[1.2.x] Play1: version 1.2.5.5, 1.2.6.1, 1.2.7.21 1.3.1 released (XSS Vulnerability)

[Alex]

Hi all,

Some builds 1.2.5.5, 1.2.6.1, 1.2.7.2, with just the security fix and nothing else.

Play 1.3.1 contains the security fix and some others issues, features
The changes in this release are listed in the "Play 1.3.1 milestone":https://play.lighthouseapp.com/projects/57987-play-framework/milestones/208206-131 on Lighthouse, including 26 resolved tickets.
Play 1.3.1 is a maintenance release so it mostly contains bug fixes. The most important are:

* It was released to fix a vulnerability in play's URL builder (jsAction tag).
* Handle diacritics fro keys back into jsaction
* Fix Multidb configuration glitches
* c3p0 logging configuration for multiDB configuration
* Fix some exceptions in SSL mode server ssl
* yesno() evaluates NullObject as true
* Add optional parameter in script / stylesheet tags to define a custom path
* Add ability to enable some kind off test in test mode

Play can be downloaded from here:

* Play 1.2.5.5 http://downloads.typesafe.com/play/1.2.5.5/play-1.2.5.5.zip
* Play 1.2.6.1 http://downloads.typesafe.com/play/1.2.6.1/play-1.2.6.1.zip
* Play 1.2.7.2 http://downloads.typesafe.com/play/1.2.7.2/play-1.2.7.2.zip
* Play 1.3.1  http://downloads.typesafe.com/play/1.3.1/play-1.3.1.zip


Thanks,

Alex

[Gilberto Pederiva]

Thanks.

--
You received this message because you are subscribed to the Google Groups "play-framework" group.
To unsubscribe from this group and stop receiving emails from it, send an email to play-framewor...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Grzegorz Slowikowski]

Hi

What is the new 'console' module for?

Regards

Grzegorz Slowikowski

--

[Odilio Noronha]

thanks, great job guys

[Scott Rippee]

Hi,

Does the 1.2.7.2 tag in github have the fix? I don't see it in the commit log.

https://github.com/playframework/play1/tree/1.2.7.2

I'm looking to merge the fix into my fork of the 1.2.7.1 release.

[Alex]

Hi Scott,

   The 1.2.7.2 tag has it, fix was done in the  PR 866 * fix(router): make some improvement in router.
So if you want to merge it, look at all commit on  Apr 27, 2015

Cheers

Alex

[Alex]

Hi Grzegorz ,

 there is no new module console, it was there for 5 years now.

Cheers

Alex

[Grzegorz Slowikowski]

Hi Alex

I asked wrong question. The 'console' module was in the repo for years, but was never released till 1.3.0.

I found more problems with the distributions:

- missing: 'documentation/api', 'modules/grizzly/documentation/api' and 'modules/testrunner/documentation/api'

- garbage: '.gitignore', '.travis.yml', '**/*.pyc'

These 'bugs' are in all releases since 1.3.0: (1.3.0, 1.2.5.5, 1.2.6.1, 1.2.7.2, 1.3.1). It seems you are not generating distribution archive with 'ant dist' command (in 'framework' directory). 'dist' target excludes e.g. 'console' module and all '*.pyc' files.

I'm publishing Play! as Maven artifacts (http://repo1.maven.org/maven2/com/google/code/maven-play-plugin/org/playframework/) so I need 'perfect' distribution. Now I don't know for example if I should generate 'documentation/api' javadocs myself or just ignore this difference between latest and older releases.

From my point of view the best way would be to regenerate (with 'and dist') and republish all latest distributions. Is it possible or is it too late?

Regards

Grzegorz Slowikowski

[Alex]

Hi
I will add the missing documentation/api, but reagrding modules/grizzly/ "documentation/api' and 'modules/testrunner/

documentation/api', they were never release before, I didn't see it in 1.2.5

Or did I miss something?

[Grzegorz Slowikowski]

You are right. Sorry, ignore these two, I'm generating them in my local Maven builds.

BTW, why versions 1.2.5.4 and 1.2.7.1 were not releases. There are tags in repo, but no distributions for download.

Grzegorz

[Grzegorz Słowikowski]

Hi

All new versions mavenized and ready for use with Maven plugin for Play!
Framework 1.x (https://code.google.com/p/maven-play-plugin/)

Grzegorz Slowikowski

> --
> You received this message because you are subscribed to the Google
> Groups "play-framework" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to play-framewor...@googlegroups.com

> <mailto:play-framewor...@googlegroups.com>.