Re: JSPWiki 2.4.104 released

On Fri, Sep 21, 2007 at 12:33:35AM +0200, Claudia Frers wrote:
> Hi I tried to find some hints about a way to upgrade but just found an
> upgrade  wiki page saying that this  needs to be  described. Since I am
> still a bit of a newbie I am offering this recipe in hopes that someone
> might read and correct any wrong assumptions. I did it in two rounds just to
> make it easier for me to read the log file. Feel free to make it clearer in
> any way:
> 
> Recipe for Upgrading from old to new version
> 
> Assume your old jspwiki webapp is called app.
> create NewFolder
> Backup app to NewFolder/app.old
> Undeploy app on localhost(work dir cleared too)

I have found undeploy and redeploy don;t always work, there is an open bugzilla 
on jspwiki no closing/terminating some threads properly, I usually find I have 
to shut down tomcat.

> extract war file->NewFolder/JSPWiki.war_FILES (leave this as the original)
> make new copy of NewFolder/JSPWiki.war_FILES and rename to app
> 
> copy all files from app.old WEBINF to current app's WEBINF
> (contains old groupdatabase.xml and userdatabase.xml definitions )
> copy app.old wikiLoggings folder to current app's wikiLoggings folder
> clear jspwiki.log
> 
> restart computer
> run webapp and check jspwiki.log
> Result:
> Two errors when it doesn't find the groupdatabase.xml
> and the userdatabase.xml are then later corrected when
> watchdog finds them both.
> 
> -----
> Second time around:
> 1.COPY IMAGES TO IMAGES
> 2.COPY TEMPLATES TO TEMPLATES
> 3.COPY contents of WIKIATTACHMENT & WIKIPAGES FOLDERS TO WIKIATTACHMENT &
> WIKIPAGES FOLDERS
> 
> restart computer, tomcat and app

There was a document on jspwiki.org that outlined how to install multiple 
instance of jspwiki on one server.  I used this to install my wiki and have 
found it easy to do upgrades. ( can't find my original page but here is a link 
to the current multiwiki outline http://jspwiki.org/wiki/MultipleWikis)

so my setup is like this (I am not an expert at this, this just happens to be 
the way I do it)

I have a debian amd64 box, sun jre 1.5.0_11, tomcat 5.5.17.  The former as a 
deb package and the later as a local install from tgz (don't like the way 
debian have package tomcat so)

my tomcat base is at 

CATALINA_HOME='/usr/local/lib/tomcat/tomcat'                                                                                                   
CATALINA_BASE=${CATALINA_BASE:-$CATALINA_HOME}                                                                                                 


I have placed in conf/Catalina/localhost Wiki.xml (I call my JSPWiki just Wiki)

contents
<Context path="/Wiki" docBase="/exports/jspwiki/Wiki/JSPWiki.war" debug="0">
  <Parameter name="jspwiki.propertyfile"
	value="/exports/jspwiki/Wiki/conf/jspwiki.properties"
	override="false"/>
</Context>

I have created a directory structure for all the dynamic stuff of jspwiki 
outside of the tomcat area

/exports/jspwiki - is where all the jspwiki stuff is
/exports/jspwiki/Wiki - is a particular instance of a wiki
	this is where I keep built war files
directories attachments
conf - all the configuration information ( jspwiki.properties )
log - log directory
pageDir - page directory
security - security information - group and user DB .xml files ( i use 
container authentication.
tmp - tmp dir just for this instance - the lucent stuff goes here

A caveat of this though is I build my own war files - including my own plugins 
and changes to the jaas/policy file

Janne/[tomcat expert?] I presume I can set where the tomcat looks for the jaas 
and policy files in the above Wiki.xml file ?



My procedure for upgrading is to shutdown tomcat (because 1) i don't know how 
to undeploy from the command line. 2) the problem with jspwiki not shutting 
down cleanly ) drop a new war file in /exports/jspwiki/Wiki/JSPWiki.war, Just 
to safe I rm -fr work/Catalina webapps/Wiki/ - I have had times when tomcat 
hasn't fully synchronized.  Then restart tomcat.

Benefits I don;t have to worry about accidentally undeploying the JSPWiki, nor 
do I have to worry about upgrading tomcat, my jspwiki stuff in kept in a 
completely separate area.  All though I have full access to the machine



> 
> ...............
> I'll add this to the wiki if I don't hear any protest from anyone
> 
> On 9/18/07, Janne Jalkanen <[email protected]> wrote:
> >
> > Hi ho folks!
> >
> > I have just released JSPWiki 2.4.104, which contains important
> > security fixes.  Upgrading is recommended to everyone.  Here is the
> > ChangeLog:
> >
> > 2007-09-13  Janne Jalkanen <[email protected]>
> >
> >          * 2.4.104
> >
> >          * Fixes several XSS vulnerabilities in Diff, PageInfo,
> >          Edit, Comment, Login, NewGroup, UserProfile and EditGroup.
> >          Thanks heaps to Jason Katzer for finding these!
> >
> >          * Fixed a local path disclosure vulnerability in attachments.
> >          Thanks also to Jason Katzer!
> >
> > JSPWiki 2.5.139-beta, also just released, contains the above fixes as
> > well, in addition for a couple of new ones.  Folks, don't forget to
> > escape your output!
> >
> > /Janne
> > _______________________________________________
> > This is the Jspwiki-users mailing list, in which we discuss the
> > stable release (even-numbered, 2.4.x, 2.6.x), and user-issues.
> > For development discussion, please join jspwiki-dev.
> > http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
> > http://www.jspwiki.org/JSPWikiMailingList
> >
> _______________________________________________
> This is the Jspwiki-users mailing list, in which we discuss the 
> stable release (even-numbered, 2.4.x, 2.6.x), and user-issues. 
> For development discussion, please join jspwiki-dev.
> http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
> http://www.jspwiki.org/JSPWikiMailingList
>