Re: [Fwd: [Mason] patch for task 294: support exec/subexec("comp:method")]

Dave Rolsky wrote:
> On Sun, 21 May 2006, Zach Welch wrote:
> 
>> I suppose it's too late for 1.33, but I posted this patch and never 
>> saw any reply to it. I am using it in (light) production, so I would 
>> at least like to hear a reply as to why it was not considered. I 
>> suppose "because you posted it to the user's list" is valid, too.
> 
> 
> Actually, the reasons are probably more like:
> 
> A) It's a long message, and I'm lazy ;)

Hrmph. You are not alone with that disposition. :/ I'm fairly convinced
that this shows there can be no such thing as the perfect bug report.

If a post too short, one skips it for lacking sufficient details; if it
is too long, no one ever reads it in the first place. Further, it seems
that trimming a long message ends up making it too short, and adding
details to a short message makes it too long. If it is even possible, I
just can't find a way to win. :)

> B) The patch has no tests or docs, which means incorporating it is more 
> work for me.

I tried to imply these deficiencies, but I can fix them - with feedback.
My writing should show that adequate documentation will not be a
problem, once the system reaches a state where it justifies such work.
The tests also require the perspective that your feedback is giving me.

> But looking at it more closely, I suspect it's not something we want to 
> do, because then someone could call component methods directly via a 
> URI. While we've never said so in the docs, I think the implication has 
> always been that these should not be exposed via the web, unless someone 
> wanted to really go to the trouble of writing code that lets them do that.

Eeek. :) It took me a few tries, but yeah, this is bad. This is why I
sent it to the list for review; I thought there might be stuff I missed.
Well, I am glad that I have held off deploying it publicly.

This might be avoided by adding an check in the proper exec method, if I
recall correctly. In other words, only the top-level (i.e. exec) request
would need to be checked for this pre-condition. Really, I only need the
subexec, so I completely agree that an additional fix will be required.

I am ready to do what it takes to get this included, so give me the
proper direction and I'll get it done to your specification. Still, I
know we're now talking 1.34, so I guess you're off the hook for now. ;)
I'll try to come up with a patch myself, but you may have further
insight that can make my life a little easier.

Cheers,

Zach


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642