Change Log ================================================================================ .. tabularcolumns:: |p{0.15\linewidth}|p{0.25\linewidth}|p{0.60\linewidth}| .. list-table:: :header-rows: 1 :widths: 15 25 60 * - Modified on - Modified locations - Modification details * - 2015-08-05 - \- - Released "5.0.1 RELEASE" version * For update details, refer to \ `Issue list of 5.0.1 `_\ * - - Overall modifications - Fixed guideline errors (corrected typos, mistakes in description, etc.) * For modification details, refer to \ `Issue list of 5.0.1 (clerical error) `_\ Improved the description * For improvement details, \ `Issue list of 5.0.1 (improvement) `_\ Fixed the description about application server * Removed the description for the Resin * Updated the link of reference page * - - :doc:`index` - Added the description * Added description about tested environments for contents described in this guideline * - - :doc:`../Overview/FrameworkStack` - Updated the OSS version(Spring IO Platform version) to protect security vulnerability * Spring IO Platform version updated to 1.1.3.RELEASE * Spring Framework version updated to 4.1.7.RELEASE (\ `CVE-2015-3192 `_\ ) * JSTL version updated to 1.2.5 (\ `CVE-2015-0254 `_\ ) Updated the OSS version by the Spring IO Platform version update * Updated the OSS version to be used. For update details, refer to \ `Migration guide of version 5.0.1 `_\ Improved the description (\ `guideline#1148 `_\ ) * Added the description of \ ``terasoluna-gfw-recommended-dependencies``\ ,\ ``terasoluna-gfw-recommended-web-dependencies``\ and \ ``terasoluna-gfw-parent``\ * Modified the description for some project * Added the illustration to indicate project dependencies * - - :doc:`../ImplementationAtEachLayer/CreateWebApplicationProject` - Added the description * Added how to build a war file (\ `guideline#1146 `_\ ) * - - :doc:`../ArchitectureInDetail/DataAccessCommon` - Added the description * Added the description of \ ``DataSource``\ switching functionality (\ `guideline#1071 `_\ ) * - - :doc:`../ArchitectureInDetail/DataAccessMyBatis3` - Fixed the guideline bug * Modified the description about timing of batch execution (\ `guideline#903 `_\ ) * - - :doc:`../ArchitectureInDetail/Logging` - Improved the description * Added the description about \ ``additivity``\ attribute of \ ````\ tag (\ `guideline#977 `_\ ) * - - :doc:`../ArchitectureInDetail/SessionManagement` - Improved the description * Modified the description about how to define a session scope bean (\ `guideline#1082 `_\ ) * - - :doc:`../ArchitectureInDetail/DoubleSubmitProtection` - Added the description * Added the description about the transaction token check in case that response cache is disabled (\ `guideline#1260 `_\ ) * - - :doc:`../ArchitectureInDetail/Codelist` - Added the description * Added how to display a code name (\ `guideline#1109 `_\ ) * - - | :doc:`../ArchitectureInDetail/Ajax` | :doc:`../ArchitectureInDetail/REST` - Added the warning about \ `CVE-2015-3192 `_\ (XML security vulnerability) * Added the warning at the time of the StAX(Streaming API for XML) use (\ `guideline#1211 `_\ ) * - - | :doc:`../ArchitectureInDetail/Pagination` | :doc:`../Appendix/TagLibAndELFunctions` - Modified in accordance with bug fixes of common library * Modified the description about \ ``f:query``\ specification , in accordance with bug fixes of common library (\ `terasoluna-gfw#297 `_\ ) (\ `guideline#1244 `_\ ) * - - :doc:`../Security/Authentication` - Improved the description * Added the notes about handling with some properties of parent class of \ ``ExceptionMappingAuthenticationFailureHandler``\ (\ `guideline#812 `_\ ) * Modified the setting example for the \ ``requiresAuthenticationRequestMatcher``\ property of \ ``AbstractAuthenticationProcessingFilter``\ (\ `guideline#1110 `_\ ) * - - :doc:`../Security/Authorization` - Fixed the guideline bug * Modified the setting example for the \ ``access``\ attribute of \ ````\ tag (JSP tag library) (\ `guideline#1003 `_\ ) * - - :doc:`../Appendix/EnvironmentIndependency` - Added the description * Added how to apply the external classpath(alternative functionality of \ ``VirtualWebappLoader``\ of Tomcat7) at the time of Tomcat8 use (\ `guideline#1081 `_\ ) * - 2015-06-12 - Overall modifications - Released English version of "5.0.0 RELEASE" * - 2015-02-23 - \- - Released "5.0.0 RELEASE" version * For update details, refer to \ `Issue list of 5.0.0 `_\ and \ `Backport issue list of 1.0.2 `_\ . * - - Overall modifications - Fixed guideline errors (corrected typos, mistakes in description, etc.) * For modification details, refer to \ `Backport issue list of 1.0.2 (clerical error) `_\ . Improved the description * For improvement details, refer to \ `Issue list of 5.0.0 (improvement) `_\ and \ `Backport issue list of 1.0.2 (improvement) `_\ . Added new * :doc:`../ImplementationAtEachLayer/CreateWebApplicationProject` * :doc:`../ArchitectureInDetail/DataAccessMyBatis3` * :doc:`../Appendix/TagLibAndELFunctions` * :doc:`../Appendix/Lombok` Updated in accordance with version 5.0.0 * Deleted MyBatis2 * - - :doc:`../Overview/FrameworkStack` - Spring IO Platform compatible * Added a point that except for some libraries, the management of recommended libraries is changed to a structure delegating it to Spring IO Platform. Updated the OSS version * Updated the OSS version to be used. For update details, refer to \ `Migration guide of version 5.0.0 `_\ . * - - :doc:`../Overview/FirstApplication` - Updated in accordance with version 5.0.0 * Used Spring Framework 4.1 * Reviewed structure of document. * - - :doc:`../Overview/ApplicationLayering` - Fixed bugs in English translation. * Fixed translation bugs related to domain layer and other layers. For modification details, refer to \ `guideline#364 issue `_\ . * - - :doc:`../TutorialTodo/index` - Updated in accordance with version 5.0.0 * Use of Spring Framework 4.1. * MyBatis3 support as infrastructure layer. * Revised document structure. * - - :doc:`../ImplementationAtEachLayer/CreateWebApplicationProject` - Added new * Added a method to create a project having multi project structure * - - :doc:`../ImplementationAtEachLayer/DomainLayer` - Modified in accordance with Spring Framework 4.1 * Added description about handling \ ``@Transactional``\ of JTA 1.2. For modification details, refer to \ `guideline#562 issue `_\ . * Modified description about handling \ ``@Transactional(readOnly = true)``\ when using JPA (Hibernate implementation). With \ `SPR-8959 `_\ (Spring Framework 4.1 and later versions) support, it has been improved so that instruction can be given so as to handle as "Read-only transactions" for JDBC driver. Added description * Added notes regarding the cases where "Read-only transactions" are not enabled. For added contents, refer to \ `guideline#861 issue `_\ . * - - :doc:`../ImplementationAtEachLayer/InfrastructureLayer` - Modified in accordance with MyBatis3 * Added a method to use MyBatis3 mechanism as implementation of RepositoryImpl. * - - :doc:`../ImplementationAtEachLayer/ApplicationLayer` - Modified in accordance with Spring Framework 4.1 * Added description about the attribute (attribute to filter the Controllers to be used) added in \ ``@ControllerAdvice``\ . For modification details, refer to \ `guideline#549 issue `_\ . * Added description about \ ````\ . For modification details, refer to \ `guideline#609 issue `_\ . * - - :doc:`../ArchitectureInDetail/DataAccessCommon` - Modified in accordance with bug fixes of common library * Added description about handling double byte wild card characters (\ ``%``\ , \ ``_``\)\ , in accordance with bug fixes of common library (\ `terasoluna-gfw#78 `_\ ). For modification details, refer to \ `guideline#712 issue `_\ . Modified in accordance with Spring Framework 4.1 * Removed the description about the problem where pessimistic locking error of JPA (Hibernate implementation) is not converted into \ ``PessimisticLockingFailureException``\ of Spring Framework. This problem is resolved in \ `SPR-10815 `_\ (Spring Framework 4.0 and later versions). Modified in accordance with Apache Commons DBCP 2.0 * Changed the sample code and its description to use component for Apache Commons DBCP 2.0. * - - :doc:`../ArchitectureInDetail/DataAccessMyBatis3` - Added new * Added method to implement an infrastructure layer using MyBatis3 as O/R Mapper. * - - :doc:`../ArchitectureInDetail/ExclusionControl` - Fixed guideline bugs * Modified the sample code of optimistic locking of long transactions (processing when records cannot be fetched). For modification details, refer to \ `guideline#450 issue `_\ . Modified in accordance with Spring Framework 4.1 * Removed the description about the problem where pessimistic locking error of JPA (Hibernate implementation) is not converted into \ ``PessimisticLockingFailureException``\ of Spring Framework. This problem is resolved in \ `SPR-10815 `_\ (Spring Framework 4.0 and later versions). Modified in accordance with MyBatis3 * Added methods to implement exclusive control when using MyBatis3. * - - :doc:`../ArchitectureInDetail/Validation` - Fixed guideline bugs * Modified the description of \ ``@GroupSequence``\ . For modification details, refer to \ `guideline#296 issue `_\ . Modified in accordance with bug fixes of common library * Added notes about \ ``ValidationMessages.properties``\ , in accordance with bug fixes of common library (\ `terasoluna-gfw#256 `_\ ). For modification details, refer to \ `guideline#766 issue `_\ . Added description * Added a method to link with the mechanism of Group Validation of Bean Validation at the time of correlated item check using Spring Validator. For added contents, refer to \ `guideline#320 issue `_\ . Modified in accordance with Bean Validation 1.1 (Hibernate Validator 5.1) * Added description about \ ``inclusive``\ attribute of \ ``@DecimalMin``\ and \ ``@DecimalMax``\ . * Added description about Expression Language. * Described about deprecated API from Bean Validation 1.1. * Added description about a bug related to \ ``ValidationMessages.properties``\ of Hibernate Validator 5.1.x (\ `HV-881 `_\ ) and methods to prevent the same. * - - :doc:`../ArchitectureInDetail/ExceptionHandling` - Added description * Added a description that simple error page is likely to be displayed in Internet Explorer when an error having size lesser than 513 bytes is sent as response. For added contents, refer to \ `guideline#189 issue `_\ . Modified in accordance with Spring Framework 4.1 * Removed the description about the problem where pessimistic locking error of JPA (Hibernate implementation) is not converted into \ ``PessimisticLockingFailureException``\ of Spring Framework. This problem is resolved in \ `SPR-10815 `_\ (Spring Framework 4.0 and later versions). * - - :doc:`../ArchitectureInDetail/SessionManagement` - Modified in accordance with Spring Security 3.2 * Removed the description about a problem where CSRF token error occurs (\ `SEC-2422 `_\ ) instead of session time out at the time of POST request. A mechanism to detect session time out is included in formal version of Spring Security 3.2, hence the problem is resolved. * - - :doc:`../ArchitectureInDetail/MessageManagement` - Reflected changes of common library * Added description about newly added message type (warning) and deprecated messages types (warn), in accordance with the improvement of common library (\ `terasoluna-gfw#24 `_\ ). For modification details, refer to \ `guideline#74 issue `_\ . * - - :doc:`../ArchitectureInDetail/Pagination` - Reflected changes of common library * Changed description of page link in active state, in accordance with the improvement of common library (\ `terasoluna-gfw#13 `_\ ). For modification details, refer to \ `guideline#699 issue `_\ . * Changed description of page link in disabled state, in accordance with the improvement of common library (\ `terasoluna-gfw#14 `_\ ). For modification details, refer to \ `guideline#700 issue `_\ . Modified in accordance with Spring Data Common 1.9 * Added notes for the classes where API specifications (\ ``Page``\ interface, etc.) are changed due to version upgrade. * - - :doc:`../ArchitectureInDetail/Codelist` - Modified in accordance with bug fixes of common library * Added notes about version upgrade and changing message key of \ ``ExistInCodeList``\ in accordance with bug fixes of common library (\ `terasoluna-gfw#16 `_\ ). For modification details, refer to \ `guideline#638 issue `_\ . * Added notes about message definition of \ ``@ExistInCodeList``\ in accordance with bug fixes of common library (\ `terasoluna-gfw#256 `_\ ). For modification details, refer to \ `guideline#766 issue `_\ . Reflected changes of common library * Added a method to use \ ``EnumCodeList``\ class in accordance with addition of common library functions (\ `terasoluna-gfw#25 `_\ ). * - - :doc:`../ArchitectureInDetail/Ajax` - Modified in accordance with Spring Security 3.2 * Changed the sample code for CSRF measures (method to create \ ````\ tag for CSRF measures). Modified in accordance with Jackson 2.4 * Changed the sample code and description to use components for Jackson 2.4. * - - :doc:`../ArchitectureInDetail/REST` - Improvement in description * Improve the method to build an URL to be set in location header and hypermedia link. For improvement details, refer to \ `guideline#374 issue `_\ . Modified in accordance with Spring Framework 4.1 * Added a description about \ ``@RestController``\ . For modification details, refer to \ `guideline#560 issue `_\ . * Changed the sample code to create \ ``ResponseEntity``\ using builder style API. Modified in accordance with Jackson 2.4 * Changed the sample code and description to use components for Jackson 2.4. Modified in accordance with Spring Data Common 1.9 * Added notes for the classes where API specifications (\ ``Page``\ interface, etc.) are changed due to version upgrade. * - - :doc:`../ArchitectureInDetail/FileUpload` - Fixed guideline bugs * Modified version of Apache Commons FileUpload with resolved \ `CVE-2014-0050 `_\ (File Upload vulnerabilities). For modification details, refer to \ `guideline#846 issue `_\ . Added description * File upload function of Servlet 3 has a problem of garbled characters on a part of application server. Therefore, added a method to use Apache Commons FileUpload as a measure to prevent this event. For added contents, refer to \ `guideline#778 issue `_\ . * - - :doc:`../ArchitectureInDetail/SystemDate` - Reflected changes of common library * Changed document structure, package name and class name in accordance with the improvement of common library (\ `terasoluna-gfw#224 `_\ ). For modification details, refer to \ `guideline#701 issue `_\ . * - - :doc:`../ArchitectureInDetail/TilesLayout` - Modified in accordance with Tiles 3.0 * Changed the example of settings and description to use component for Tiles 3.0. Modified in accordance with Spring Framework 4.1 * Added description about \ ````\ , \ ````\ , \ ````\ . For modification details, refer to \ `guideline#609 issue `_\ . * - - :doc:`../ArchitectureInDetail/Utilities/JodaTime` - Added description * Added method to use \ ``LocalDateTime``\ . For added contents, refer to \ `guideline#584 issue `_\ . Modified in accordance with Joda Time 2.5 * Since \ ``DateMidnight``\ class is deprecated in accordance with version upgrade, changed the method to fetch start time of specific date (0:00:00.000). * - - :doc:`../Security/SpringSecurity` - Modified in accordance with Spring Security 3.2 * Added "Settings to create secure HTTP header" in appendix. * - - :doc:`../Security/Tutorial` - Updated in accordance with version 5.0.0 * Made changes so as to use MyBatis3 as infrastructure layer. * Applied Spring Framework 4.1 * Applied Spring Security 3.2 * Revised document structure. * - - :doc:`../Security/Authentication` - Fixed guideline bugs * Modified the erroneous and inadequate description of \ ````\ , \ ````\ , \ ````\ tag. For modification details, refer to \ `guideline#754 issue `_\ . * Modified the sample code that indicates extension method of AuthenticationFilter (added settings to validate CSRF measures and session fixation attack measures). For details, refer to \ `guideline#765 issue `_\ . Modified in accordance with Spring Security 3.2 * Added notes about logout method when CSRF measures are validated. * Added description of \ ``@AuthenticationPrincipal``\ , as a method to access \ ``UserDetails``\ (authentication user information class) from Controller. * Added description of \ ``changeSessionId``\ , as parameters of \ ``session-fixation-protection``\ attribute of \ ````\ . * Added methods to detect session time-out and notes for same. * Changed setting method to validate concurrent session control of identical users (made changes so as to use \ ````\ ). * Added a point that a class of concurrent session control of identical users is deprecated and other class is provided. * - - :doc:`../Security/CSRF` - Modified in accordance with Spring Security 3.2 * Removed description about the component for CSRF measures of Spring Security 3.2.0 (provisional version before formal release) included in common library of version 1.0.x. * Changed setting method to validate CSRF measures by a proper method of Spring Security 3.2 (method using \ ````\ ). * Added description about JSP tag library (\ ````\ and \ ````\ ) for CSRF measures. * Added methods to detect session time-out and precautions when CSRF measures are validated. Modified in accordance with Spring Framework 4.1 * Changed description about the condition where CSRF token is output as hidden, when \ ````\ is used. * - - :doc:`../TutorialREST/index` - Improved the description * Changed to the contents that do not depend on specific infrastructure layer (O/R Mapper), by adding REST API in the project created in \ :doc:`../TutorialTodo/index`\ . For modification details, refer to \ `guideline#325 issue `_\ . Updated in accordance with version 5.0.0 * Applied Spring Framework 4.1. * Applied Spring Security 3.2. * Applied Jackson 2.4. * - - :doc:`../Appendix/CreateProjectFromBlank` - Improved the description * Supported method to create a project having multi project structure. * Updated the method to create a project having single project structure. * - - :doc:`../Appendix/TagLibAndELFunctions` - Added new * Added description about EL functions and JSP tag libraries provided by common libraries. * - - :doc:`../Appendix/Lombok` - Added new * Added description about how to remove a boilerplate code where Lombok is used. * - - English version - Added English version of the following. * :doc:`../ImplementationAtEachLayer/CreateWebApplicationProject` * :doc:`../ArchitectureInDetail/DataAccessCommon` * :doc:`../ArchitectureInDetail/DataAccessJpa` * :doc:`../ArchitectureInDetail/DataAccessMyBatis3` * :doc:`../ArchitectureInDetail/ExclusionControl` * :doc:`../ArchitectureInDetail/Logging` * :doc:`../ArchitectureInDetail/PropertyManagement` * :doc:`../ArchitectureInDetail/Pagination` * :doc:`../ArchitectureInDetail/DoubleSubmitProtection` * :doc:`../ArchitectureInDetail/Internationalization` * :doc:`../ArchitectureInDetail/Codelist` * :doc:`../ArchitectureInDetail/Ajax` * :doc:`../ArchitectureInDetail/REST` * :doc:`../ArchitectureInDetail/FileUpload` * :doc:`../ArchitectureInDetail/FileDownload` * :doc:`../ArchitectureInDetail/TilesLayout` * :doc:`../ArchitectureInDetail/SystemDate` * :doc:`../ArchitectureInDetail/Utilities/Dozer` * :doc:`../Security/SpringSecurity` * :doc:`../Security/Authentication` * :doc:`../Security/PasswordHashing` * :doc:`../Security/Authorization` * :doc:`../Security/CSRF` * :doc:`../Appendix/CreateProjectFromBlank` * :doc:`../Appendix/Nexus` * :doc:`../Appendix/EnvironmentIndependency` * :doc:`../Appendix/ProjectStructureStandard` * :doc:`../Appendix/Lombok` * :doc:`../Appendix/SpringComprehensionCheck` * - 2014-08-27 - \- - Released "1.0.1 RELEASE" version Refer to \ `Issue list of 1.0.1 `_\ for details. * - - Overall modifications - Fixed guideline bugs (corrected typos, mistakes in description etc.) Refer to \ `Issue list of 1.0.1 `_\ for details. * - - Japanese version - Added Japanese version of the following. * :doc:`CriteriaBasedMapping` * :doc:`../ArchitectureInDetail/REST` * :doc:`Tutorial (Todo Application for REST)<../TutorialREST/index>` * - - English version - Added English version of the following. * :doc:`index` * :doc:`../Overview/index` * :doc:`../TutorialTodo/index` * :doc:`../ImplementationAtEachLayer/index` * :doc:`../ArchitectureInDetail/Validation` * :doc:`../ArchitectureInDetail/ExceptionHandling` * :doc:`../ArchitectureInDetail/MessageManagement` * :doc:`../ArchitectureInDetail/utilities/JodaTime` * :doc:`../Security/XSS` * :doc:`../Appendix/ReferenceBooks` * - - :doc:`../Overview/FrameworkStack` - Updated the OSS version in accordance with bug fixes. * GroupId (\ ``org.springframework``\ ) updated to 3.2.10.RELEASE from 3.2.4.RELEASE * GroupId (\ ``org.springframework.data``\ )/ArtifactId(\ ``spring-data-commons``\ ) updated to 1.6.4.RELEASE from 1.6.1.RELEASE * GroupId (\ ``org.springframework.data``\ )/ArtifactId(\ ``spring-data-jpa``\ ) updated to 1.4.3.RELEASE from 1.4.1.RELEASE * GroupId (\ ``org.aspectj``\ ) updated to 1.7.4 from 1.7.3 * Deleted GroupId (\ ``javax.transaction``\ )/ArtifactId(\ ``jta``\ ) * - - :doc:`../ImplementationAtEachLayer/ApplicationLayer` - Added a warning about `CVE-2014-1904 `_\ (XSS Vulnerability of \ ``action``\ attribute in \ ````\ tag) * - - Japanese version :doc:`../ArchitectureInDetail/MessageManagement` - Added description about bug fix * Fixed bugs of \ ````\ tag of common library (\ `terasoluna-gfw#10 `_\ ) * - - Japanese version :doc:`../ArchitectureInDetail/Pagination` - Updated description about bug fix * Fixed bugs of \ ````\ tag of common library (\ `terasoluna-gfw#12 `_\ ) * Fixed bugs of Spring Data Commons (\ `terasoluna-gfw#22 `_\ ) * - - Japanese version :doc:`../ArchitectureInDetail/Ajax` - Updated description of countermeasures against XXE Injection * - - Japanese version :doc:`../ArchitectureInDetail/FileUpload` - Added a warning about `CVE-2014-0050 `_\ (File Upload Vulnerability) Fixed guideline bugs. * Added how to handle \ ``MultipartException``\ using error-page functionality of servlet container, because your application can't handle \ ``MultipartException``\ using \ ``SystemExceptionResolver``\ when used \ ``MultipartFilter``\ . Refer to \ `Issue of guideline#59 `_\ for details. * - 2013-12-17 - Japanese version - Released "1.0.0 Public Review" version .. raw:: latex \newpage