402] Support CharSequence on @ExistInCodeList
• [#436] Remove jsp/jstl dependencies from terasoluna-gfw-web
• [#462] Deprecate RedirectAuthenticationHandler

Some configuration files in blank project have been upgraded from 5.1.0.

• [single#136] Reflect changes of MyBatis 3.3.0
• [single#137] Disable URL Rewriting by default with Servlet 3.0 config
• [single#143] Polushing XML files
• [single#159] Add validation messages
• [single#162] Change dependency to terasoluna-gfw-web-jsp
• [single#168] wrong spelling "plugi" at parent POM.xml
• [multi#178] Reflect changes of MyBatis 3.3.0
• [multi#179] Disable URL Rewriting by default with Servlet 3.0 config
• [multi#185] Polushing XML files
• [multi#193] Change configuration value of 'onError' option of sql-maven-plugin. (continue -> abort)
• [multi#198] Add validation messages
• [multi#201] About "auto-config"
• [multi#204] Change dependency to terasoluna-gfw-web-jsp
• [multi#209] POM analysis is failing at seleinumPJ,'cause maven-failsafe-plugin version is not found.
• [multi#213] wrong spelling "plugi" at parent POM.xml

The migration procedures are as follows.

Note

Legend

Required : This procedure is mandatory

Required by case : This procedure is mandatory if conditions match

Optional : This procedure is recommended. (Implement it as required)

- : This procedure is not required

[General]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

[Spring Framework]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

[Spring Security]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

[MyBatis]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

[Common library]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

[Blank project]

.. tabularcolumns:: |p{0.10\linewidth}|p{0.30\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|p{0.20\linewidth}|

Update the common library and dependent library of TERASOLUNA Server Framework for Java (5.x).

.. tabularcolumns:: |p{0.35\linewidth}|p{0.25\linewidth}|p{0.25\linewidth}|p{0.15\linewidth}|

[Procedure's required cases]

This procedure is mandatory.

This update procedure is for the project created using 'mvn archetype <https://github.com/terasolunaorg/terasoluna-gfw-web-multi-blank>'__.

Modify "version" of pom file of parent project to 5.1.0.RELEASE. ("$YOUR_MULTIPLE_PROJECT_ROOT/pom.xml")

<!-- omitted -->
<parent>
    <groupId>org.terasoluna.gfw</groupId>
    <artifactId>terasoluna-gfw-parent</artifactId>
    <version>5.1.0.RELEASE</version>                    <!-- ### Modified location ### -->
</parent>
<!-- omitted -->

This update procedure is for the project created using 'mvn archetype <https://github.com/terasolunaorg/terasoluna-gfw-web-blank>'__ or the project downloaded from 'release site <https://github.com/terasolunaorg/terasoluna-gfw-web-blank/releases/>'_.

Modify "version" of pom file of parent project to 5.1.0.RELEASE.

($YOUR_SINGLE_PROJECT/pom.xml)

<!-- omitted -->
<parent>
    <groupId>org.terasoluna.gfw</groupId>
    <artifactId>terasoluna-gfw-parent</artifactId>
    <version>5.1.0.RELEASE</version>                    <!-- ### Modified location ### -->
</parent>
<!-- omitted -->

This update procedure is for the Eclipse WTP project downloaded from 'release site <https://github.com/terasolunaorg/terasoluna-gfw-web-blank/releases/>'_.

Refer to 'Updating library while using Eclipse WTP Project <#eclipse-wtp-project%E4%BD%BF%E7%94%A8%E6%99%82%E3%81%AE%E3%83%A9%E3%82%A4%E3%83%96%E3%83%A9%E3%83%AA%E6%9B%B4%E6%96%B0>'_ for the update procedure.

From 5.1.0, JSP/JSTL related libraries moved from terasoluna-gfw-web to terasoluna-gfw-web-jsp.

[Procedure's required cases]

Modification is required when JSP/JSTL is used.

[Modification method]

Add terasoluna-gfw-web-jsp to dependencies in pom.xml of project which use JSP/JSTL, as below.

<!-- omitted -->
<dependencies>
    <dependency>                                          <!-- ### Add location ### -->
        <groupId>org.terasoluna.gfw</groupId>             <!-- ### Add location ### -->
        <artifactId>terasoluna-gfw-web-jsp</artifactId>   <!-- ### Add location ### -->
    </dependency>                                         <!-- ### Add location ### -->
    <!-- omitted -->
</dependencies>
<!-- omitted -->

AbstractExcelView is not recommended from 5.1.0 (Spring Framework 4.2). AbstractXlsView has been added instead.

[Procedure's required cases]

Modification is required when AbstractExcelView is used.

[Modification method]

Change so as to use AbstractXlsView instead of AbstractExcelView.

In 5.1.0 (Spring Framework 4.2), Hibernate Validator 5.2.x is used and a bug in the message definition detected in 5.1.x is corrected.

[Procedure's required cases]

As an interim measure for bug in the message definition in 5.1.x, modification is necessary when message definition is overwritten in ValidationMessages.properties.

[Modification method]

Delete interim measure defined in ValidationMessages.properties For message definition performing interim measures, refer Modifications done for Hibernate Validator 5.2 .

From 5.1.0 (Spring Security 4.0.3), Constructor arguments of following classes are changed which are subclasses of AuthenticationException.

• AccountStatusException
• AccountExpiredException
• BadCredentialsException
• CredentialsExpiredException
• DisabledException
• LockedException
• UsernameNotFoundException

[Procedure's required cases]

In the above class, modification is required when constructor which use UserDetails is used.

[Modification method]

As shown below, UserDetails is deleted from constructor argument.

new UsernameNotFoundException ("Message");

Following attributes of taglib authorize tag are deleted, from 5.1.0 (Spring Security 4.0.3).

• ifAllGranted
• ifAnyGranted
• ifNotGranted

[Procedure's required cases]

Modification is required when authorize tag is used and following attributes are used.

[Modification method]

In the corresponding JSP, following description changed respectively.

hasRole() and and are used.

[Before modification]

<sec:authorize ifAllGranted="ROLE_ADMIN,ROLE_USER">

[After modification]

<sec:authorize access="hasRole('ROLE_ADMIN') and hasRole('ROLE_USER')">

hasAnyRole() is used.

[Before modification]

<sec:authorize ifAnyGranted="ROLE_ADMIN,ROLE_USER">

[After modification]

<sec:authorize access="hasAnyRole('ROLE_ADMIN','ROLE_USER')">

!hasAnyRole() is used.

[Before modification]

<sec:authorize ifNotGranted="ROLE_ADMIN,ROLE_USER">

[After modification]

<sec:authorize access="!hasAnyRole('ROLE_ADMIN','ROLE_USER')">

ConcurrentSessionControlStrategy - deprecated API is deleted, from 5.1.0 (Spring Security 4.0.3).

[Procedure's required cases]

Modification is required when ConcurrentSessionControlStrategy is used.

[Modification method]

Refer below.

http://docs.spring.io/spring-security/site/docs/4.0.3.RELEASE/reference/htmlsingle/#concurrent-sessions

Following URL and parameter names changed, from 5.1.0 (Spring Security 4.X).

• j_username
• j_password
• j_spring_security_check
• j_spring_cas_security_check
• j_spring_cas_security_proxyreceptor
• j_spring_openid_security_login
• j_spring_security_switch_user
• j_spring_security_exit_user
• login_error
• _spring_security_remember_me

[Procedure's required cases]

Modification is required when above URL and parameter names are used.

[Modification method]

Change all the places where above URL and parameter name are used.

• j_username -> username
• j_password -> password
• j_spring_security_check -> login
• j_spring_cas_security_check -> login/cas
• j_spring_cas_security_proxyreceptor -> login/cas/proxyreceptor
• j_spring_openid_security_login -> login/openid
• j_spring_security_switch_user -> login/impersonate
• j_spring_security_exit_user -> logout/impersonate
• login_error -> error
• _spring_security_remember_me -> remember-me

From 5.1.0 (Spring Security 4.X), when Spring Security function is used, it is possible to omit prefix (ROLE_) while specifying ROLE name.

[Procedure's required cases]

Modification is required when ROLE name is used in the Spring Security function. Modification is not required since prefix of ROLE name which is used in the user rights data (entity) handled in the property is necessary.

[Modification method]

• In case of spring-security.xml

  Delete prefix from ROLE name (ROLE_) from any of the files given below.

  • $YOUR_MULTIPLE_PROJECT_ROOT/xxx-web/src/main/resources/META-INF/spring/spring-security.xml
  • $YOUR_SINGLE_PROJECT/src/main/resources/META-INF/spring/spring-security.xml
  • $YOUR_ECLIPSE_WTP_PROJECT/src/main/resources/META-INF/spring/spring-security.xml

  [Before modification]

  <sec:http auto-config="true" use-expressions="true">
      <sec:intercept-url pattern="/admin/*" access="hasRole('ROLE_ADMIN')"/>  <!-- ### Location to modify### -->
      <!-- omitted -->
  </sec:http>

  [After modification]

  <sec:http auto-config="true" use-expressions="true">
      <sec:intercept-url pattern="/admin/*" access="hasRole('ADMIN')"/>       <!-- ### Modified location ### -->
      <!-- omitted -->
  </sec:http>

• In case of java

  Delete prefix from ROLE name (ROLE_) as shown below.

  [Before modification]

  @PreAuthorize("hasRole('ROLE_ADMIN')")  // ### Location to modify ###
  String preAuthorize();

  [After modification]

  @PreAuthorize("hasRole('ADMIN')")       // ### Modified location ###
  String preAuthorize();

From 5.1.0 (Spring Security 4.X), packages for AuthenticationPrincipal and AuthenticationPrincipalArgumentResolver are changed.

[Procedure's required cases]

Modification is required when AuthenticationPrincipal or AuthenticationPrincipalArgumentResolver is used.

[Modification method]

Modify package name as shown below.

[Before modification]

import org.springframework.security.web.bind.support.AuthenticationPrincipalArgumentResolver;
import org.springframework.security.web.bind.annotation.AuthenticationPrincipal;

[After modification]

import org.springframework.security.web.method.annotation.AuthenticationPrincipalArgumentResolver;
import org.springframework.security.core.annotation.AuthenticationPrincipal;

From 5.1.0 (Spring Security 4.X), default value of use-expressions changed from false to true.

[Procedure's required cases]

Modification is required when Spring Security is used.

[Modification method]

Change the setting to enable / disable Spring EL function in Spring Security as shown below.

[While disabling Spring EL function in Spring Security]

Explicitly set use-expressions="false"

<sec:http  use-expressions="false">               <!-- ### Location to modify ### -->
  <!-- omitted -->
</sec:http>

[While enabling Spring EL function in Spring Security]

use-expressions="true" settings can be omitted

<sec:http>                                        <!-- ### Modified location ### -->
  <!-- omitted -->
</sec:http>

From 5.1.0 (Spring Security 4.X), default value of disable-url-rewriting changed from false to true.

[Procedure's required cases]

Modification is required when Spring Security is used.

[Modification method]

Change the settings to switch between enable / disable the disabling function of URL rewriting in Spring Security as shown below.

[While disabling URL rewriting disabling function (allow URL rewriting) in Spring Security]

Explicitly set disable-url-rewriting="false"

<sec:http  disable-url-rewriting="false">         <!-- ### Location to modify ### -->
  <!-- omitted -->
</sec:http>

[While enabling URL rewriting disabling function (deny URL rewriting) in Spring Security]

disable-url-rewriting="true" settings can be omitted

<sec:http>                                        <!-- ### Modified location ### -->
  <!-- omitted -->
</sec:http>

From 5.1.0 (Spring Security 4.X), access-denied-page attribute is deleted.

[Procedure's required cases]

Modification is required when access-denied-page attribute is used.

[Modification method]

Change HTTP elements of Spring Security as shown below.

[Before modification]

<sec:http access-denied-page="/accessDeneidPage">                     <!-- ### Location to modify ### -->
    <!-- omitted -->
</sec:http>

[After modification]

<sec:http>                                                            <!-- ### Modified location ### -->
    <!-- omitted -->
    <sec:access-denied-handler error-page="/accessDeneidPage" />      <!-- ### Modified location ### -->
</sec:http>

From 5.1.0 (Spring Security 4.X), path-type attribute is deleted.

[Procedure's required cases]

Modification is required when path-type attribute is used in the following elements.

• http
• filter-chain-map
• filter-security-metadata-source

[Modification method]

Use request-matcher attribute instead of path-type attribute as shown below.

[Before modification]

<sec:http path-type="regex">          <!-- ### Location to modify ### -->
    <!-- omitted -->
</sec:http>

[After modification]

<sec:http request-matcher="regex">    <!-- ### Modified location ### -->
    <!-- omitted -->
</sec:http>

From 5.1.0 (Spring Security 4.X), CSRF function is enabled by default in Spring Security.

[Procedure's required cases]

When csrf element is used in Spring Security, modification is required when CSRF function is disabled without using csrf element.

[Modification method]

• When CSRF function is disabled in Spring Security

<sec:http>
  <sec:csrf disabled="true"/>     <!-- ### Modified location ### -->
  <!-- omitted -->
</sec:http>

• When CSRF function is enabled in Spring Security

csrf element setting is optional

<sec:http>
  <!-- omitted -->
</sec:http>

From 5.1.0 (Spring Security 4.X), a function which sets a secure HTTP response header is enabled by default in Spring Security. Following HTTP response headers are set by default.

• Cache-Control
• X-Content-Type-Options
• Strict-Transport-Security
• X-Frame-Options
• X-XSS-Protection

[Procedure's required cases]

When headers element is used in Spring Security, or when a function which sets a secure HTTP response header is disabled without using headers element, modification is required.

[Modification method]

[When a function to set secure HTTP response header is disabled]

<sec:http>
  <sec:headers disabled="true"/>              <!-- ### Modified location ### -->
  <!-- omitted -->
</sec:http>

[When a function to set a secure HTTP response header is enabled]

headers element settings are optional.

<sec:http>
  <!-- omitted -->
</sec:http>

[When HTTP response header is set individually]

Perform individual settings after overriding default settings by defaults-disabled attribute of headers element.

<sec:http>
  <sec:headers defaults-disabled="true">      <!-- ### Modified location ### -->
    <sec:cache-control />                     <!-- ### Modified location ### -->
    <sec:content-type-options />              <!-- ### Modified location ### -->
    <sec:hsts />                              <!-- ### Modified location ### -->
  </sec:headers>
  <!-- omitted -->
</sec:http>

defaultFetchSize can be used from 5.1.0 (Mybatis 3.3.0). By setting defaultFetchSize, a default fetchSize can be set for all the queries.

[Procedure's required cases]

Although application of this procedure is optional, when MyBatis is used, modification below is recommended.

[Modification method]

For modification method, refer fetchSize setting of guideline. ( English or Japanese )

From 5.1.0, default setting of library used for achieving "Lazy Load" is changed from CGLIB to JAVASSIST due to update to MyBaits3.3.0.

[Procedure's required cases]

Application of this procedure is optional. Implementation of procedure is not necessary in the 2 cases given below.

• Not-applicable case 1 : When "Lazy Load" is not used
• Not-applicable case 2 : "Lazy Load" is used, however, when a library to be explicitly used is specified by "dependency" of pom.xml setting file and "proxyFactory" of mybatis-config.xml setting file.

The case when the procedure becomes necessary is the case when "Lazy Load" is achieved by using a default library (when a library setting is not implemented explicitly). Implement any of the two procedures given below depending on the requirement in 5.1.0.

• Step 18-1: When default library of MyBatis is used (JAVASSIST is used)
• Step 18-2: When you do not want to change the library before migration (CGLIB is used)

This procedure uses JAVASSIST which is a default library in MyBatis 3.3.0 as a library to be used for achieving "Lazy Load". Setting of CGLIB which is used before migration is deleted.

[Modification method]

Modify settings for any of the following files in MyBatis project.

• $YOUR_MULTIPLE_PROJECT_ROOT/pom.xml
• $YOUR_SINGLE_PROJECT/pom.xml
• $YOUR_ECLIPSE_WTP_PROJECT/pom.xml

[Before modification]

<!-- omitted -->
        <dependency>                       <!-- ### Delete location ### -->
            <groupId>cglib</groupId>       <!-- ### Delete location ### -->
            <artifactId>cglib</artifactId> <!-- ### Delete location ### -->
            <version>3.1</version>         <!-- ### Delete location ### -->
            <scope>runtime</scope>         <!-- ### Delete location ### -->
        </dependency>                      <!-- ### Delete location ### -->
<!-- omitted -->

[After modification]

<!-- omitted -->
     <!-- none -->
<!-- omitted -->

This procedure uses CGLIB as a library to be used for achieving "Lazy Load". Since JAVASSIST is used as a default in MyBatis3.3.0, CGLIB setting is added.

[Modification method]

Modify settings in any of the following files in MyBatis project.

• $YOUR_MULTIPLE_PROJECT_ROOT/xxx-domain/src/main/resources/META-INF/mybatis/mybatis-config.xml
• $YOUR_SINGLE_PROJECT/src/main/resources/META-INF/mybatis/mybatis-config.xml
• $YOUR_ECLIPSE_WTP_PROJECT/src/main/resources/META-INF/mybatis/mybatis-config.xml

[Before modification]

<!-- omitted -->
<!-- See http://mybatis.github.io/mybatis-3/configuration.html#settings -->
<settings>
    <setting name="mapUnderscoreToCamelCase" value="true" />
    <setting name="lazyLoadingEnabled" value="true" />
    <setting name="aggressiveLazyLoading" value="false" />
  <!-- ### Delete location Start### -->
  <!--
      <setting name="defaultExecutorType" value="REUSE" />
      <setting name="jdbcTypeForNull" value="NULL" />
      <setting name="proxyFactory" value="JAVASSIST" />
      <setting name="localCacheScope" value="STATEMENT" />
  -->
  <!-- ### Delete location End ### -->
</settings>
<!-- omitted -->

[After modification]

<!-- omitted -->
<!-- See http://mybatis.github.io/mybatis-3/configuration.html#settings -->
<settings>
    <setting name="mapUnderscoreToCamelCase" value="true" />
    <setting name="lazyLoadingEnabled" value="true" />
    <setting name="aggressiveLazyLoading" value="false" />
<!-- ### Add location Start ### -->
<!-- Default value for proxyFactory has changed to JAVASSIST since mybatis 3.3.0 .
 To use CGLIB as a proxyFactory, remove this comment and add dependency for CGLIB in pom.xml -->
    <setting name="proxyFactory" value="CGLIB" />
<!-- ### Add location End ### -->
</settings>
<!-- omitted -->

Modify setting in any of the following files in MyBatis project. Check version of cglib to be added for each project.

• $YOUR_MULTIPLE_PROJECT_ROOT/pom.xml
• $YOUR_SINGLE_PROJECT/pom.xml
• $YOUR_ECLIPSE_WTP_PROJECT/pom.xml

[Before modification]

<!-- omitted -->
     <!-- none -->
<!-- omitted -->

[After modification]

<!-- omitted -->
    <!-- ### Add location Start ### -->
    <dependency>
        <groupId>cglib</groupId>
        <artifactId>cglib</artifactId>
        <version>3.1</version>
        <scope>runtime</scope>
    </dependency>
   <!-- ### Add location End ### -->
<!-- omitted -->

From 5.1.0 (MyBatis 3.3.0), org.apache.ibatis.session.ResultHandler became a class which is generically handled.

[Procedure's required cases]

Although application of this procedure is optional, when MyBatis is used, modification given below is recommended.

[Modification method]

Perform generic handling for ResultHandler and ResultContext as given below.

[Before modification]

public class BookResultHandler implements ResultHandler, AutoCloseable {          // ### Location to modify ###

    // omitted

    @Override
    public void handleResult(ResultContext context) {                             // ### Location to modify ###
        Book book = (Book) context.getResultObject();                             // ### Location to modify ###

        // omitted
    }
}

[After modification]

public class BookResultHandler implements ResultHandler<Book>, AutoCloseable {    // ### Modified location ###

    // omitted

    @Override
    public void handleResult(ResultContext<? extends Book> context) {             // ### Modified location ###
        Book book = context.getResultObject();                                    // ### Modified location ###

        // omitted
    }
}

From 5.1.0, ExistInCodeListValidatorForString is deleted, and ExistInCodeListValidatorForCharSequence is added instead.

[Procedure's required cases]

Modification is required when ExistInCodeListValidatorForString is used.

[Modification method]

Replace ExistInCodeListValidatorForString with ExistInCodeListValidatorForCharSequence as shown below.

[Before modification]

import org.terasoluna.gfw.common.codelist.validator.ExistInCodeListValidatorForString;

[After modification]

import org.terasoluna.gfw.common.codelist.validator.ExistInCodeListValidatorForCharSequence;

From 5.1.0, RedirectAuthenticationHandler is deprecated.

[Procedure's required cases]

Modification is required when RedirectAuthenticationHandler is used.

[Modification method]

Replace RedirectAuthenticationHandler with SavedRequestAwareAuthenticationSuccessHandler as shown below.

[Before modification]

// omitted
import org.terasoluna.gfw.security.web.redirect.RedirectAuthenticationHandler;    // ### Location to modify ###

public class MyAuthenticationSuccessHandler extends
                                           RedirectAuthenticationHandler {        // ### Location to modify ###
    // omitted
}

[After modification]

// omitted
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;     // ### Modified location ###

public class MyAuthenticationSuccessHandler extends
                                           SavedRequestAwareAuthenticationSuccessHandler {                // ### Modified location ###
    // omitted
}

From 5.1.0, version of Java which use Blank project is changed to 1.8.

[Procedure's required cases]

Application of this procedure is optional. Modify when required as below.

[Modification method]

Modify Java version to 1.8 as shown below, in any of the following files.

• $YOUR_MULTIPLE_PROJECT_ROOT/pom.xml
• $YOUR_SINGLE_PROJECT/pom.xml

[Before modification]

<!-- omitted -->
<properties>
    <!-- omitted -->
    <java-version>1.7</java-version>      <!-- ### Location to modify ### -->
</properties>
<!-- omitted -->

[After modification]

<!-- omitted -->
<properties>
    <!-- omitted -->
    <java-version>1.8</java-version>      <!-- ### Modified location ### -->
</properties>
<!-- omitted -->

From 5.1.0, setting of Servlet 3.0 which disables URL rewriting is included. For detailed information, refer GitHub multi#179 .

[Procedure's required cases]

Although application of this procedure is optional, application is recommended from security point of view.

In the case below, implementation of this procedure is not required.

• When it is difficult to use Cookie as a method to handle session ID between client and server and URL rewriting is required.

[Modification method]

Add settings for any of the following files.

• $YOUR_MULTIPLE_PROJECT_ROOT/xxx-web/src/main/webapp/WEB-INF/web.xml
• $YOUR_SINGLE_PROJECT/src/main/webapp/WEB-INF/web.xml
• $YOUR_ECLIPSE_WTP_PROJECT/src/main/webapp/WEB-INF/web.xml

[Before modification]

<!-- omitted -->
<session-config>
    <!-- 30min -->
    <session-timeout>30</session-timeout>
</session-config>
<!-- omitted -->

[After modification]

<!-- omitted -->
<session-config>
    <!-- 30min -->
    <session-timeout>30</session-timeout>
    <cookie-config>                       <!-- ### Add location ### -->
        <http-only>true</http-only>       <!-- ### Add location ### -->
        <!-- <secure>true</secure> -->    <!-- ### Add location ### -->
    </cookie-config>                      <!-- ### Add location ### -->
    <tracking-mode>COOKIE</tracking-mode> <!-- ### Add location ### -->
</session-config>
<!-- omitted -->

In 5.1.0, indent of various XML files is adjusted and namespaces which are not used, are deleted for source organization.

[Procedure's required cases]

Application of this procedure is optional. Modify when required as given below.

[Modification method]

Refer following for modification methods.

• GitHub single#152
• GitHub single#157
• GitHub multi#186

In 5.1.0, following new annotations are added.

• @ByteMin
• @ByteMax
• @Compare
• @ConsistOf

[Procedure's required cases]

Application of this procedure is optional. Modify when required as given below.

[Modification method]

Add settings in any of the following files.

• $YOUR_MULTIPLE_PROJECT_ROOT/xxx-web/src/main/resources/ValidationMessages.properties
• $YOUR_SINGLE_PROJECT/src/main/resources/ValidationMessages.properties
• $YOUR_ECLIPSE_WTP_PROJECT/src/main/resources/ValidationMessages.properties

[Add message]

org.terasoluna.gfw.common.codelist.ExistInCodeList.message = Does not exist in {codeListId}
org.terasoluna.gfw.common.codepoints.ConsistOf.message = not consist of specified code points
org.terasoluna.gfw.common.validator.constraints.ByteMin.message = must be greater than or equal to {value} bytes
org.terasoluna.gfw.common.validator.constraints.ByteMax.message = must be less than or equal to {value} bytes
org.terasoluna.gfw.common.validator.constraints.Compare.message = invalid combination of {left} and {right}

auto-config attribute of http element of Spring Security recommends default (false) setting in the guideline. Therefore, from Blank project of 5.1.0, setting which sets auto-config attribute to true is deleted.

[Procedure's required cases]

Although application of this procedure is optional, when auto-config attribute is set to true, modification given below is recommended.

[Modification method]

As shown below, auto-config attribute is deleted, and form-login element, http-basic element and logout element are added when required instead. For details of each element, refer auto-config attribute of guideline. ( English or Japanese )

[Before modification]

<!-- omitted -->
<sec:http auto-config="true" >    <!-- ### Location to modify ### -->
    <!-- omitted -->
</sec:http>
<!-- omitted -->

[After modification]

<!-- omitted -->
<sec:http>                        <!-- ### Modified location ### -->
    <sec:form-login/>             <!-- ### Modified location ### -->
    <sec:logout/>                 <!-- ### Modified location ### -->
    <!-- omitted -->
</sec:http>
<!-- omitted -->

In Blank project of 5.1.0, wrongly set property name which defines build-helper-maven-plugin version corrected from "-maven-plugi" to " -maven-plugin ".

[Procedure's required cases]

Although application of the procedure is optional, modify as much as possible for clerical corrections.

[Modification method]

Modify property name as shown below, for any of the following files.

• $YOUR_MULTIPLE_PROJECT_ROOT/pom.xml
• $YOUR_SINGLE_PROJECT/pom.xml

[Before modification]

<!-- omitted -->
<properties>
    <!-- omitted -->
    <org.codehaus.mojo.build-helper-maven-plugi.version>1.9.1</org.codehaus.mojo.build-helper-maven-plugi.version>    <!-- ### Location to modify ### -->
    <!-- omitted -->
</properties>
<!-- omitted -->
<build>
    <pluginManagement>
        <plugins>
            <!-- omitted -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>build-helper-maven-plugin</artifactId>
                <version>${org.codehaus.mojo.build-helper-maven-plugi.version}</version>      <!-- ### Location to modify ### -->
                <!-- omitted -->
            </plugin>
            <!-- omitted -->
        </plugins>
    </pluginManagement>
</build>
<!-- omitted -->

[After modification]

<!-- omitted -->
<properties>
    <!-- omitted -->
    <org.codehaus.mojo.build-helper-maven-plugin.version>1.9.1</org.codehaus.mojo.build-helper-maven-plugin.version>  <!-- ### Modified location ### -->
    <!-- omitted -->
</properties>
<!-- omitted -->
<build>
    <pluginManagement>
        <plugins>
            <!-- omitted -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>build-helper-maven-plugin</artifactId>
                <version>${org.codehaus.mojo.build-helper-maven-plugin.version}</version>     <!-- ### Modified location ### -->
                <!-- omitted -->
            </plugin>
            <!-- omitted -->
        </plugins>
    </pluginManagement>
</build>
<!-- omitted -->

maven-failsafe-plugin is added to Blank project of 5.1.0 to execute goal integration-test of Maven.

[Procedure's required cases]

Application of this procedure is optional. Modify as given below, as and when required.

[Modification method]

Add and set maven-failsafe-plugin and maven-surefire-plugin as given below, for any of the following files.

• $YOUR_MULTIPLE_PROJECT_ROOT/xxx-selenium/pom.xml
• $YOUR_SINGLE_PROJECT/pom.xml

<!-- omitted -->
<build>
     <plugins>
         <plugin>                                                 <!-- ### Add location ### -->
             <groupId>org.apache.maven.plugins</groupId>          <!-- ### Add location ### -->
             <artifactId>maven-failsafe-plugin</artifactId>       <!-- ### Add location ### -->
             <executions>                                         <!-- ### Add location ### -->
                 <execution>                                      <!-- ### Add location ### -->
                     <goals>                                      <!-- ### Add location ### -->
                         <goal>integration-test</goal>            <!-- ### Add location ### -->
                     </goals>                                     <!-- ### Add location ### -->
                 </execution>                                     <!-- ### Add location ### -->
             </executions>                                        <!-- ### Add location ### -->
         </plugin>                                                <!-- ### Add location ### -->
         <plugin>                                                 <!-- ### Add location ### -->
             <groupId>org.apache.maven.plugins</groupId>          <!-- ### Add location ### -->
             <artifactId>maven-surefire-plugin</artifactId>       <!-- ### Add location ### -->
             <configuration>                                      <!-- ### Add location ### -->
                 <excludes>                                       <!-- ### Add location ### -->
                     <exclude>**/*IT.java</exclude>               <!-- ### Add location ### -->
                 </excludes>                                      <!-- ### Add location ### -->
             </configuration>                                     <!-- ### Add location ### -->
         </plugin>                                                <!-- ### Add location ### -->
     </plugins>
</build>
<!-- omitted -->

onError setting of sql-maven-plugin of Maven is deleted from Blank project, from 5.1.0 to not to allow completion of build by ignoring SQL error at the time of Maven build.

[Procedure's required cases]

Although application of this procedure is optional, modification given next is recommended.

[Modification method]

Delete onError setting of sql-maven-plugin as shown below, in the following file.

• $YOUR_MULTIPLE_PROJECT_ROOT/xxx-initdb/pom.xml

[Before modification]

<!-- omitted -->
<build>
    <plugins>
        <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>sql-maven-plugin</artifactId>
            <!-- omitted -->
            <configuration>
              <!-- omitted -->
              <onError>continue</onError>             <!-- ### Location to delete ### -->
              <!-- omitted -->
            </configuration>
        </plugin>
    </plugins>
</build>
<!-- omitted -->

[After modification]

<!-- omitted -->
<build>
    <plugins>
        <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>sql-maven-plugin</artifactId>
            <!-- omitted -->
            <configuration>
              <!-- omitted -->
            </configuration>
        </plugin>
    </plugins>
</build>
<!-- omitted -->

This update procedure is for the Eclipse WTP project downloaded from 'release site <https://github.com/terasolunaorg/terasoluna-gfw-web-blank/releases/>'_.

Note

Legend

[Table header]

Non : Blank project that is independent of O/R Mapper

MB3 : Blank project for MyBatis3

JPA : Blank project for JPA

[Remarks column]

* : Operation target

Download 'Eclipse WTP Project of 5.1.0.RELEASE <https://github.com/terasolunaorg/terasoluna-gfw-web-blank/releases/tag/5.1.0.RELEASE>'_.

Terminate Eclipse if it is running.

Update (delete and add) jar file of "$YOUR_ECLIPSE_WTP_PROJECT/src/main/webapp/WEB-INF/lib".

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|

Update (delete and add) jar file of "$YOUR_ECLIPSE_WTP_PROJECT/testlib".

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|

Update (delete and add) jar file for storing the source of "$YOUR_ECLIPSE_WTP_PROJECT/libsrc".

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|

Update the reference library using replacement string.

• $YOUR_ECLIPSE_WTP_PROJECT/.classpath
• $YOUR_ECLIPSE_WTP_PROJECT/build.xml

.. tabularcolumns:: |p{0.25\linewidth}|p{0.30\linewidth}|p{0.30\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|p{0.05\linewidth}|