[maven-release-plugin] prepare release STRUTS_2_5_32

Uses proper maven version
Uses latest maven version supporting Java 7
2026-08-07 23:57:03 +00:00 · 2023-09-11 08:17:13 +02:00 · 2023-09-06 19:33:48 +02:00 · 2023-09-06 19:30:52 +02:00 · 2023-09-03 08:52:11 +02:00 · 2023-06-13 10:05:14 +02:00
211 changed files with 6773 additions and 1290 deletions
@@ -9,8 +9,8 @@ pipeline {
    disableConcurrentBuilds()
  }
  tools {
-    jdk 'JDK 1.7 (latest)'
-    maven 'Maven 3 (latest)'
+    jdk 'jdk_1.7_latest'
+    maven 'maven_3.8.7'
  }
  triggers {
    pollSCM 'H/15 * * * *'
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>
    <artifactId>struts2-apps</artifactId>
    <packaging>pom</packaging>
@@ -24,12 +24,12 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>

    <artifactId>struts2-rest-showcase</artifactId>
    <packaging>war</packaging>
-    <version>2.5.23</version>
+    <version>2.5.32</version>
    <name>Struts 2 Rest Showcase Webapp</name>
    <description>Struts 2 Rest Showcase Example</description>

@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-apps</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>

    <artifactId>struts2-showcase</artifactId>
@@ -22,12 +22,12 @@ ${parameters.after!}<#t/>
    </td><#lt/>
 </tr>
 <#if (parameters.errorposition!"top") == 'bottom'>
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
 <tr errorFor="${parameters.id}">
    <td class="tdErrorMessage" colspan="2"><#rt/>
        <#if hasFieldErrors>
-            <#list fieldErrors[parameters.name] as error>
+            <#list fieldErrors.get(parameters.name) as error>
                <div class="errorMessage">${error?html}</div><#t/>
            </#list>
        </#if>
@@ -21,29 +21,29 @@
 <#--
 	Always include elements to show errors. They may be filled later via AJAX.
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if (parameters.errorposition!"top") == 'top'>
 <tr errorFor="${parameters.id}">
    <td class="tdErrorMessage" colspan="2" data-error-for-fieldname="${parameters.name}"><#rt/>
        <#if hasFieldErrors>
-            <#list fieldErrors[parameters.name] as error>
+            <#list fieldErrors.get(parameters.name) as error>
                <div class="errorMessage">${error?html}</div><#t/>
            </#list>
        </#if>
    </td><#lt/>
 </tr>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelpos = parameters.labelPosition/>
 </#if>
 <#--
 	if the label position is top,
 	then give the label it's own row in the table
 -->
 <tr>
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
    <td class="tdLabelTop" colspan="2"><#rt/>
 <#else>
    <td class="tdLabel"><#rt/>
@@ -72,7 +72,7 @@ ${parameters.labelseparator!":"?html}<#t/>
 </#if>
    </td><#lt/>
 <#-- add the extra row -->
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
 </tr>
 <tr>
 </#if>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>

    <artifactId>struts2-assembly</artifactId>
@@ -30,7 +30,7 @@
    </parent>

    <artifactId>struts2-bom</artifactId>
-    <version>2.5.23</version>
+    <version>2.5.32</version>
    <packaging>pom</packaging>

    <name>Struts 2 Bill of Materials</name>
@@ -45,7 +45,7 @@
    </licenses>

    <properties>
-        <struts-version.version>2.5.23</struts-version.version>
+        <struts-version.version>2.5.32</struts-version.version>
        <maven.site.skip>true</maven.site.skip>
        <maven.site.deploy.skip>true</maven.site.deploy.skip>
    </properties>
@@ -181,6 +181,9 @@
    </dependencyManagement>

  <scm>
-    <tag>STRUTS_2_5_23</tag>
+    <tag>STRUTS_2_5_32</tag>
+    <connection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</connection>
+    <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/struts.git</developerConnection>
+    <url>https://github.com/apache/struts/</url>
  </scm>
 </project>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>

    <artifactId>struts2-osgi-admin-bundle</artifactId>
@@ -60,6 +60,9 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
    }

    public String start() throws BundleException {
+        clearErrorsAndMessages();
+        addActionMessage("Start - OSGi Host: " + osgiHost + ", ID: " + id);
+
        Bundle bundle = osgiHost.getBundles().get(id);
        try {
            bundle.start();
@@ -69,29 +72,35 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
            //there no easy way/elegant way to know if the bundle was processed already
            Thread.sleep(1000);
        } catch (Exception e) {
-            addActionError(e.toString());
+            addActionError("Exception: " + e.toString() + " (" + e.getMessage() + ")");
        }

        return view();
    }

    public String stop() throws BundleException {
+        clearErrorsAndMessages();
+        addActionMessage("Stop - OSGi Host: " + osgiHost + ", ID: " + id);
+
        Bundle bundle = osgiHost.getBundles().get(id);
        try {
            bundle.stop();
        } catch (Exception e) {
-            addActionError(e.toString());
+            addActionError("Exception: " + e.toString() + " (" + e.getMessage() + ")");
        }

        return view();
    }

    public String update() throws BundleException {
+        clearErrorsAndMessages();
+        addActionMessage("Update - OSGi Host: " + osgiHost + ", ID: " + id);
+
        Bundle bundle = osgiHost.getBundles().get(id);
        try {
            bundle.update();
        } catch (Exception e) {
-            addActionError(e.toString());
+            addActionError("Exception: " + e.toString() + " (" + e.getMessage() + ")");
        }

        return view();
@@ -114,13 +123,14 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
    }

    public List<PackageConfig> getPackages() {
-        List<PackageConfig> pkgs = new ArrayList<PackageConfig>();
+        List<PackageConfig> pkgs = new ArrayList<>();
        Bundle bundle = getBundle();
        if (bundle.getState() == Bundle.ACTIVE) {
            for (String name : bundleAccessor.getPackagesByBundle(bundle)) {
                PackageConfig packageConfig = configuration.getPackageConfig(name);
-                if (packageConfig != null)
+                if (packageConfig != null) {
                    pkgs.add(packageConfig);
+                }
            }
        }
        return pkgs;
@@ -133,13 +143,14 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
    public Collection<Bundle> getBundles() {
        List<Bundle> bundles = new ArrayList(osgiHost.getBundles().values());
        Collections.sort(bundles, new Comparator<Bundle>() {
+            @Override
            public int compare(Bundle bundle1, Bundle bundle2) {
                boolean bundle1StrutsEnabled = isStrutsEnabled(bundle1);
                boolean bundle2StrutsEnabled = isStrutsEnabled(bundle2);

-                if ((bundle1StrutsEnabled && bundle2StrutsEnabled) || (!bundle1StrutsEnabled && !bundle2StrutsEnabled))
+                if ((bundle1StrutsEnabled && bundle2StrutsEnabled) || (!bundle1StrutsEnabled && !bundle2StrutsEnabled)) {
                    return bundle1.getSymbolicName().compareTo(bundle2.getSymbolicName());
-                else {
+                } else {
                    return bundle1StrutsEnabled ? -1 : 1;
                }
            }
@@ -172,7 +183,7 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
        try {
            state = bundle.getState();
        } catch (Exception e) {
-            addActionError("Unable to determine bundle state: " + e.getMessage());
+            addActionError("Unable to determine bundle state.  Exception: " + e.toString() + " (" + e.getMessage() + ")");
            return false;
        }

@@ -181,8 +192,7 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
        } else if ("stop".equals(val)) {
            return state == Bundle.ACTIVE;
        } else if ("update".equals(val)) {
-            return state == Bundle.ACTIVE || state == Bundle.INSTALLED
-                    || state == Bundle.RESOLVED;
+            return state == Bundle.ACTIVE || state == Bundle.INSTALLED || state == Bundle.RESOLVED;
        }
        throw new IllegalArgumentException("Invalid state");
    }
@@ -197,6 +207,7 @@ public class BundlesAction extends ActionSupport implements ServletContextAware
        this.bundleAccessor = bundleAccessor;
    }

+    @Override
    public void setServletContext(ServletContext servletContext) {
        osgiHost = (OsgiHost) servletContext.getAttribute(StrutsOsgiListener.OSGI_HOST);
    }
@@ -24,20 +24,29 @@ package org.apache.struts2.osgi.admin.actions;
 import java.io.ByteArrayOutputStream;
 import java.io.PrintStream;

-import org.apache.struts2.osgi.DefaultBundleAccessor;
 import org.apache.felix.shell.ShellService;
+import org.apache.struts2.osgi.DefaultBundleAccessor;
+import org.apache.struts2.osgi.interceptor.BundleContextAware;
+import org.osgi.framework.Bundle;
+import org.osgi.framework.BundleContext;
 import org.osgi.framework.ServiceReference;

 import com.opensymphony.xwork2.Action;
 import com.opensymphony.xwork2.ActionSupport;

 /**
- * This action executes commands on the Felix Shell
+ * This action executes commands on the Felix Shell.
+ * 
+ * The action is BundleContextAware so that if the OSGi interceptor is used the BundleContext
+ * can be provided for configurations where the DefaultBundleAccessor is insufficient.
+ * 
 */
-public class ShellAction extends ActionSupport {
+public class ShellAction extends ActionSupport implements BundleContextAware {
    private String command;
    private String output;
+    private BundleContext bundleContext;

+    @Override
    public String execute() {
        // get service
        ByteArrayOutputStream outByteStream = new ByteArrayOutputStream();
@@ -52,7 +61,9 @@ public class ShellAction extends ActionSupport {
            outString = outByteStream.toString().trim();
            errString = errByteStream.toString().trim();
        } catch (Exception e) {
-            errString = e.getMessage();
+            outString = outByteStream.toString().trim();
+            errString = "Exception: " + e.toString() + " (" + e.getMessage() + ").  Output:" + outString +
+                        ".  Error: " + errByteStream.toString().trim();  // Full details for troubleshooting.
        } finally {
            outStream.close();
            errStream.close();
@@ -75,17 +86,58 @@ public class ShellAction extends ActionSupport {
    }

    public void executeCommand(String commandLine, PrintStream out, PrintStream err) throws Exception {
-        ShellService shellService = getShellService();
-        if (shellService != null)
+        ShellService shellService = getShellService(out);
+        if (shellService != null) {
+            out.println("Attempting to execute command: " + commandLine);
            shellService.executeCommand(commandLine, out, err);
+        }
        else
            err.println("Apache Felix Shell service is not installed");
    }

-    private ShellService getShellService() {
+    private ShellService getShellService(PrintStream out) {
        //bundle can be de-activated, so keeping a reference aorund is not a good idea
-        DefaultBundleAccessor bundleAcessor = DefaultBundleAccessor.getInstance();
-        ServiceReference ref = bundleAcessor.getServiceReference(ShellService.class.getName());
-        return (ShellService) bundleAcessor.getService(ref);
+        final DefaultBundleAccessor bundleAccessor = DefaultBundleAccessor.getInstance();
+        ServiceReference ref = (bundleAccessor != null ? bundleAccessor.getServiceReference(ShellService.class.getName()) : null);
+        //out.println("DefaultBundleAccessor: "  + bundleAcessor + ", ServiceReference [" + ShellService.class.getName() + "]: " + ref);  // No logger, for debugging only.
+
+        if (ref == null && this.bundleContext != null) {
+            // Depending on OSGi and Felix bundle configurations, the DefaultBundleAccessor may not be able to locate the ShellService.
+            // In such cases, use the bundleContext (if available) to locate the ShellService in a "brute-force" manner.
+            final Bundle[] bundles = this.bundleContext.getBundles();
+            if (bundles != null && bundles.length > 0) {
+                for (Bundle currentBundle : bundles) {
+                    if (currentBundle != null) {
+                        //out.println("Bundle [" + index + "], SymbolicName: " + currentBundle.getSymbolicName() + ", Location: " + currentBundle.getLocation() + ", BundleID: " + currentBundle.getBundleId());  // No logger, for debugging only.
+                        if (currentBundle.getSymbolicName().startsWith("org.apache.felix.shell")) {
+                            BundleContext currentBundleContext = currentBundle.getBundleContext();
+                            Object directShellServiceByClass = (currentBundleContext != null ? currentBundleContext.getServiceReference(org.apache.felix.shell.ShellService.class) : null);
+                            Object directShellServiceByName = (currentBundleContext != null ? currentBundleContext.getServiceReference("org.apache.felix.shell.ShellService") : null);
+                            //out.println("    ShellService reference (via bundle's context) by class: " + directShellServiceByClass);  // No logger, for debugging only.
+                            //out.println("    ShellService reference (via bundle's context) by name: " + directShellServiceByName);    // No logger, for debugging only.
+                            if (ref == null) {
+                                ref = (directShellServiceByClass != null ? (ServiceReference) directShellServiceByClass : (ServiceReference) directShellServiceByName);
+                            }
+                        }
+                    } else {
+                        //out.println("Bundle [" + index + "] is null");  // No logger, for debugging only.
+                    }
+                }
+            } else {
+                //out.println("OSGi Interceptor-provided BundleContext bundle array is null or empty");  // No logger, for debugging only.
+            }
+        }
+
+        if (ref == null) {
+            out.println("ShellService reference cannot be found (null), service lookup will fail.");
+        }
+
+        return (ShellService) (bundleAccessor != null ? bundleAccessor.getService(ref) : null);
+    }
+
+    @Override
+    public void setBundleContext(BundleContext bundleContext) {
+        //System.out.println("ShellAction - setBundleContext called.  BundleContext: " + bundleContext);  // No logger, for debugging only.
+        this.bundleContext = bundleContext;
    }
 }
@@ -1,9 +1,13 @@
-Copyright (c) 2009 Paul Bakaus, http://jqueryui.com/
+Copyright jQuery Foundation and other contributors, https://jquery.org/

 This software consists of voluntary contributions made by many
-individuals (AUTHORS.txt, http://jqueryui.com/about) For exact
-contribution history, see the revision history and logs, available
-at http://jquery-ui.googlecode.com/svn/
+individuals. For exact contribution history, see the revision history
+available at https://github.com/jquery/jquery-ui
+
+The following license applies to all parts of this software except as
+documented below:
+
+====

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -23,3 +27,17 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+====
+
+Copyright and related rights for sample code are waived via CC0. Sample
+code is defined as all source code contained within the demos directory.
+
+CC0: http://creativecommons.org/publicdomain/zero/1.0/
+
+====
+
+All files located in the node_modules and external directories are
+externally maintained libraries used by this software which have their
+own licenses; we recommend you read them, as their terms may differ from
+the terms above.
@@ -2,7 +2,8 @@ Apache Struts
 Copyright 2000-2011 The Apache Software Foundation

 This product includes software developed by
-The Apache Software Foundation (http://www.apache.org/).
+The Apache Software Foundation (https://www.apache.org/).

 The binary distributions includes the following third party software:
-JQuery (http://jquery.com/).
+jQuery (https://jquery.com/).
+jQuery UI (https://jqueryui.com/).
@@ -24,11 +24,11 @@

        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/shell.css" />" />
        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/main.css" />" />
-        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.7.1.custom.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.12.1.redmond.css" />" />

        <script src="<@s.url value="/static/js/shell.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-1.3.2.min.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-ui-1.7.1.custom.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-ui-1.12.1.min.js" />"></script>
    </head>
 <body>
 <div class="menu">
@@ -23,10 +23,10 @@
        <title>${bundle.symbolicName!}</title>

        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/main.css" />" />
-        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.7.1.custom.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.12.1.redmond.css" />" />

-        <script src="<@s.url value="/static/js/jquery-1.3.2.min.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-ui-1.7.1.custom.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-ui-1.12.1.min.js" />"></script>

        <script type="text/javascript">
            $(function() {
@@ -163,5 +163,8 @@
        </table>
    </div>
 </div>
+
+<@s.actionmessage />
+
 </body>
 </html>
@@ -23,10 +23,10 @@
        <title>OSGi Bundles</title>

        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/main.css" />" />
-        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.7.1.custom.css" />" />
+        <link rel="stylesheet" type="text/css" href="<@s.url value="/static/css/redmond/jquery-ui-1.12.1.redmond.css" />" />

-        <script src="<@s.url value="/static/js/jquery-1.3.2.min.js" />"></script>
-        <script src="<@s.url value="/static/js/jquery-ui-1.7.1.custom.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-1.12.4.min.js" />"></script>
+        <script src="<@s.url value="/static/js/jquery-ui-1.12.1.min.js" />"></script>
    </head>
 <body>

@@ -44,6 +44,9 @@
        </a>
    </div>    
 </div>
+
+<@s.actionerror />
+
 <table class="properties" style="clear:both; width:700px">
    <thead>
        <tr>
@@ -87,5 +90,8 @@
        </#list>
    </tbody>
 </table>
+
+<@s.actionmessage />
+
 </body>
 </html>
@@ -1,404 +0,0 @@
-/*
-* jQuery UI CSS Framework
-* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
-* Dual licensed under the MIT (MIT-LICENSE.txt) and GPL (GPL-LICENSE.txt) licenses.
-*/
-
-/* Layout helpers
----------------------------------*/
-.ui-helper-hidden { display: none; }
-.ui-helper-hidden-accessible { position: absolute; left: -99999999px; }
-.ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }
-.ui-helper-clearfix:after { content: "."; display: block; height: 0; clear: both; visibility: hidden; }
-.ui-helper-clearfix { display: inline-block; }
-/* required comment for clearfix to work in Opera \*/
-* html .ui-helper-clearfix { height:1%; }
-.ui-helper-clearfix { display:block; }
-/* end clearfix */
-.ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }
-
-
-/* Interaction Cues
----------------------------------*/
-.ui-state-disabled { cursor: default !important; }
-
-
-/* Icons
----------------------------------*/
-
-/* states and images */
-.ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }
-
-
-/* Misc visuals
----------------------------------*/
-
-/* Overlays */
-.ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }
-
-/*
-* jQuery UI CSS Framework
-* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
-* Dual licensed under the MIT (MIT-LICENSE.txt) and GPL (GPL-LICENSE.txt) licenses.
-* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px
-*/
-
-
-/* Component containers
----------------------------------*/
-.ui-widget { font-family: Lucida Grande, Lucida Sans, Arial, sans-serif; font-size: 1.1em; }
-.ui-widget input, .ui-widget select, .ui-widget textarea, .ui-widget button { font-family: Lucida Grande, Lucida Sans, Arial, sans-serif; font-size: 1em; }
-.ui-widget-content { border: 1px solid #a6c9e2; background: #fcfdfd url(images/ui-bg_inset-hard_100_fcfdfd_1x100.png) 50% bottom repeat-x; color: #222222; }
-.ui-widget-content a { color: #222222; }
-.ui-widget-header { border: 1px solid #4297d7; background: #5c9ccc url(images/ui-bg_gloss-wave_55_5c9ccc_500x100.png) 50% 50% repeat-x; color: #ffffff; font-weight: bold; }
-.ui-widget-header a { color: #ffffff; }
-
-/* Interaction states
----------------------------------*/
-.ui-state-default, .ui-widget-content .ui-state-default { border: 1px solid #c5dbec; background: #dfeffc url(images/ui-bg_glass_85_dfeffc_1x400.png) 50% 50% repeat-x; font-weight: bold; color: #2e6e9e; outline: none; }
-.ui-state-default a, .ui-state-default a:link, .ui-state-default a:visited { color: #2e6e9e; text-decoration: none; outline: none; }
-.ui-state-hover, .ui-widget-content .ui-state-hover, .ui-state-focus, .ui-widget-content .ui-state-focus { border: 1px solid #79b7e7; background: #d0e5f5 url(images/ui-bg_glass_75_d0e5f5_1x400.png) 50% 50% repeat-x; font-weight: bold; color: #1d5987; outline: none; }
-.ui-state-hover a, .ui-state-hover a:hover { color: #1d5987; text-decoration: none; outline: none; }
-.ui-state-active, .ui-widget-content .ui-state-active { border: 1px solid #79b7e7; background: #f5f8f9 url(images/ui-bg_inset-hard_100_f5f8f9_1x100.png) 50% 50% repeat-x; font-weight: bold; color: #e17009; outline: none; }
-.ui-state-active a, .ui-state-active a:link, .ui-state-active a:visited { color: #e17009; outline: none; text-decoration: none; }
-
-/* Interaction Cues
----------------------------------*/
-.ui-state-highlight, .ui-widget-content .ui-state-highlight {border: 1px solid #fad42e; background: #fbec88 url(images/ui-bg_flat_55_fbec88_40x100.png) 50% 50% repeat-x; color: #363636; }
-.ui-state-highlight a, .ui-widget-content .ui-state-highlight a { color: #363636; }
-.ui-state-error, .ui-widget-content .ui-state-error {border: 1px solid #cd0a0a; background: #fef1ec url(images/ui-bg_glass_95_fef1ec_1x400.png) 50% 50% repeat-x; color: #cd0a0a; }
-.ui-state-error a, .ui-widget-content .ui-state-error a { color: #cd0a0a; }
-.ui-state-error-text, .ui-widget-content .ui-state-error-text { color: #cd0a0a; }
-.ui-state-disabled, .ui-widget-content .ui-state-disabled { opacity: .35; filter:Alpha(Opacity=35); background-image: none; }
-.ui-priority-primary, .ui-widget-content .ui-priority-primary { font-weight: bold; }
-.ui-priority-secondary, .ui-widget-content .ui-priority-secondary { opacity: .7; filter:Alpha(Opacity=70); font-weight: normal; }
-
-/* Icons
----------------------------------*/
-
-/* states and images */
-.ui-icon { width: 16px; height: 16px; background-image: url(images/ui-icons_469bdd_256x240.png); }
-.ui-widget-content .ui-icon {background-image: url(images/ui-icons_469bdd_256x240.png); }
-.ui-widget-header .ui-icon {background-image: url(images/ui-icons_d8e7f3_256x240.png); }
-.ui-state-default .ui-icon { background-image: url(images/ui-icons_6da8d5_256x240.png); }
-.ui-state-hover .ui-icon, .ui-state-focus .ui-icon {background-image: url(images/ui-icons_217bc0_256x240.png); }
-.ui-state-active .ui-icon {background-image: url(images/ui-icons_f9bd01_256x240.png); }
-.ui-state-highlight .ui-icon {background-image: url(images/ui-icons_2e83ff_256x240.png); }
-.ui-state-error .ui-icon, .ui-state-error-text .ui-icon {background-image: url(images/ui-icons_cd0a0a_256x240.png); }
-
-/* positioning */
-.ui-icon-carat-1-n { background-position: 0 0; }
-.ui-icon-carat-1-ne { background-position: -16px 0; }
-.ui-icon-carat-1-e { background-position: -32px 0; }
-.ui-icon-carat-1-se { background-position: -48px 0; }
-.ui-icon-carat-1-s { background-position: -64px 0; }
-.ui-icon-carat-1-sw { background-position: -80px 0; }
-.ui-icon-carat-1-w { background-position: -96px 0; }
-.ui-icon-carat-1-nw { background-position: -112px 0; }
-.ui-icon-carat-2-n-s { background-position: -128px 0; }
-.ui-icon-carat-2-e-w { background-position: -144px 0; }
-.ui-icon-triangle-1-n { background-position: 0 -16px; }
-.ui-icon-triangle-1-ne { background-position: -16px -16px; }
-.ui-icon-triangle-1-e { background-position: -32px -16px; }
-.ui-icon-triangle-1-se { background-position: -48px -16px; }
-.ui-icon-triangle-1-s { background-position: -64px -16px; }
-.ui-icon-triangle-1-sw { background-position: -80px -16px; }
-.ui-icon-triangle-1-w { background-position: -96px -16px; }
-.ui-icon-triangle-1-nw { background-position: -112px -16px; }
-.ui-icon-triangle-2-n-s { background-position: -128px -16px; }
-.ui-icon-triangle-2-e-w { background-position: -144px -16px; }
-.ui-icon-arrow-1-n { background-position: 0 -32px; }
-.ui-icon-arrow-1-ne { background-position: -16px -32px; }
-.ui-icon-arrow-1-e { background-position: -32px -32px; }
-.ui-icon-arrow-1-se { background-position: -48px -32px; }
-.ui-icon-arrow-1-s { background-position: -64px -32px; }
-.ui-icon-arrow-1-sw { background-position: -80px -32px; }
-.ui-icon-arrow-1-w { background-position: -96px -32px; }
-.ui-icon-arrow-1-nw { background-position: -112px -32px; }
-.ui-icon-arrow-2-n-s { background-position: -128px -32px; }
-.ui-icon-arrow-2-ne-sw { background-position: -144px -32px; }
-.ui-icon-arrow-2-e-w { background-position: -160px -32px; }
-.ui-icon-arrow-2-se-nw { background-position: -176px -32px; }
-.ui-icon-arrowstop-1-n { background-position: -192px -32px; }
-.ui-icon-arrowstop-1-e { background-position: -208px -32px; }
-.ui-icon-arrowstop-1-s { background-position: -224px -32px; }
-.ui-icon-arrowstop-1-w { background-position: -240px -32px; }
-.ui-icon-arrowthick-1-n { background-position: 0 -48px; }
-.ui-icon-arrowthick-1-ne { background-position: -16px -48px; }
-.ui-icon-arrowthick-1-e { background-position: -32px -48px; }
-.ui-icon-arrowthick-1-se { background-position: -48px -48px; }
-.ui-icon-arrowthick-1-s { background-position: -64px -48px; }
-.ui-icon-arrowthick-1-sw { background-position: -80px -48px; }
-.ui-icon-arrowthick-1-w { background-position: -96px -48px; }
-.ui-icon-arrowthick-1-nw { background-position: -112px -48px; }
-.ui-icon-arrowthick-2-n-s { background-position: -128px -48px; }
-.ui-icon-arrowthick-2-ne-sw { background-position: -144px -48px; }
-.ui-icon-arrowthick-2-e-w { background-position: -160px -48px; }
-.ui-icon-arrowthick-2-se-nw { background-position: -176px -48px; }
-.ui-icon-arrowthickstop-1-n { background-position: -192px -48px; }
-.ui-icon-arrowthickstop-1-e { background-position: -208px -48px; }
-.ui-icon-arrowthickstop-1-s { background-position: -224px -48px; }
-.ui-icon-arrowthickstop-1-w { background-position: -240px -48px; }
-.ui-icon-arrowreturnthick-1-w { background-position: 0 -64px; }
-.ui-icon-arrowreturnthick-1-n { background-position: -16px -64px; }
-.ui-icon-arrowreturnthick-1-e { background-position: -32px -64px; }
-.ui-icon-arrowreturnthick-1-s { background-position: -48px -64px; }
-.ui-icon-arrowreturn-1-w { background-position: -64px -64px; }
-.ui-icon-arrowreturn-1-n { background-position: -80px -64px; }
-.ui-icon-arrowreturn-1-e { background-position: -96px -64px; }
-.ui-icon-arrowreturn-1-s { background-position: -112px -64px; }
-.ui-icon-arrowrefresh-1-w { background-position: -128px -64px; }
-.ui-icon-arrowrefresh-1-n { background-position: -144px -64px; }
-.ui-icon-arrowrefresh-1-e { background-position: -160px -64px; }
-.ui-icon-arrowrefresh-1-s { background-position: -176px -64px; }
-.ui-icon-arrow-4 { background-position: 0 -80px; }
-.ui-icon-arrow-4-diag { background-position: -16px -80px; }
-.ui-icon-extlink { background-position: -32px -80px; }
-.ui-icon-newwin { background-position: -48px -80px; }
-.ui-icon-refresh { background-position: -64px -80px; }
-.ui-icon-shuffle { background-position: -80px -80px; }
-.ui-icon-transfer-e-w { background-position: -96px -80px; }
-.ui-icon-transferthick-e-w { background-position: -112px -80px; }
-.ui-icon-folder-collapsed { background-position: 0 -96px; }
-.ui-icon-folder-open { background-position: -16px -96px; }
-.ui-icon-document { background-position: -32px -96px; }
-.ui-icon-document-b { background-position: -48px -96px; }
-.ui-icon-note { background-position: -64px -96px; }
-.ui-icon-mail-closed { background-position: -80px -96px; }
-.ui-icon-mail-open { background-position: -96px -96px; }
-.ui-icon-suitcase { background-position: -112px -96px; }
-.ui-icon-comment { background-position: -128px -96px; }
-.ui-icon-person { background-position: -144px -96px; }
-.ui-icon-print { background-position: -160px -96px; }
-.ui-icon-trash { background-position: -176px -96px; }
-.ui-icon-locked { background-position: -192px -96px; }
-.ui-icon-unlocked { background-position: -208px -96px; }
-.ui-icon-bookmark { background-position: -224px -96px; }
-.ui-icon-tag { background-position: -240px -96px; }
-.ui-icon-home { background-position: 0 -112px; }
-.ui-icon-flag { background-position: -16px -112px; }
-.ui-icon-calendar { background-position: -32px -112px; }
-.ui-icon-cart { background-position: -48px -112px; }
-.ui-icon-pencil { background-position: -64px -112px; }
-.ui-icon-clock { background-position: -80px -112px; }
-.ui-icon-disk { background-position: -96px -112px; }
-.ui-icon-calculator { background-position: -112px -112px; }
-.ui-icon-zoomin { background-position: -128px -112px; }
-.ui-icon-zoomout { background-position: -144px -112px; }
-.ui-icon-search { background-position: -160px -112px; }
-.ui-icon-wrench { background-position: -176px -112px; }
-.ui-icon-gear { background-position: -192px -112px; }
-.ui-icon-heart { background-position: -208px -112px; }
-.ui-icon-star { background-position: -224px -112px; }
-.ui-icon-link { background-position: -240px -112px; }
-.ui-icon-cancel { background-position: 0 -128px; }
-.ui-icon-plus { background-position: -16px -128px; }
-.ui-icon-plusthick { background-position: -32px -128px; }
-.ui-icon-minus { background-position: -48px -128px; }
-.ui-icon-minusthick { background-position: -64px -128px; }
-.ui-icon-close { background-position: -80px -128px; }
-.ui-icon-closethick { background-position: -96px -128px; }
-.ui-icon-key { background-position: -112px -128px; }
-.ui-icon-lightbulb { background-position: -128px -128px; }
-.ui-icon-scissors { background-position: -144px -128px; }
-.ui-icon-clipboard { background-position: -160px -128px; }
-.ui-icon-copy { background-position: -176px -128px; }
-.ui-icon-contact { background-position: -192px -128px; }
-.ui-icon-image { background-position: -208px -128px; }
-.ui-icon-video { background-position: -224px -128px; }
-.ui-icon-script { background-position: -240px -128px; }
-.ui-icon-alert { background-position: 0 -144px; }
-.ui-icon-info { background-position: -16px -144px; }
-.ui-icon-notice { background-position: -32px -144px; }
-.ui-icon-help { background-position: -48px -144px; }
-.ui-icon-check { background-position: -64px -144px; }
-.ui-icon-bullet { background-position: -80px -144px; }
-.ui-icon-radio-off { background-position: -96px -144px; }
-.ui-icon-radio-on { background-position: -112px -144px; }
-.ui-icon-pin-w { background-position: -128px -144px; }
-.ui-icon-pin-s { background-position: -144px -144px; }
-.ui-icon-play { background-position: 0 -160px; }
-.ui-icon-pause { background-position: -16px -160px; }
-.ui-icon-seek-next { background-position: -32px -160px; }
-.ui-icon-seek-prev { background-position: -48px -160px; }
-.ui-icon-seek-end { background-position: -64px -160px; }
-.ui-icon-seek-first { background-position: -80px -160px; }
-.ui-icon-stop { background-position: -96px -160px; }
-.ui-icon-eject { background-position: -112px -160px; }
-.ui-icon-volume-off { background-position: -128px -160px; }
-.ui-icon-volume-on { background-position: -144px -160px; }
-.ui-icon-power { background-position: 0 -176px; }
-.ui-icon-signal-diag { background-position: -16px -176px; }
-.ui-icon-signal { background-position: -32px -176px; }
-.ui-icon-battery-0 { background-position: -48px -176px; }
-.ui-icon-battery-1 { background-position: -64px -176px; }
-.ui-icon-battery-2 { background-position: -80px -176px; }
-.ui-icon-battery-3 { background-position: -96px -176px; }
-.ui-icon-circle-plus { background-position: 0 -192px; }
-.ui-icon-circle-minus { background-position: -16px -192px; }
-.ui-icon-circle-close { background-position: -32px -192px; }
-.ui-icon-circle-triangle-e { background-position: -48px -192px; }
-.ui-icon-circle-triangle-s { background-position: -64px -192px; }
-.ui-icon-circle-triangle-w { background-position: -80px -192px; }
-.ui-icon-circle-triangle-n { background-position: -96px -192px; }
-.ui-icon-circle-arrow-e { background-position: -112px -192px; }
-.ui-icon-circle-arrow-s { background-position: -128px -192px; }
-.ui-icon-circle-arrow-w { background-position: -144px -192px; }
-.ui-icon-circle-arrow-n { background-position: -160px -192px; }
-.ui-icon-circle-zoomin { background-position: -176px -192px; }
-.ui-icon-circle-zoomout { background-position: -192px -192px; }
-.ui-icon-circle-check { background-position: -208px -192px; }
-.ui-icon-circlesmall-plus { background-position: 0 -208px; }
-.ui-icon-circlesmall-minus { background-position: -16px -208px; }
-.ui-icon-circlesmall-close { background-position: -32px -208px; }
-.ui-icon-squaresmall-plus { background-position: -48px -208px; }
-.ui-icon-squaresmall-minus { background-position: -64px -208px; }
-.ui-icon-squaresmall-close { background-position: -80px -208px; }
-.ui-icon-grip-dotted-vertical { background-position: 0 -224px; }
-.ui-icon-grip-dotted-horizontal { background-position: -16px -224px; }
-.ui-icon-grip-solid-vertical { background-position: -32px -224px; }
-.ui-icon-grip-solid-horizontal { background-position: -48px -224px; }
-.ui-icon-gripsmall-diagonal-se { background-position: -64px -224px; }
-.ui-icon-grip-diagonal-se { background-position: -80px -224px; }
-
-
-/* Misc visuals
----------------------------------*/
-
-/* Corner radius */
-.ui-corner-tl { -moz-border-radius-topleft: 5px; -webkit-border-top-left-radius: 5px; }
-.ui-corner-tr { -moz-border-radius-topright: 5px; -webkit-border-top-right-radius: 5px; }
-.ui-corner-bl { -moz-border-radius-bottomleft: 5px; -webkit-border-bottom-left-radius: 5px; }
-.ui-corner-br { -moz-border-radius-bottomright: 5px; -webkit-border-bottom-right-radius: 5px; }
-.ui-corner-top { -moz-border-radius-topleft: 5px; -webkit-border-top-left-radius: 5px; -moz-border-radius-topright: 5px; -webkit-border-top-right-radius: 5px; }
-.ui-corner-bottom { -moz-border-radius-bottomleft: 5px; -webkit-border-bottom-left-radius: 5px; -moz-border-radius-bottomright: 5px; -webkit-border-bottom-right-radius: 5px; }
-.ui-corner-right {  -moz-border-radius-topright: 5px; -webkit-border-top-right-radius: 5px; -moz-border-radius-bottomright: 5px; -webkit-border-bottom-right-radius: 5px; }
-.ui-corner-left { -moz-border-radius-topleft: 5px; -webkit-border-top-left-radius: 5px; -moz-border-radius-bottomleft: 5px; -webkit-border-bottom-left-radius: 5px; }
-.ui-corner-all { -moz-border-radius: 5px; -webkit-border-radius: 5px; }
-
-/* Overlays */
-.ui-widget-overlay { background: #aaaaaa url(images/ui-bg_flat_0_aaaaaa_40x100.png) 50% 50% repeat-x; opacity: .30;filter:Alpha(Opacity=30); }
-.ui-widget-shadow { margin: -8px 0 0 -8px; padding: 8px; background: #aaaaaa url(images/ui-bg_flat_0_aaaaaa_40x100.png) 50% 50% repeat-x; opacity: .30;filter:Alpha(Opacity=30); -moz-border-radius: 8px; -webkit-border-radius: 8px; }/* Accordion
----------------------------------*/
-.ui-accordion .ui-accordion-header { cursor: pointer; position: relative; margin-top: 1px; zoom: 1; }
-.ui-accordion .ui-accordion-li-fix { display: inline; }
-.ui-accordion .ui-accordion-header-active { border-bottom: 0 !important; }
-.ui-accordion .ui-accordion-header a { display: block; font-size: 1em; padding: .5em .5em .5em 2.2em; }
-.ui-accordion .ui-accordion-header .ui-icon { position: absolute; left: .5em; top: 50%; margin-top: -8px; }
-.ui-accordion .ui-accordion-content { padding: 1em 2.2em; border-top: 0; margin-top: -2px; position: relative; top: 1px; margin-bottom: 2px; overflow: auto; display: none; }
-.ui-accordion .ui-accordion-content-active { display: block; }/* Datepicker
----------------------------------*/
-.ui-datepicker { width: 17em; padding: .2em .2em 0; }
-.ui-datepicker .ui-datepicker-header { position:relative; padding:.2em 0; }
-.ui-datepicker .ui-datepicker-prev, .ui-datepicker .ui-datepicker-next { position:absolute; top: 2px; width: 1.8em; height: 1.8em; }
-.ui-datepicker .ui-datepicker-prev-hover, .ui-datepicker .ui-datepicker-next-hover { top: 1px; }
-.ui-datepicker .ui-datepicker-prev { left:2px; }
-.ui-datepicker .ui-datepicker-next { right:2px; }
-.ui-datepicker .ui-datepicker-prev-hover { left:1px; }
-.ui-datepicker .ui-datepicker-next-hover { right:1px; }
-.ui-datepicker .ui-datepicker-prev span, .ui-datepicker .ui-datepicker-next span { display: block; position: absolute; left: 50%; margin-left: -8px; top: 50%; margin-top: -8px;  }
-.ui-datepicker .ui-datepicker-title { margin: 0 2.3em; line-height: 1.8em; text-align: center; }
-.ui-datepicker .ui-datepicker-title select { float:left; font-size:1em; margin:1px 0; }
-.ui-datepicker select.ui-datepicker-month-year {width: 100%;}
-.ui-datepicker select.ui-datepicker-month, 
-.ui-datepicker select.ui-datepicker-year { width: 49%;}
-.ui-datepicker .ui-datepicker-title select.ui-datepicker-year { float: right; }
-.ui-datepicker table {width: 100%; font-size: .9em; border-collapse: collapse; margin:0 0 .4em; }
-.ui-datepicker th { padding: .7em .3em; text-align: center; font-weight: bold; border: 0;  }
-.ui-datepicker td { border: 0; padding: 1px; }
-.ui-datepicker td span, .ui-datepicker td a { display: block; padding: .2em; text-align: right; text-decoration: none; }
-.ui-datepicker .ui-datepicker-buttonpane { background-image: none; margin: .7em 0 0 0; padding:0 .2em; border-left: 0; border-right: 0; border-bottom: 0; }
-.ui-datepicker .ui-datepicker-buttonpane button { float: right; margin: .5em .2em .4em; cursor: pointer; padding: .2em .6em .3em .6em; width:auto; overflow:visible; }
-.ui-datepicker .ui-datepicker-buttonpane button.ui-datepicker-current { float:left; }
-
-/* with multiple calendars */
-.ui-datepicker.ui-datepicker-multi { width:auto; }
-.ui-datepicker-multi .ui-datepicker-group { float:left; }
-.ui-datepicker-multi .ui-datepicker-group table { width:95%; margin:0 auto .4em; }
-.ui-datepicker-multi-2 .ui-datepicker-group { width:50%; }
-.ui-datepicker-multi-3 .ui-datepicker-group { width:33.3%; }
-.ui-datepicker-multi-4 .ui-datepicker-group { width:25%; }
-.ui-datepicker-multi .ui-datepicker-group-last .ui-datepicker-header { border-left-width:0; }
-.ui-datepicker-multi .ui-datepicker-group-middle .ui-datepicker-header { border-left-width:0; }
-.ui-datepicker-multi .ui-datepicker-buttonpane { clear:left; }
-.ui-datepicker-row-break { clear:both; width:100%; }
-
-/* RTL support */
-.ui-datepicker-rtl { direction: rtl; }
-.ui-datepicker-rtl .ui-datepicker-prev { right: 2px; left: auto; }
-.ui-datepicker-rtl .ui-datepicker-next { left: 2px; right: auto; }
-.ui-datepicker-rtl .ui-datepicker-prev:hover { right: 1px; left: auto; }
-.ui-datepicker-rtl .ui-datepicker-next:hover { left: 1px; right: auto; }
-.ui-datepicker-rtl .ui-datepicker-buttonpane { clear:right; }
-.ui-datepicker-rtl .ui-datepicker-buttonpane button { float: left; }
-.ui-datepicker-rtl .ui-datepicker-buttonpane button.ui-datepicker-current { float:right; }
-.ui-datepicker-rtl .ui-datepicker-group { float:right; }
-.ui-datepicker-rtl .ui-datepicker-group-last .ui-datepicker-header { border-right-width:0; border-left-width:1px; }
-.ui-datepicker-rtl .ui-datepicker-group-middle .ui-datepicker-header { border-right-width:0; border-left-width:1px; }
-
-/* IE6 IFRAME FIX (taken from datepicker 1.5.3 */
-.ui-datepicker-cover {
-    display: none; /*sorry for IE5*/
-    display/**/: block; /*sorry for IE5*/
-    position: absolute; /*must have*/
-    z-index: -1; /*must have*/
-    filter: mask(); /*must have*/
-    top: -4px; /*must have*/
-    left: -4px; /*must have*/
-    width: 200px; /*must have*/
-    height: 200px; /*must have*/
-}/* Dialog
----------------------------------*/
-.ui-dialog { position: relative; padding: .2em; width: 300px; }
-.ui-dialog .ui-dialog-titlebar { padding: .5em .3em .3em 1em; position: relative;  }
-.ui-dialog .ui-dialog-title { float: left; margin: .1em 0 .2em; } 
-.ui-dialog .ui-dialog-titlebar-close { position: absolute; right: .3em; top: 50%; width: 19px; margin: -10px 0 0 0; padding: 1px; height: 18px; }
-.ui-dialog .ui-dialog-titlebar-close span { display: block; margin: 1px; }
-.ui-dialog .ui-dialog-titlebar-close:hover, .ui-dialog .ui-dialog-titlebar-close:focus { padding: 0; }
-.ui-dialog .ui-dialog-content { border: 0; padding: .5em 1em; background: none; overflow: auto; zoom: 1; }
-.ui-dialog .ui-dialog-buttonpane { text-align: left; border-width: 1px 0 0 0; background-image: none; margin: .5em 0 0 0; padding: .3em 1em .5em .4em; }
-.ui-dialog .ui-dialog-buttonpane button { float: right; margin: .5em .4em .5em 0; cursor: pointer; padding: .2em .6em .3em .6em; line-height: 1.4em; width:auto; overflow:visible; }
-.ui-dialog .ui-resizable-se { width: 14px; height: 14px; right: 3px; bottom: 3px; }
-.ui-draggable .ui-dialog-titlebar { cursor: move; }
-/* Progressbar
----------------------------------*/
-.ui-progressbar { height:2em; text-align: left; }
-.ui-progressbar .ui-progressbar-value {margin: -1px; height:100%; }/* Resizable
----------------------------------*/
-.ui-resizable { position: relative;}
-.ui-resizable-handle { position: absolute;font-size: 0.1px;z-index: 99999; display: block;}
-.ui-resizable-disabled .ui-resizable-handle, .ui-resizable-autohide .ui-resizable-handle { display: none; }
-.ui-resizable-n { cursor: n-resize; height: 7px; width: 100%; top: -5px; left: 0px; }
-.ui-resizable-s { cursor: s-resize; height: 7px; width: 100%; bottom: -5px; left: 0px; }
-.ui-resizable-e { cursor: e-resize; width: 7px; right: -5px; top: 0px; height: 100%; }
-.ui-resizable-w { cursor: w-resize; width: 7px; left: -5px; top: 0px; height: 100%; }
-.ui-resizable-se { cursor: se-resize; width: 12px; height: 12px; right: 1px; bottom: 1px; }
-.ui-resizable-sw { cursor: sw-resize; width: 9px; height: 9px; left: -5px; bottom: -5px; }
-.ui-resizable-nw { cursor: nw-resize; width: 9px; height: 9px; left: -5px; top: -5px; }
-.ui-resizable-ne { cursor: ne-resize; width: 9px; height: 9px; right: -5px; top: -5px;}/* Slider
----------------------------------*/
-.ui-slider { position: relative; text-align: left; }
-.ui-slider .ui-slider-handle { position: absolute; z-index: 2; width: 1.2em; height: 1.2em; cursor: default; }
-.ui-slider .ui-slider-range { position: absolute; z-index: 1; font-size: .7em; display: block; border: 0; }
-
-.ui-slider-horizontal { height: .8em; }
-.ui-slider-horizontal .ui-slider-handle { top: -.3em; margin-left: -.6em; }
-.ui-slider-horizontal .ui-slider-range { top: 0; height: 100%; }
-.ui-slider-horizontal .ui-slider-range-min { left: 0; }
-.ui-slider-horizontal .ui-slider-range-max { right: 0; }
-
-.ui-slider-vertical { width: .8em; height: 100px; }
-.ui-slider-vertical .ui-slider-handle { left: -.3em; margin-left: 0; margin-bottom: -.6em; }
-.ui-slider-vertical .ui-slider-range { left: 0; width: 100%; }
-.ui-slider-vertical .ui-slider-range-min { bottom: 0; }
-.ui-slider-vertical .ui-slider-range-max { top: 0; }/* Tabs
----------------------------------*/
-.ui-tabs { padding: .2em; zoom: 1; }
-.ui-tabs .ui-tabs-nav { list-style: none; position: relative; padding: .2em .2em 0; }
-.ui-tabs .ui-tabs-nav li { position: relative; float: left; border-bottom-width: 0 !important; margin: 0 .2em -1px 0; padding: 0; }
-.ui-tabs .ui-tabs-nav li a { float: left; text-decoration: none; padding: .5em 1em; }
-.ui-tabs .ui-tabs-nav li.ui-tabs-selected { padding-bottom: 1px; border-bottom-width: 0; }
-.ui-tabs .ui-tabs-nav li.ui-tabs-selected a, .ui-tabs .ui-tabs-nav li.ui-state-disabled a, .ui-tabs .ui-tabs-nav li.ui-state-processing a { cursor: text; }
-.ui-tabs .ui-tabs-nav li a, .ui-tabs.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-selected a { cursor: pointer; } /* first selector in group seems obsolete, but required to overcome bug in Opera applying cursor: text overall if defined elsewhere... */
-.ui-tabs .ui-tabs-panel { padding: 1em 1.4em; display: block; border-width: 0; background: none; }
-.ui-tabs .ui-tabs-hide { display: none !important; }
@@ -29,8 +29,8 @@
      result_div.appendChild(document.createElement('br'));

      for (var line_index in result_array) {
-          var result_wrap = document.createElement('pre')
-          line = document.createTextNode(result_array[line_index]);
+          var result_wrap = document.createElement('pre');
+          var line = document.createTextNode(result_array[line_index]);
          result_wrap.appendChild(line);
          result_div.appendChild(result_wrap);
          result_div.appendChild(document.createElement('br'));
@@ -21,28 +21,29 @@
 -->

 <!DOCTYPE struts PUBLIC
-    "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
-    "http://struts.apache.org/dtds/struts-2.0.dtd">
+    "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+    "http://struts.apache.org/dtds/struts-2.5.dtd">

 <struts>
-    <package name="bundle-admin" namespace="/osgi/admin" extends="struts-default">
+    <constant name="struts.enable.DynamicMethodInvocation" value="false" />
+    <package name="bundle-admin" namespace="/osgi/admin" extends="osgi-default" strict-method-invocation="true">
        <default-action-ref name="bundles" />
        
        <action name="bundle_*!*" class="org.apache.struts2.osgi.admin.actions.BundlesAction" method="{2}">
            <param name="id">{1}</param>
            <result type="freemarker">viewBundle.ftl</result>
+            <allowed-methods>index,view,start,stop,update</allowed-methods>
        </action>

        <action name="bundles" class="org.apache.struts2.osgi.admin.actions.BundlesAction" method="index">
            <result type="freemarker">viewBundles.ftl</result>
        </action>

-
        <action name="execCommand" class="org.apache.struts2.osgi.admin.actions.ShellAction">
            <result type="freemarker">commandResult.ftl</result>
        </action>

-        <action name="shell">
+        <action name="shell" class="org.apache.struts2.osgi.admin.actions.ShellAction">
            <result type="freemarker">shell.ftl</result>
        </action>
    </package>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-osgi-bundles</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>

    <artifactId>struts2-osgi-demo-bundle</artifactId>
@@ -67,7 +67,6 @@
                <groupId>org.apache.felix</groupId>
                <artifactId>maven-bundle-plugin</artifactId>
                <extensions>true</extensions>
-                <version>2.1.0</version>
                <configuration>
                    <instructions>
                        <manifestLocation>META-INF</manifestLocation>
@@ -22,13 +22,21 @@ package actions.osgi;

 import com.opensymphony.xwork2.ActionSupport;
 import org.apache.struts2.convention.annotation.Action;
+import org.apache.struts2.convention.annotation.Actions;
+import org.apache.struts2.convention.annotation.Namespace;
+import org.apache.struts2.convention.annotation.Result;
 import org.apache.struts2.convention.annotation.ResultPath;

-@ResultPath("/content")
+@Namespace("/osgi")
+@ResultPath("/content/osgi")
 public class HelloWorldAction extends ActionSupport {
-    private Message message;
+    private Message message = new Message("Default non-null message");

-    @Action("hello-convention")
+    @Override
+    @Actions({
+        @Action(value="hello-convention", results={@Result(name="success", type="freemarker", location="/content/osgi/hello-convention.ftl")}),
+        @Action(value="/osgi/hello-convention", results={@Result(name="success", type="freemarker", location="/content/osgi/hello-convention.ftl")})
+    })
    public String execute() {
        return SUCCESS;
    }
@@ -45,6 +53,7 @@ public class HelloWorldAction extends ActionSupport {
        return "Hello!!!";
    }

+    @Override
    public String toString() {
        StringBuilder sb = new StringBuilder("{message:");
        sb.append(message != null ? message.getText() : "null");
@@ -20,7 +20,7 @@
 -->
 <html>
    <head>
-        <title>Action mapped by the XML configurationn</title>
+        <title>Action mapped by the XML configuration</title>
    </head>
    <body>
        This is an action mapped by XML configuration, using a <b>FreeMarker</b> result.
@@ -18,7 +18,7 @@
 *# 
 <html>
    <head>
-        <title>Action mapped by the XML configurationn</title>
+        <title>Action mapped by the XML configuration</title>
    </head>
    <body>
        This is an action mapped by XML configuration, using a <b>Velocity</b> result.
@@ -20,21 +20,36 @@
 */
 -->
 <!DOCTYPE struts PUBLIC
-    "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
-    "http://struts.apache.org/dtds/struts-2.0.dtd">
+    "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+    "http://struts.apache.org/dtds/struts-2.5.dtd">

 <struts>
-    <package name="bundle-demo" namespace="/osgi" extends="osgi-default">
+    <!-- Set some Struts 2 constants relevant to the OSGi Plugin. 
+           Note:  The constant definitions specified here (within the demo bundle) may also need to be 
+                  duplicated in the struts.xml configuration of the outer project that packages the demo
+                  bundle JAR file within it.
+    -->
+    <constant name="struts.objectFactory" value="osgi" />
+    <constant name="struts.objectFactory.delegate" value="struts" />
+    <constant name="struts.freemarker.manager.classname" value="org.apache.struts2.osgi.BundleFreemarkerManager" />
+    <constant name="struts.velocity.manager.classname" value="org.apache.struts2.osgi.VelocityBundleResourceLoader" />
+    <constant name="struts.staticContentLoader" value="org.apache.struts2.osgi.loaders.StaticContentBundleResourceLoader" />
+
+    <package name="bundle-demo" namespace="/osgi" extends="osgi-default" strict-method-invocation="true">
+
        <default-action-ref name="home" />
-        <action name="hello-velocity" class="helloWorldAction">
+
+        <action name="hello-velocity" class="actions.osgi.HelloWorldAction">
            <result type="velocity">/content/osgi/hello.vm</result>
        </action>
-        <action name="hello-freemarker" class="helloWorldAction">
+
+        <action name="hello-freemarker" class="actions.osgi.HelloWorldAction">
            <result type="freemarker">/content/osgi/hello.ftl</result>
        </action>

-        <action name="home">
+        <action name="home" class="actions.osgi.HelloWorldAction">
            <result type="freemarker">/content/osgi/home.ftl</result>
        </action>
+
    </package>
 </struts>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>

    <artifactId>struts2-osgi-bundles</artifactId>
@@ -24,7 +24,7 @@
    <parent>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-parent</artifactId>
-        <version>2.5.23</version>
+        <version>2.5.32</version>
    </parent>
    <artifactId>struts2-core</artifactId>
    <packaging>jar</packaging>
@@ -33,6 +33,7 @@ import com.opensymphony.xwork2.security.DefaultAcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker;
 import com.opensymphony.xwork2.DefaultTextProvider;
 import com.opensymphony.xwork2.DefaultUnknownHandlerManager;
+import com.opensymphony.xwork2.security.DefaultNotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
 import com.opensymphony.xwork2.FileManager;
 import com.opensymphony.xwork2.FileManagerFactory;
@@ -88,6 +89,7 @@ import com.opensymphony.xwork2.ognl.accessor.XWorkIteratorPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkListPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkMapPropertyAccessor;
 import com.opensymphony.xwork2.ognl.accessor.XWorkMethodAccessor;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.util.CompoundRoot;
 import com.opensymphony.xwork2.LocalizedTextProvider;
 import com.opensymphony.xwork2.util.StrutsLocalizedTextProvider;
@@ -215,6 +217,8 @@ public class XWorkConfigurationProvider implements ConfigurationProvider {

                .factory(ExcludedPatternsChecker.class, DefaultExcludedPatternsChecker.class, Scope.PROTOTYPE)
                .factory(AcceptedPatternsChecker.class, DefaultAcceptedPatternsChecker.class, Scope.PROTOTYPE)
+                .factory(NotExcludedAcceptedPatternsChecker.class, DefaultNotExcludedAcceptedPatternsChecker.class
+                        , Scope.SINGLETON)

                .factory(ValueSubstitutor.class, EnvsValueSubstitutor.class, Scope.SINGLETON)
        ;
@@ -44,15 +44,17 @@ public enum Scope {
        @Override
        <T> InternalFactory<? extends T> scopeFactory(Class<T> type, String name, final InternalFactory<? extends T> factory) {
            return new InternalFactory<T>() {
-                T instance;
+                volatile T instance;

                public T create(InternalContext context) {
-                    synchronized (context.getContainer()) {
-                        if (instance == null) {
-                            instance = InitializableFactory.wrapIfNeeded(factory).create(context);
+                    if (instance == null) {
+                        synchronized (context.getContainer()) {
+                            if (instance == null) {
+                                instance = InitializableFactory.wrapIfNeeded(factory).create(context);
+                            }
                        }
-                        return instance;
                    }
+                    return instance;
                }

                @Override
@@ -23,6 +23,8 @@ import com.opensymphony.xwork2.ActionInvocation;
 import com.opensymphony.xwork2.XWorkConstants;
 import com.opensymphony.xwork2.config.entities.ActionConfig;
 import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.security.AcceptedPatternsChecker;
+import com.opensymphony.xwork2.security.ExcludedPatternsChecker;
 import com.opensymphony.xwork2.util.ClearableValueStack;
 import com.opensymphony.xwork2.util.Evaluated;
 import com.opensymphony.xwork2.LocalizedTextProvider;
@@ -32,6 +34,7 @@ import com.opensymphony.xwork2.util.reflection.ReflectionContextState;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.apache.struts2.dispatcher.HttpParameters;
+import org.apache.struts2.dispatcher.Parameter;

 import java.util.Map;

@@ -99,6 +102,9 @@ public class AliasInterceptor extends AbstractInterceptor {
    protected LocalizedTextProvider localizedTextProvider;
    protected boolean devMode = false;

+    private ExcludedPatternsChecker excludedPatterns;
+    private AcceptedPatternsChecker acceptedPatterns;
+
    @Inject(XWorkConstants.DEV_MODE)
    public void setDevMode(String mode) {
        this.devMode = Boolean.parseBoolean(mode);
@@ -114,6 +120,16 @@ public class AliasInterceptor extends AbstractInterceptor {
        this.localizedTextProvider = localizedTextProvider;
    }

+    @Inject
+    public void setExcludedPatterns(ExcludedPatternsChecker excludedPatterns) {
+        this.excludedPatterns = excludedPatterns;
+    }
+
+    @Inject
+    public void setAcceptedPatterns(AcceptedPatternsChecker acceptedPatterns) {
+        this.acceptedPatterns = acceptedPatterns;
+    }
+
    /**
     * <p>
     * Sets the name of the action parameter to look for the alias map.
@@ -144,7 +160,7 @@ public class AliasInterceptor extends AbstractInterceptor {
            ValueStack stack = ac.getValueStack();
            Object obj = stack.findValue(aliasExpression);

-            if (obj != null && obj instanceof Map) {
+            if (obj instanceof Map) {
                //get secure stack
                ValueStack newStack = valueStackFactory.createValueStack(stack);
                boolean clearableStack = newStack instanceof ClearableValueStack;
@@ -166,14 +182,23 @@ public class AliasInterceptor extends AbstractInterceptor {
                for (Object o : aliases.entrySet()) {
                    Map.Entry entry = (Map.Entry) o;
                    String name = entry.getKey().toString();
+                    if (isNotAcceptableExpression(name)) {
+                        continue;
+                    }
                    String alias = (String) entry.getValue();
+                    if (isNotAcceptableExpression(alias)) {
+                        continue;
+                    }
                    Evaluated value = new Evaluated(stack.findValue(name));
                    if (!value.isDefined()) {
                        // workaround
                        HttpParameters contextParameters = ActionContext.getContext().getParameters();

                        if (null != contextParameters) {
-                            value = new Evaluated(contextParameters.get(name));
+                            Parameter param = contextParameters.get(name);
+                            if (param.isDefined()) {
+                                value = new Evaluated(param.getValue());
+                            }
                        }
                    }
                    if (value.isDefined()) {
@@ -202,5 +227,65 @@ public class AliasInterceptor extends AbstractInterceptor {
        
        return invocation.invoke();
    }
-    
+
+    protected boolean isAccepted(String paramName) {
+        AcceptedPatternsChecker.IsAccepted result = acceptedPatterns.isAccepted(paramName);
+        if (result.isAccepted()) {
+            return true;
+        }
+
+        LOG.warn("Parameter [{}] didn't match accepted pattern [{}]! See Accepted / Excluded patterns at\n" +
+                        "https://struts.apache.org/security/#accepted--excluded-patterns",
+                paramName, result.getAcceptedPattern());
+
+        return false;
+    }
+
+    protected boolean isExcluded(String paramName) {
+        ExcludedPatternsChecker.IsExcluded result = excludedPatterns.isExcluded(paramName);
+        if (!result.isExcluded()) {
+            return false;
+        }
+
+        LOG.warn("Parameter [{}] matches excluded pattern [{}]! See Accepted / Excluded patterns at\n" +
+                        "https://struts.apache.org/security/#accepted--excluded-patterns",
+                paramName, result.getExcludedPattern());
+
+        return true;
+    }
+
+    /**
+     * Checks if expression contains vulnerable code
+     *
+     * @param expression of interceptor
+     * @return true|false
+     */
+    protected boolean isNotAcceptableExpression(String expression) {
+        return isExcluded(expression) || !isAccepted(expression);
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * parameters that are allowed in the parameter map (aka whitelist).
+     * <p>
+     * Don't change the default unless you know what you are doing in terms
+     * of security implications.
+     * </p>
+     *
+     * @param commaDelim A comma-delimited list of regular expressions
+     */
+    public void setAcceptParamNames(String commaDelim) {
+        acceptedPatterns.setAcceptedPatterns(commaDelim);
+    }
+
+    /**
+     * Sets a comma-delimited list of regular expressions to match
+     * parameters that should be removed from the parameter map.
+     *
+     * @param commaDelim A comma-delimited list of regular expressions
+     */
+    public void setExcludeParams(String commaDelim) {
+        excludedPatterns.setExcludedPatterns(commaDelim);
+    }
+
 }
@@ -227,21 +227,13 @@ public class StaticParametersInterceptor extends AbstractInterceptor {
    protected void addParametersToContext(ActionContext ac, Map<String, ?> newParams) {
        HttpParameters previousParams = ac.getParameters();

-        HttpParameters.Builder combinedParams = HttpParameters.create();
+        HttpParameters.Builder combinedParams;
        if (overwrite) {
-            if (previousParams != null) {
-                combinedParams = combinedParams.withParent(previousParams);
-            }
-            if (newParams != null) {
-                combinedParams = combinedParams.withExtraParams(newParams);
-            }
+            combinedParams = HttpParameters.create().withParent( previousParams);
+            combinedParams = combinedParams.withExtraParams(newParams);
        } else {
-            if (newParams != null) {
-                combinedParams = combinedParams.withExtraParams(newParams);
-            }
-            if (previousParams != null) {
-                combinedParams = combinedParams.withParent(previousParams);
-            }
+            combinedParams = HttpParameters.create(newParams);
+            combinedParams = combinedParams.withExtraParams(previousParams);
        }
        ac.setParameters(combinedParams.build());
    }
@@ -31,6 +31,8 @@ public class MockResult implements Result {

    public static final String DEFAULT_PARAM = "foo";

+    private ActionInvocation invocation;
+
    @Override
    public boolean equals(Object o) {
        if (this == o) {
@@ -41,7 +43,7 @@ public class MockResult implements Result {
    }

    public void execute(ActionInvocation invocation) throws Exception {
-        // no op
+        this.invocation = invocation;
    }

    @Override
@@ -53,4 +55,7 @@ public class MockResult implements Result {
        // no op
    }

+    public ActionInvocation getInvocation() {
+        return invocation;
+    }
 }
@@ -115,6 +115,11 @@ public class XWorkListPropertyAccessor extends ListPropertyAccessor {
            if (listSize <= index) {
                Object result;

+                if (index > autoGrowCollectionLimit) {
+                    throw new OgnlException("Error auto growing collection size to " + index + " which limited to "
+                                            + autoGrowCollectionLimit);
+                }
+
                for (int i = listSize; i < index; i++) {
                    list.add(null);
                }
@@ -22,7 +22,7 @@ import java.util.Set;
 import java.util.regex.Pattern;

 /**
- * Used across different interceptors to check if given string matches one of the excluded patterns.
+ * Used across different interceptors to check if given string matches one of the accepted patterns.
 */
 public interface AcceptedPatternsChecker {

@@ -21,8 +21,10 @@ package com.opensymphony.xwork2.security;
 import com.opensymphony.xwork2.XWorkConstants;
 import com.opensymphony.xwork2.inject.Inject;
 import com.opensymphony.xwork2.util.TextParseUtil;
+import org.apache.commons.lang3.BooleanUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.struts2.StrutsConstants;

 import java.util.Arrays;
 import java.util.Collections;
@@ -35,7 +37,11 @@ public class DefaultAcceptedPatternsChecker implements AcceptedPatternsChecker {
    private static final Logger LOG = LogManager.getLogger(DefaultAcceptedPatternsChecker.class);

    public static final String[] ACCEPTED_PATTERNS = {
-            "\\w+((\\.\\w+)|(\\[\\d+\\])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'\\])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*"
+            "\\w+((\\.\\w+)|(\\[\\d+])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*"
+    };
+
+    public static final String[] DMI_AWARE_ACCEPTED_PATTERNS = {
+            "\\w+([:]?\\w+)?((\\.\\w+)|(\\[\\d+])|(\\(\\d+\\))|(\\['(\\w|[\\u4e00-\\u9fa5])+'])|(\\('(\\w|[\\u4e00-\\u9fa5])+'\\)))*([!]?\\w+)?"
    };

    private Set<Pattern> acceptedPatterns;
@@ -44,10 +50,21 @@ public class DefaultAcceptedPatternsChecker implements AcceptedPatternsChecker {
        setAcceptedPatterns(ACCEPTED_PATTERNS);
    }

+    public DefaultAcceptedPatternsChecker(
+            @Inject(value = StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION, required = false) String dmiValue
+    ) {
+        if (BooleanUtils.toBoolean(dmiValue)) {
+            LOG.debug("DMI is enabled, adding DMI related accepted patterns");
+            setAcceptedPatterns(DMI_AWARE_ACCEPTED_PATTERNS);
+        } else {
+            setAcceptedPatterns(ACCEPTED_PATTERNS);
+        }
+    }
+
    @Inject(value = XWorkConstants.OVERRIDE_ACCEPTED_PATTERNS, required = false)
    protected void setOverrideAcceptedPatterns(String acceptablePatterns) {
        LOG.warn("Overriding accepted patterns [{}] with [{}], be aware that this affects all instances and safety of your application!",
-                    acceptedPatterns, acceptablePatterns);
+                acceptedPatterns, acceptablePatterns);
        acceptedPatterns = new HashSet<>();
        try {
            for (String pattern : TextParseUtil.commaDelimitedStringToSet(acceptablePatterns)) {
@@ -88,7 +105,7 @@ public class DefaultAcceptedPatternsChecker implements AcceptedPatternsChecker {
            LOG.debug("Sets accepted patterns to [{}], note this impacts the safety of your application!", patterns);
        } else {
            LOG.warn("Replacing accepted patterns [{}] with [{}], be aware that this affects all instances and safety of your application!",
-                        acceptedPatterns, patterns);
+                    acceptedPatterns, patterns);
        }
        acceptedPatterns = new HashSet<>(patterns.size());
        try {
@@ -81,7 +81,7 @@ public class DefaultExcludedPatternsChecker implements ExcludedPatternsChecker {

    @Inject(StrutsConstants.STRUTS_ENABLE_DYNAMIC_METHOD_INVOCATION)
    protected void setDynamicMethodInvocation(String dmiValue) {
-        if (BooleanUtils.toBoolean(dmiValue) == false) {
+        if (!BooleanUtils.toBoolean(dmiValue)) {
            LOG.debug("DMI is disabled, adding DMI related excluded patterns");
            setAdditionalExcludePatterns("^(action|method):.*");
        }
@@ -0,0 +1,105 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.opensymphony.xwork2.security;
+
+import com.opensymphony.xwork2.inject.Inject;
+
+import java.util.Set;
+import java.util.regex.Pattern;
+
+public class DefaultNotExcludedAcceptedPatternsChecker implements NotExcludedAcceptedPatternsChecker {
+    private ExcludedPatternsChecker excludedPatterns;
+    private AcceptedPatternsChecker acceptedPatterns;
+
+
+    @Inject
+    public void setExcludedPatterns(ExcludedPatternsChecker excludedPatterns) {
+        this.excludedPatterns = excludedPatterns;
+    }
+
+    @Inject
+    public void setAcceptedPatterns(AcceptedPatternsChecker acceptedPatterns) {
+        this.acceptedPatterns = acceptedPatterns;
+    }
+
+    @Override
+    public IsAllowed isAllowed(String value) {
+        IsExcluded isExcluded = isExcluded(value);
+        if (isExcluded.isExcluded()) {
+            return IsAllowed.no(isExcluded.getExcludedPattern());
+        }
+
+        IsAccepted isAccepted = isAccepted(value);
+        if (!isAccepted.isAccepted()) {
+            return IsAllowed.no(isAccepted.getAcceptedPattern());
+        }
+
+        return IsAllowed.yes(isAccepted.getAcceptedPattern());
+    }
+
+    @Override
+    public IsAccepted isAccepted(String value) {
+        return acceptedPatterns.isAccepted(value);
+    }
+
+    @Override
+    public void setAcceptedPatterns(String commaDelimitedPatterns) {
+        acceptedPatterns.setAcceptedPatterns(commaDelimitedPatterns);
+    }
+
+    @Override
+    public void setAcceptedPatterns(String[] patterns) {
+        acceptedPatterns.setAcceptedPatterns(patterns);
+    }
+
+    @Override
+    public void setAcceptedPatterns(Set<String> patterns) {
+        acceptedPatterns.setAcceptedPatterns(patterns);
+    }
+
+    @Override
+    public Set<Pattern> getAcceptedPatterns() {
+        return acceptedPatterns.getAcceptedPatterns();
+    }
+
+    @Override
+    public IsExcluded isExcluded(String value) {
+        return excludedPatterns.isExcluded(value);
+    }
+
+    @Override
+    public void setExcludedPatterns(String commaDelimitedPatterns) {
+        excludedPatterns.setExcludedPatterns(commaDelimitedPatterns);
+    }
+
+    @Override
+    public void setExcludedPatterns(String[] patterns) {
+        excludedPatterns.setExcludedPatterns(patterns);
+    }
+
+    @Override
+    public void setExcludedPatterns(Set<String> patterns) {
+        excludedPatterns.setExcludedPatterns(patterns);
+    }
+
+    @Override
+    public Set<Pattern> getExcludedPatterns() {
+        return excludedPatterns.getExcludedPatterns();
+    }
+}
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.opensymphony.xwork2.security;
+
+/**
+ * Used across different places to check if given string is not excluded and is accepted
+ * @see <a href="https://securitylab.github.com/research/apache-struts-double-evaluation/">here</a>
+ * @since 2.5.27
+ */
+public interface NotExcludedAcceptedPatternsChecker extends ExcludedPatternsChecker, AcceptedPatternsChecker {
+
+    /**
+     * Checks if value doesn't match excluded pattern and matches accepted pattern
+     *
+     * @param value to check
+     * @return object containing result of matched pattern and pattern itself
+     */
+    IsAllowed isAllowed(String value);
+
+    final class IsAllowed {
+
+        private final boolean allowed;
+        private final String allowedPattern;
+
+        public static IsAllowed yes(String allowedPattern) {
+            return new IsAllowed(true, allowedPattern);
+        }
+
+        public static IsAllowed no(String allowedPattern) {
+            return new IsAllowed(false, allowedPattern);
+        }
+
+        private IsAllowed(boolean allowed, String allowedPattern) {
+            this.allowed = allowed;
+            this.allowedPattern = allowedPattern;
+        }
+
+        public boolean isAllowed() {
+            return allowed;
+        }
+
+        public String getAllowedPattern() {
+            return allowedPattern;
+        }
+
+        @Override
+        public String toString() {
+            return "IsAllowed { " +
+                    "allowed=" + allowed +
+                    ", allowedPattern=" + allowedPattern +
+                    " }";
+        }
+    }
+}
@@ -31,8 +31,6 @@ import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.text.MessageFormat;
-import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
@@ -61,7 +59,7 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {

    private final ConcurrentMap<MessageFormatKey, MessageFormat> messageFormats = new ConcurrentHashMap<>();
    private final ConcurrentMap<Integer, List<String>> classLoaderMap = new ConcurrentHashMap<>();
-    private final Set<String> missingBundles = Collections.synchronizedSet(new HashSet<String>());
+    private final ConcurrentMap<String, Boolean> missingBundles = new ConcurrentHashMap<>();
    private final ConcurrentMap<Integer, ClassLoader> delegatedClassLoaderMap = new ConcurrentHashMap<>();

    /**
@@ -390,7 +388,7 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {
        ClassLoader classLoader = getCurrentThreadContextClassLoader();
        String key = createMissesKey(String.valueOf(classLoader.hashCode()), aBundleName, locale);

-        if (missingBundles.contains(key)) {
+        if (missingBundles.containsKey(key)) {
            return null;
        }

@@ -413,11 +411,11 @@ abstract class AbstractLocalizedTextProvider implements LocalizedTextProvider {
                    }
                } catch (MissingResourceException e) {
                    LOG.debug("Missing resource bundle [{}]!", aBundleName, e);
-                    missingBundles.add(key);
+                    missingBundles.putIfAbsent(key, Boolean.TRUE);
                }
            } else {
                LOG.debug("Missing resource bundle [{}]!", aBundleName);
-                missingBundles.add(key);
+                missingBundles.putIfAbsent(key, Boolean.TRUE);
            }
        }
        return bundle;
@@ -58,10 +58,25 @@ public class ResourceFinder {
        this(path, classLoaderInterface, null);
    }

+    /**
+     * Create a ResourceFinder instance for looking up resources (via ClassLoader or via specific URLs
+     * specifying resource locations).
+     * 
+     * This class was functional in Struts 2.3.x, but broken for Struts 2.5.x (before 2.5.24), when dealing with
+     * JAR resources in certain circumstances.  The current logic permits the base path to be "" (empty string),
+     * which is required to also match JAR entries rooted at "" and not just file entries rooted at "/".
+     * 
+     * @param path  Base path from which to look for resources (typically "xyz/abc/klm" form for file or
+     *              jar contents).
+     * @param classLoaderInterface  ClassLoader to perform the resource lookup.  If null, a default Thread
+     *              ClassLoader will be used.
+     * @param urls  URLs (typically file: or jar:) within which to search for resources, instead of the
+     *              ClassLoader.  If null, fallback to a ClassLoader instead.
+     */
    public ResourceFinder(String path, ClassLoaderInterface classLoaderInterface, URL... urls) {
        path = StringUtils.trimToEmpty(path);
-        if (!StringUtils.endsWith(path, "/")) {
-            path += "/";
+        if (!path.isEmpty() && !StringUtils.endsWith(path, "/")) {
+            path += "/";  // Only append terminator to nonempty paths, otherwise JAR entry lookups break.
        }
        this.path = path;

@@ -1015,15 +1030,26 @@ public class ResourceFinder {
    public Map<URL, Set<String>> findPackagesMap(String uri) throws IOException {
        String basePath = path + uri;

+        LOG.trace("    basePath(initial): " + basePath);
+
        if (!basePath.endsWith("/")) {
            basePath += "/";
        }
+
+        LOG.trace("    basePath(final): " + basePath);
+
        Enumeration<URL> urls = getResources(basePath);
        Map<URL, Set<String>> result = new HashMap<>();

+        if (! urls.hasMoreElements()) {
+            LOG.debug("    urls enumeration for basePath is empty ?");
+        }
+
        while (urls.hasMoreElements()) {
            URL location = urls.nextElement();

+            LOG.debug("       url (location): " + location);
+
            try {
                if ("jar".equals(location.getProtocol())) {
                    Set<String> resources = new HashSet<>();
@@ -1114,12 +1140,20 @@ public class ResourceFinder {
        jarfile = conn.getJarFile();

        Enumeration<JarEntry> entries = jarfile.entries();
+
+        if (entries == null || ! entries.hasMoreElements()) {
+            LOG.debug("           JAR entries null or empty");
+        }
+        LOG.debug("           Looking for entries matching basePath: " + basePath);
+
        while (entries != null && entries.hasMoreElements()) {
            JarEntry entry = entries.nextElement();
            String name = entry.getName();

            if (entry.isDirectory() && StringUtils.startsWith(name, basePath)) {
                resources.add(name);
+            } else if (entry.isDirectory()) {
+               LOG.trace("           entry: " + name + " , isDirectory: " + entry.isDirectory() + " but does not start with basepath");
            }
        }
    }
@@ -1156,13 +1190,22 @@ public class ResourceFinder {

    private Enumeration<URL> getResources(String fulluri) throws IOException {
        if (urls == null) {
+            LOG.debug("    urls (member) null, using classLoaderInterface to get resources");
+
            return classLoaderInterface.getResources(fulluri);
        }
+
+        LOG.debug("    urls (member) non-null, using findResource to get resources");
+
        Vector<URL> resources = new Vector<>();
        for (URL url : urls) {
            URL resource = findResource(fulluri, url);
-            if (resource != null){
+
+            if (resource != null) {
+                LOG.trace("    resource lookup non-null");
                resources.add(resource);
+            } else {
+                LOG.trace("    resource lookup is null");
            }
        }
        return resources.elements();
@@ -96,13 +96,13 @@ public final class StrutsConstants {

    /** Update freemarker templates cache in seconds */
    public static final String STRUTS_FREEMARKER_TEMPLATES_CACHE_UPDATE_DELAY = "struts.freemarker.templatesCache.updateDelay";
-    
+
    /** Cache model instances at BeanWrapper level */
    public static final String STRUTS_FREEMARKER_BEANWRAPPER_CACHE = "struts.freemarker.beanwrapperCache";
-    
+
    /** Maximum strong sizing for MruCacheStorage for freemarker */
    public static final String STRUTS_FREEMARKER_MRU_MAX_STRONG_SIZE = "struts.freemarker.mru.max.strong.size";
-    
+
    /** org.apache.struts2.views.velocity.VelocityManager implementation class */
    public static final String STRUTS_VELOCITY_MANAGER_CLASSNAME = "struts.velocity.manager.classname";

@@ -127,6 +127,9 @@ public final class StrutsConstants {
    /** The maximize size of a multipart request (file upload) */
    public static final String STRUTS_MULTIPART_MAXSIZE = "struts.multipart.maxSize";

+    /** The maximum length of a string parameter in a multipart request. */
+    public static final String STRUTS_MULTIPART_MAX_STRING_LENGTH = "struts.multipart.maxStringLength";
+
    /** The directory to use for storing uploaded files */
    public static final String STRUTS_MULTIPART_SAVEDIR = "struts.multipart.saveDir";

@@ -180,7 +183,7 @@ public final class StrutsConstants {
     * You can specify different prefixes that will be handled by different mappers
     */
    public static final String PREFIX_BASED_MAPPER_CONFIGURATION = "struts.mapper.prefixMapping";
-    
+
    /** Whether the Struts filter should serve static content or not */
    public static final String STRUTS_SERVE_STATIC_CONTENT = "struts.serve.static";

@@ -322,6 +325,7 @@ public final class StrutsConstants {
    /** Dedicated services to check if passed string is excluded/accepted */
    public static final String STRUTS_EXCLUDED_PATTERNS_CHECKER = "struts.excludedPatterns.checker";
    public static final String STRUTS_ACCEPTED_PATTERNS_CHECKER = "struts.acceptedPatterns.checker";
+    public static final String STRUTS_NOT_EXCLUDED_ACCEPTED_PATTERNS_CHECKER = "struts.notExcludedAcceptedPatterns.checker";

    /** Constant is used to override framework's default excluded patterns */
    public static final String STRUTS_OVERRIDE_EXCLUDED_PATTERNS = "struts.override.excludedPatterns";
@@ -83,4 +83,21 @@ public class Checkbox extends UIBean {
        this.fieldValue = fieldValue;
    }

+    /**
+     * Deprecated since 2.5.27
+     * @deprecated use {@link #setLabelPosition(String)} instead
+     */
+    @Deprecated
+    @Override
+    @StrutsTagAttribute(description="(Deprecated) Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme")
+    public void setLabelposition(String labelPosition) {
+        super.setLabelposition(labelPosition);
+    }
+
+    @Override
+    @StrutsTagAttribute(description="Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme")
+    public void setLabelPosition(String labelPosition) {
+        super.setLabelPosition(labelPosition);
+    }
+
 }
@@ -48,7 +48,7 @@ import com.opensymphony.xwork2.util.ValueStack;
        allowDynamicAttributes = true)
 public class CheckboxList extends ListUIBean {
    final public static String TEMPLATE = "checkboxlist";
-    
+
    public CheckboxList(ValueStack stack, HttpServletRequest request, HttpServletResponse response) {
        super(stack, request, response);
    }
@@ -56,9 +56,19 @@ public class CheckboxList extends ListUIBean {
    protected String getDefaultTemplate() {
        return TEMPLATE;
    }
-    
+
    public void evaluateExtraParams() {
    	super.evaluateExtraParams();
    }

-}
+    /**
+     * Checkboxlist tag requires lazy evaluation as list of tags is dynamically generated using <s:iterator/>
+     *
+     * @return boolean true by default
+     */
+    @Override
+    protected boolean lazyEvaluation() {
+        return true;
+    }
+
+}
@@ -19,6 +19,7 @@
 package org.apache.struts2.components;

 import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.util.TextParseUtil;
 import com.opensymphony.xwork2.util.ValueStack;
 import org.apache.commons.lang3.BooleanUtils;
@@ -70,6 +71,8 @@ public class Component {
    protected boolean throwExceptionOnELFailure;
    private UrlHelper urlHelper;

+    private NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns;
+
    /**
     * Constructor.
     *
@@ -112,6 +115,12 @@ public class Component {
    public void setUrlHelper(UrlHelper urlHelper) {
        this.urlHelper = urlHelper;
    }
+
+    @Inject
+    public void setNotExcludedAcceptedPatterns(NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns) {
+        this.notExcludedAcceptedPatterns = notExcludedAcceptedPatterns;
+    }
+
    /**
     * Gets the OGNL value stack associated with this component.
     * @return the OGNL value stack associated with this component.
@@ -276,7 +285,7 @@ public class Component {
    }

    /**
-     * If altsyntax (%{...}) is applied, simply strip the "%{" and "}" off. 
+     * If altsyntax (%{...}) is applied, simply strip the "%{" and "}" off.
     * @param expr the expression (must be not null)
     * @return the stripped expression if altSyntax is enabled. Otherwise
     * the parameter expression is returned as is.
@@ -296,11 +305,11 @@ public class Component {
    /**
     * Adds the surrounding %{ } to the expression for proper processing.
     * @param expr the expression.
-     * @return the modified expression if altSyntax is enabled, or the parameter 
+     * @return the modified expression if altSyntax is enabled, or the parameter
     * expression otherwise.
     */
 	protected String completeExpressionIfAltSyntax(String expr) {
-		if (altSyntax()) {
+		if (altSyntax() && !ComponentUtils.containsExpression(expr)) {
 			return "%{" + expr + "}";
 		}
 		return expr;
@@ -398,7 +407,7 @@ public class Component {
     * @return the action url.
     */
    protected String determineActionURL(String action, String namespace, String method,
-                                        HttpServletRequest req, HttpServletResponse res, Map parameters, String scheme,
+                                        HttpServletRequest req, HttpServletResponse res, Map<String, Object> parameters, String scheme,
                                        boolean includeContext, boolean encodeResult, boolean forceAddSchemeHostAndPort,
                                        boolean escapeAmp) {
        String finalAction = findString(action);
@@ -551,4 +560,22 @@ public class Component {
        return standardAttributes;
    }

+    /**
+     * Checks if expression doesn't contain vulnerable code
+     *
+     * @param expression of the component
+     * @return true|false
+     * @since 2.5.27
+     */
+    protected boolean isAcceptableExpression(String expression) {
+        NotExcludedAcceptedPatternsChecker.IsAllowed isAllowed = notExcludedAcceptedPatterns.isAllowed(expression);
+        if (isAllowed.isAllowed()) {
+            return true;
+        }
+
+        LOG.warn("Expression [{}] isn't allowed by pattern [{}]! See Accepted / Excluded patterns at\n" +
+                "https://struts.apache.org/security/", expression, isAllowed.getAllowedPattern());
+
+        return false;
+    }
 }
@@ -221,7 +221,7 @@ public class Form extends ClosingUIBean {
    @Override
    protected void populateComponentHtmlId(Form form) {
        if (id != null) {
-            addParameter("id", escape(id));
+            super.populateComponentHtmlId(null);
        }

        // if no id given, it will be tried to generate it from the action attribute
@@ -125,6 +125,7 @@ public abstract class FormButton extends ClosingUIBean {
            }
        }
        addParameter("id", _tmp_id);
+        addParameter("escapedId", escape(_tmp_id));
    }

    /**
@@ -188,7 +188,6 @@ public abstract class ListUIBean extends UIBean {
        this.listTitle = listTitle;
    }

-
    public void setThrowExceptionOnNullValueAttribute(boolean throwExceptionOnNullValueAttribute) {
        this.throwExceptionOnNullValueAttribute = throwExceptionOnNullValueAttribute;
    }
@@ -125,23 +125,29 @@ public class Param extends Component {
            if (component instanceof UnnamedParametric) {
                ((UnnamedParametric) component).addParameter(findValue(value));
            } else {
-                String name = findString(this.name);
+                String translatedName = findString(this.name);

-                if (name == null) {
+                if (translatedName == null) {
                    throw new StrutsException("No name found for following expression: " + this.name);
                }

-                Object value = findValue(this.value);
+                boolean evaluated = !translatedName.equals(this.name);
+                boolean reevaluate = !evaluated || isAcceptableExpression(translatedName);
+                if (!reevaluate) {
+                    throw new StrutsException("Excluded or not accepted name found: " + translatedName);
+                }
+
+                Object foundValue = findValue(this.value);
                if (suppressEmptyParameters) {
-                    if (value != null && StringUtils.isNotBlank(value.toString())) {
-                        component.addParameter(name, value);
+                    if (foundValue != null && StringUtils.isNotBlank(foundValue.toString())) {
+                        component.addParameter(translatedName, foundValue);
                    } else {
-                        component.addParameter(name, null);
+                        component.addParameter(translatedName, null);
                    }
-                } else if (value == null || StringUtils.isBlank(value.toString())) {
-                    component.addParameter(name, "");
+                } else if (foundValue == null || StringUtils.isBlank(foundValue.toString())) {
+                    component.addParameter(translatedName, "");
                } else {
-                    component.addParameter(name, value);
+                    component.addParameter(translatedName, foundValue);
                }
            }
        } else {
@@ -158,7 +164,8 @@ public class Param extends Component {

        return super.end(writer, "");
    }
-    
+
+    @Override
    public boolean usesBody() {
        return true;
    }
@@ -193,7 +200,7 @@ public class Param extends Component {
         * Adds the given value as a parameter to the outer tag.
         * @param value  the value
         */
-        public void addParameter(Object value);
+        void addParameter(Object value);
    }

 }
@@ -57,7 +57,7 @@ import javax.servlet.http.HttpServletResponse;
        allowDynamicAttributes = true)
 public class Radio extends ListUIBean {
    final public static String TEMPLATE = "radiomap";
-    
+
    public Radio(ValueStack stack, HttpServletRequest request, HttpServletResponse response) {
        super(stack, request, response);
    }
@@ -65,8 +65,19 @@ public class Radio extends ListUIBean {
    protected String getDefaultTemplate() {
        return TEMPLATE;
    }
-    
+
    public void evaluateExtraParams() {
    	super.evaluateExtraParams();
    }
-}
+
+    /**
+     * Radio tag requires lazy evaluation as list of tags is dynamically generated using <s:iterator/>
+     *
+     * @return boolean true by default
+     */
+    @Override
+    protected boolean lazyEvaluation() {
+        return true;
+    }
+
+}
@@ -188,7 +188,9 @@ public class ServletUrlRenderer implements UrlRenderer {

            // if the id isn't specified, use the action name
            if (formComponent.getId() == null && actionName != null) {
-                formComponent.addParameter("id", formComponent.escape(actionName));
+                String escapedId = formComponent.escape(actionName);
+                formComponent.addParameter("id", escapedId);
+                formComponent.addParameter("escapedId", escapedId);
            }
        } else if (action != null) {
            // Since we can't find an action alias in the configuration, we just
@@ -223,7 +225,9 @@ public class ServletUrlRenderer implements UrlRenderer {
                } else {
                    id = result.substring(slash + 1);
                }
-                formComponent.addParameter("id", formComponent.escape(id));
+                String escapedId = formComponent.escape(id);
+                formComponent.addParameter("id", escapedId);
+                formComponent.addParameter("escapedId", escapedId);
            }
        }

@@ -31,8 +31,7 @@ import com.opensymphony.xwork2.util.ValueStack;
 * complex expression and then simply reference that variable each time rather than the complex expression. This is
 * useful in both cases: when the complex expression takes time (performance improvement) or is hard to read (code
 * readability improvement).</p>
- * <p>If the tag is used with body content, the evaluation of the value parameter is omitted. Instead, the String to
- * which the body evaluates is set as value for the scoped variable.</p>
+ * <p>If the value parameter is omitted, the String to which the body evaluates is set as value for the scoped variable.</p>
 *
 * <p>The scopes available are as follows:</p>
 * <ul>
@@ -94,10 +93,10 @@ public class Set extends ContextBean {

        Object o;
        if (value == null) {
-            if (body != null && !body.equals("")) {
-                o = body;
-            } else {
+            if (body == null) {
                o = findValue("top");
+            } else {
+                o = body;
            }
        } else {
            o = findValue(value);
@@ -20,7 +20,9 @@ package org.apache.struts2.components;

 import com.opensymphony.xwork2.config.ConfigurationException;
 import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.util.TextParseUtil;
 import com.opensymphony.xwork2.util.ValueStack;
+import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -30,6 +32,7 @@ import org.apache.struts2.components.template.Template;
 import org.apache.struts2.components.template.TemplateEngine;
 import org.apache.struts2.components.template.TemplateEngineManager;
 import org.apache.struts2.components.template.TemplateRenderingContext;
+import org.apache.struts2.util.ComponentUtils;
 import org.apache.struts2.util.TextProviderHelper;
 import org.apache.struts2.views.annotations.StrutsTagAttribute;
 import org.apache.struts2.views.util.ContextUtil;
@@ -555,16 +558,13 @@ public abstract class UIBean extends Component {
    protected abstract String getDefaultTemplate();

    protected Template buildTemplateName(String myTemplate, String myDefaultTemplate) {
-        String template = myDefaultTemplate;
+        String templateName = myDefaultTemplate;

        if (myTemplate != null) {
-            template = findString(myTemplate);
+            templateName = findString(myTemplate);
        }

-        String templateDir = getTemplateDir();
-        String theme = getTheme();
-
-        return new Template(templateDir, theme, template);
+        return new Template(getTemplateDir(), getTheme(), templateName);

    }

@@ -581,71 +581,70 @@ public abstract class UIBean extends Component {
    }

    public String getTemplateDir() {
-        String templateDir = null;
+        String result = null;

        if (this.templateDir != null) {
-            templateDir = findString(this.templateDir);
+            result = findString(this.templateDir);
        }

        // If templateDir is not explicitly given,
        // try to find attribute which states the dir set to use
-        if (StringUtils.isBlank(templateDir)) {
-            templateDir = stack.findString("#attr.templateDir");
+        if (StringUtils.isBlank(result)) {
+            result = stack.findString("#attr.templateDir");
        }

        // Default template set
-        if (StringUtils.isBlank(templateDir)) {
-            templateDir = defaultTemplateDir;
+        if (StringUtils.isBlank(result)) {
+            result = defaultTemplateDir;
        }

        // Defaults to 'template'
-        if (StringUtils.isBlank(templateDir)) {
-            templateDir = "template";
+        if (StringUtils.isBlank(result)) {
+            result = "template";
        }

-        return templateDir;
+        return result;
    }

    public String getTheme() {
-        String theme = null;
+        String result = null;

        if (this.theme != null) {
-            theme = findString(this.theme);
+            result = findString(this.theme);
        }

-        if (StringUtils.isBlank(theme)) {
+        if (StringUtils.isBlank(result)) {
            Form form = (Form) findAncestor(Form.class);
            if (form != null) {
-                theme = form.getTheme();
+                result = form.getTheme();
            }
        }

        // If theme set is not explicitly given,
        // try to find attribute which states the theme set to use
-        if (StringUtils.isBlank(theme)) {
-            theme = stack.findString("#attr.theme");
+        if (StringUtils.isBlank(result)) {
+            result = stack.findString("#attr.theme");
        }

        // Default theme set
-        if (StringUtils.isBlank(theme)) {
-            theme = defaultUITheme;
+        if (StringUtils.isBlank(result)) {
+            result = defaultUITheme;
        }

-        return theme;
+        return result;
    }

    public void evaluateParams() {
-        String templateDir = getTemplateDir();
-        String theme = getTheme();
-        
-        addParameter("templateDir", templateDir);
-        addParameter("theme", theme);
+        String gotTheme = getTheme();
+
+        addParameter("templateDir", getTemplateDir());
+        addParameter("theme", gotTheme);
        addParameter("template", template != null ? findString(template) : getDefaultTemplate());
        addParameter("dynamicAttributes", dynamicAttributes);
        addParameter("themeExpansionToken", uiThemeExpansionToken);
-        addParameter("expandTheme", uiThemeExpansionToken + theme);
+        addParameter("expandTheme", uiThemeExpansionToken + gotTheme);

-        String name = null;
+        String translatedName = null;
        String providedLabel = null;

        if (this.key != null) {
@@ -661,8 +660,8 @@ public abstract class UIBean extends Component {
        }

        if (this.name != null) {
-            name = findString(this.name);
-            addParameter("name", name);
+            translatedName = findString(this.name);
+            addParameter("name", translatedName);
        }

        if (label != null) {
@@ -679,7 +678,9 @@ public abstract class UIBean extends Component {
        }

        if (labelPosition != null) {
-            addParameter("labelposition", findString(labelPosition));
+            String labelPosition = findString(this.labelPosition);
+            addParameter("labelposition", labelPosition);
+            addParameter("labelPosition", labelPosition);
        }

        if (requiredPosition != null) {
@@ -689,7 +690,7 @@ public abstract class UIBean extends Component {
        if (errorPosition != null) {
            addParameter("errorposition", findString(errorPosition));
        }
-        
+
        if (requiredLabel != null) {
            addParameter("required", findValue(requiredLabel, Boolean.class));
        }
@@ -784,25 +785,31 @@ public abstract class UIBean extends Component {


        // see if the value was specified as a parameter already
+        final String NAME_VALUE = "nameValue";
        if (parameters.containsKey("value")) {
-            parameters.put("nameValue", parameters.get("value"));
+            parameters.put(NAME_VALUE, parameters.get("value"));
        } else {
            if (evaluateNameValue()) {
                final Class valueClazz = getValueClassType();

                if (valueClazz != null) {
                    if (value != null) {
-                        addParameter("nameValue", findValue(value, valueClazz));
-                    } else if (name != null) {
-                        String expr = completeExpressionIfAltSyntax(name);
-
-                        addParameter("nameValue", findValue(expr, valueClazz));
+                        addParameter(NAME_VALUE, findValue(value, valueClazz));
+                    } else if (translatedName != null) {
+                        boolean evaluated = !translatedName.equals(this.name);
+                        boolean reevaluate = !evaluated || isAcceptableExpression(translatedName);
+                        if (!reevaluate) {
+                            addParameter(NAME_VALUE, translatedName);
+                        } else {
+                            String expr = completeExpressionIfAltSyntax(translatedName);
+                            addParameter(NAME_VALUE, findValue(expr, valueClazz));
+                        }
                    }
                } else {
                    if (value != null) {
-                        addParameter("nameValue", findValue(value));
-                    } else if (name != null) {
-                        addParameter("nameValue", findValue(name));
+                        addParameter(NAME_VALUE, findValue(value));
+                    } else if (translatedName != null) {
+                        addParameter(NAME_VALUE, findValue(translatedName));
                    }
                }
            }
@@ -816,10 +823,10 @@ public abstract class UIBean extends Component {
        if (form != null ) {
            addParameter("form", form.getParameters());

-            if ( name != null ) {
+            if ( translatedName != null ) {
                // list should have been created by the form component
                List<String> tags = (List<String>) form.getParameters().get("tagNames");
-                tags.add(name);
+                tags.add(translatedName);
            }
        }

@@ -887,7 +894,7 @@ public abstract class UIBean extends Component {
    protected String escape(String name) {
        // escape any possible values that can make the ID painful to work with in JavaScript
        if (name != null) {
-            return name.replaceAll("[\\/\\.\\[\\]]", "_");
+            return name.replaceAll("[^a-zA-Z0-9_]", "_");
        } else {
            return null;
        }
@@ -938,14 +945,14 @@ public abstract class UIBean extends Component {

    protected Map getTooltipConfig(UIBean component) {
        Object tooltipConfigObj = component.getParameters().get("tooltipConfig");
-        Map<String, String> tooltipConfig = new LinkedHashMap<>();
+        Map<String, String> result = new LinkedHashMap<>();

        if (tooltipConfigObj instanceof Map) {
            // we get this if its configured using
            // 1] UI component's tooltipConfig attribute  OR
            // 2] <param name="tooltip" value="" /> param tag value attribute

-            tooltipConfig = new LinkedHashMap<>((Map) tooltipConfigObj);
+            result = new LinkedHashMap<>((Map) tooltipConfigObj);
        } else if (tooltipConfigObj instanceof String) {

            // we get this if its configured using
@@ -955,23 +962,23 @@ public abstract class UIBean extends Component {

            for (String aTooltipConfigArray : tooltipConfigArray) {
                String[] configEntry = aTooltipConfigArray.trim().split("=");
-                String key = configEntry[0].trim();
-                String value;
+                String configKey = configEntry[0].trim();
+                String configValue;
                if (configEntry.length > 1) {
-                    value = configEntry[1].trim();
-                    tooltipConfig.put(key, value);
+                    configValue = configEntry[1].trim();
+                    result.put(configKey, configValue);
                } else {
-                    LOG.warn("component {} tooltip config param {} has no value defined, skipped", component, key);
+                    LOG.warn("component {} tooltip config param {} has no value defined, skipped", component, configKey);
                }
            }
        }
        if (component.javascriptTooltip != null)
-            tooltipConfig.put("jsTooltipEnabled", component.javascriptTooltip);
+            result.put("jsTooltipEnabled", component.javascriptTooltip);
        if (component.tooltipIconPath != null)
-            tooltipConfig.put("tooltipIcon", component.tooltipIconPath);
+            result.put("tooltipIcon", component.tooltipIconPath);
        if (component.tooltipDelay != null)
-            tooltipConfig.put("tooltipDelay", component.tooltipDelay);
-        return tooltipConfig;
+            result.put("tooltipDelay", component.tooltipDelay);
+        return result;
    }

    /**
@@ -1002,7 +1009,7 @@ public abstract class UIBean extends Component {
        } else {
            tryId = generatedId;
        }
-        
+
        //fix for https://issues.apache.org/jira/browse/WW-4299
        //do not assign value to id if tryId is null
        if (tryId != null) {
@@ -1021,9 +1028,7 @@ public abstract class UIBean extends Component {

    @StrutsTagAttribute(description="HTML id attribute")
    public void setId(String id) {
-        if (id != null) {
-            this.id = findString(id);
-        }
+        this.id = id;
    }

    @StrutsTagAttribute(description="The template directory.")
@@ -1050,7 +1055,8 @@ public abstract class UIBean extends Component {
        this.cssClass = cssClass;
    }

-    @StrutsTagAttribute(description="The css class to use for element - it's an alias of cssClass attribute.")
+    @Deprecated
+    @StrutsTagAttribute(description="(Deprecated) The css class to use for element - it's an alias of cssClass attribute.")
    public void setClass(String cssClass) {
        this.cssClass = cssClass;
    }
@@ -1095,8 +1101,19 @@ public abstract class UIBean extends Component {
        this.labelSeparator = labelseparator;
    }

-    @StrutsTagAttribute(description="Define label position of form element (top/left)")
+    /**
+     * Deprecated since 2.5.27
+     * @deprecated use {@link #setLabelPosition(String)} instead
+     */
+    @StrutsTagAttribute(description="(Deprecated) Define label position of form element (top/left)")
+    @Deprecated
    public void setLabelposition(String labelPosition) {
+        LOG.warn("\"labelposition\" attribute is deprecated, please use \"labelPosition\" instead!");
+        this.labelPosition = labelPosition;
+    }
+
+    @StrutsTagAttribute(description="Define label position of form element (top/left)")
+    public void setLabelPosition(String labelPosition) {
        this.labelPosition = labelPosition;
    }

@@ -1109,7 +1126,7 @@ public abstract class UIBean extends Component {
    public void setErrorPosition(String errorPosition) {
        this.errorPosition = errorPosition;
    }
-    
+
    @StrutsTagAttribute(description="The name to set for element")
    public void setName(String name) {
        this.name = name;
@@ -1241,31 +1258,47 @@ public abstract class UIBean extends Component {
        this.tooltipIconPath = tooltipIconPath;
    }

-    public void setDynamicAttributes(Map<String, Object> tagDynamicAttributes) {
-        for (Map.Entry<String, Object> entry : tagDynamicAttributes.entrySet()) {
-            String key = entry.getKey();
+    public void setDynamicAttributes(Map<String, String> tagDynamicAttributes) {
+        for (Map.Entry<String, String> entry : tagDynamicAttributes.entrySet()) {
+            String attrName = entry.getKey();
+            String attrValue = entry.getValue();

-            if (!isValidTagAttribute(key)) {
-                dynamicAttributes.put(key, entry.getValue());
+            if (!isValidTagAttribute(attrName)) {
+                if (ComponentUtils.altSyntax(getStack()) && ComponentUtils.containsExpression(attrValue) && !lazyEvaluation()) {
+                    String translated = TextParseUtil.translateVariables('%', attrValue, stack);
+                    dynamicAttributes.put(attrName, ObjectUtils.defaultIfNull(translated, attrValue));
+                } else {
+                    dynamicAttributes.put(attrName, attrValue);
+                }
            }
        }
    }

-    @Override
    /**
     * supports dynamic attributes for freemarker ui tags
-     * @see https://issues.apache.org/jira/browse/WW-3174
-     * @see https://issues.apache.org/jira/browse/WW-4166
+     * @see "https://issues.apache.org/jira/browse/WW-3174"
+     * @see "https://issues.apache.org/jira/browse/WW-4166"
     */
+    @Override
    public void copyParams(Map params) {
        super.copyParams(params);
        for (Object o : params.entrySet()) {
            Map.Entry entry = (Map.Entry) o;
-            String key = (String) entry.getKey();
-            if (!isValidTagAttribute(key) && !key.equals("dynamicAttributes")) {
-                dynamicAttributes.put(key, entry.getValue());
+            String entryKey = (String) entry.getKey();
+            if (!isValidTagAttribute(entryKey) && !entryKey.equals("dynamicAttributes")) {
+                dynamicAttributes.put(entryKey, entry.getValue());
            }
        }
    }

+    /**
+     * Used to avoid evaluating attributes in {@link #evaluateParams()} or {@link #evaluateExtraParams()}
+     * as evaluation will happen in tag's template
+     *
+     * @return boolean false if evaluation should be performed in ftl
+     */
+    protected boolean lazyEvaluation() {
+        return false;
+    }
+
 }
@@ -64,7 +64,7 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
    public void setFreemarkerManager(FreemarkerManager mgr) {
        this.freemarkerManager = mgr;
    }
-    
+
    public void renderTemplate(TemplateRenderingContext templateContext) throws Exception {
    	// get the various items required from the stack
        ValueStack stack = templateContext.getStack();
@@ -121,6 +121,10 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
        ActionInvocation ai = ActionContext.getContext().getActionInvocation();

        Object action = (ai == null) ? null : ai.getAction();
+        if (action == null) {
+            LOG.warn("Rendering tag {} out of Action scope, accessing directly JSPs is not recommended! " +
+                    "Please read https://struts.apache.org/security/#never-expose-jsp-files-directly", templateName);
+        }
        SimpleHash model = freemarkerManager.buildTemplateModel(stack, action, servletContext, req, res, config.getObjectWrapper());

        model.put("tag", templateContext.getTag());
@@ -144,10 +148,12 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
            }
        };

+        LOG.debug("Push tag on top of the stack");
+        stack.push(templateContext.getTag());
        try {
-            stack.push(templateContext.getTag());
            template.process(model, writer);
        } finally {
+            LOG.debug("Removes tag from top of the stack");
            stack.pop();
        }
    }
@@ -155,4 +161,4 @@ public class FreemarkerTemplateEngine extends BaseTemplateEngine {
    protected String getSuffix() {
        return "ftl";
    }
-}
+}
@@ -50,6 +50,7 @@ import com.opensymphony.xwork2.factory.ResultFactory;
 import com.opensymphony.xwork2.factory.ValidatorFactory;
 import com.opensymphony.xwork2.inject.ContainerBuilder;
 import com.opensymphony.xwork2.inject.Scope;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import com.opensymphony.xwork2.util.PatternMatcher;
 import com.opensymphony.xwork2.util.TextParser;
 import com.opensymphony.xwork2.util.ValueStackFactory;
@@ -424,6 +425,8 @@ public class DefaultBeanSelectionProvider extends AbstractBeanSelectionProvider
        /** Checker is used mostly in interceptors, so there be one instance of checker per interceptor with Scope.PROTOTYPE **/
        alias(ExcludedPatternsChecker.class, StrutsConstants.STRUTS_EXCLUDED_PATTERNS_CHECKER, builder, props, Scope.PROTOTYPE);
        alias(AcceptedPatternsChecker.class, StrutsConstants.STRUTS_ACCEPTED_PATTERNS_CHECKER, builder, props, Scope.PROTOTYPE);
+        alias(NotExcludedAcceptedPatternsChecker.class, StrutsConstants.STRUTS_NOT_EXCLUDED_ACCEPTED_PATTERNS_CHECKER
+                , builder, props, Scope.SINGLETON);

        switchDevMode(props);

@@ -192,7 +192,11 @@ public class HttpParameters implements Map<String, Parameter>, Cloneable {
            for (Map.Entry<String, Object> entry : requestParameterMap.entrySet()) {
                String name = entry.getKey();
                Object value = entry.getValue();
-                parameters.put(name, new Parameter.Request(name, value));
+                if (value instanceof Parameter) {
+                    parameters.put(name, (Parameter) value);
+                } else {
+                    parameters.put(name, new Parameter.Request(name, value));
+                }
            }

            return new HttpParameters(parameters);
@@ -54,6 +54,11 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
    protected long maxSize;
    protected boolean maxSizeProvided;

+    /**
+     * Specifies the maximum length of a string parameter in a multipart request.
+     */
+    protected Long maxStringLength;
+
    /**
     * Specifies the buffer size to use during streaming.
     */
@@ -88,6 +93,11 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
        this.maxSize = Long.parseLong(maxSize);
    }

+    @Inject(StrutsConstants.STRUTS_MULTIPART_MAX_STRING_LENGTH)
+    public void setMaxStringLength(String maxStringLength) {
+        this.maxStringLength = Long.parseLong(maxStringLength);
+    }
+
    @Inject
    public void setLocaleProviderFactory(LocaleProviderFactory localeProviderFactory) {
        defaultLocale = localeProviderFactory.createLocaleProvider().getLocale();
@@ -134,9 +144,9 @@ public abstract class AbstractMultiPartRequest implements MultiPartRequest {
        int forwardSlash = fileName.lastIndexOf('/');
        int backwardSlash = fileName.lastIndexOf('\\');
        if (forwardSlash != -1 && forwardSlash > backwardSlash) {
-            fileName = fileName.substring(forwardSlash + 1, fileName.length());
+            fileName = fileName.substring(forwardSlash + 1);
        } else {
-            fileName = fileName.substring(backwardSlash + 1, fileName.length());
+            fileName = fileName.substring(backwardSlash + 1);
        }
        return fileName;
    }
@@ -25,6 +25,7 @@ import org.apache.commons.fileupload.RequestContext;
 import org.apache.commons.fileupload.disk.DiskFileItem;
 import org.apache.commons.fileupload.disk.DiskFileItemFactory;
 import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.apache.struts2.dispatcher.LocalizedMessage;
@@ -34,7 +35,13 @@ import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;

 /**
 * Multipart form data request adapter for Jakarta Commons Fileupload package.
@@ -55,16 +62,15 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
     *
     * @param saveDir the directory to save off the file
     * @param request the request containing the multipart
-     * @throws java.io.IOException is thrown if encoding fails.
     */
-    public void parse(HttpServletRequest request, String saveDir) throws IOException {
+    public void parse(HttpServletRequest request, String saveDir) {
        try {
            setLocale(request);
            processUpload(request, saveDir);
        } catch (FileUploadException e) {
            LOG.warn("Request exceeded size limit!", e);
            LocalizedMessage errorMessage;
-            if(e instanceof FileUploadBase.SizeLimitExceededException) {
+            if (e instanceof FileUploadBase.SizeLimitExceededException) {
                FileUploadBase.SizeLimitExceededException ex = (FileUploadBase.SizeLimitExceededException) e;
                errorMessage = buildErrorMessage(e, new Object[]{ex.getPermittedSize(), ex.getActualSize()});
            } else {
@@ -100,7 +106,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
        LOG.debug("Item is a file upload");

        // Skip file uploads that don't have a file name - meaning that no file was selected.
-        if (item.getName() == null || item.getName().trim().length() < 1) {
+        if (item.getName() == null || item.getName().trim().isEmpty()) {
            LOG.debug("No file has been uploaded for the field: {}", item.getFieldName());
            return;
        }
@@ -117,26 +123,42 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
    }

    protected void processNormalFormField(FileItem item, String charset) throws UnsupportedEncodingException {
-        LOG.debug("Item is a normal form field");
+        try {
+            LOG.debug("Item is a normal form field");

-        List<String> values;
-        if (params.get(item.getFieldName()) != null) {
-            values = params.get(item.getFieldName());
-        } else {
-            values = new ArrayList<>();
-        }
+            List<String> values;
+            if (params.get(item.getFieldName()) != null) {
+                values = params.get(item.getFieldName());
+            } else {
+                values = new ArrayList<>();
+            }

-        // note: see http://jira.opensymphony.com/browse/WW-633
-        // basically, in some cases the charset may be null, so
-        // we're just going to try to "other" method (no idea if this
-        // will work)
-        if (charset != null) {
-            values.add(item.getString(charset));
-        } else {
-            values.add(item.getString());
+            long size = item.getSize();
+            if (size == 0) {
+                values.add(StringUtils.EMPTY);
+            } else if (size > maxStringLength) {
+                String errorKey = "struts.messages.upload.error.parameter.too.long";
+                LocalizedMessage localizedMessage = new LocalizedMessage(this.getClass(), errorKey, null,
+                    new Object[]{item.getFieldName(), maxStringLength, size});
+
+                if (!errors.contains(localizedMessage)) {
+                    errors.add(localizedMessage);
+                }
+                return;
+
+            } else if (charset != null) {
+                values.add(item.getString(charset));
+            } else {
+                // note: see https://issues.apache.org/jira/browse/WW-633
+                // basically, in some cases the charset may be null, so
+                // we're just going to try to "other" method (no idea if this
+                // will work)
+                values.add(item.getString());
+            }
+            params.put(item.getFieldName(), values);
+        } finally {
+            item.delete();
        }
-        params.put(item.getFieldName(), values);
-        item.delete();
    }

    protected List<FileItem> parseRequest(HttpServletRequest servletRequest, String saveDir) throws FileUploadException {
@@ -183,7 +205,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
            contentTypes.add(fileItem.getContentType());
        }

-        return contentTypes.toArray(new String[contentTypes.size()]);
+        return contentTypes.toArray(new String[0]);
    }

    /* (non-Javadoc)
@@ -209,7 +231,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
            fileList.add(new StrutsUploadedFile(storeLocation));
        }

-        return fileList.toArray(new UploadedFile[fileList.size()]);
+        return fileList.toArray(new UploadedFile[0]);
    }

    /* (non-Javadoc)
@@ -227,7 +249,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
            fileNames.add(getCanonicalName(fileItem.getName()));
        }

-        return fileNames.toArray(new String[fileNames.size()]);
+        return fileNames.toArray(new String[0]);
    }

    /* (non-Javadoc)
@@ -245,7 +267,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
            fileNames.add(((DiskFileItem) fileItem).getStoreLocation().getName());
        }

-        return fileNames.toArray(new String[fileNames.size()]);
+        return fileNames.toArray(new String[0]);
    }

    /* (non-Javadoc)
@@ -253,7 +275,7 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
     */
    public String getParameter(String name) {
        List<String> v = params.get(name);
-        if (v != null && v.size() > 0) {
+        if (v != null && !v.isEmpty()) {
            return v.get(0);
        }

@@ -272,8 +294,8 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
     */
    public String[] getParameterValues(String name) {
        List<String> v = params.get(name);
-        if (v != null && v.size() > 0) {
-            return v.toArray(new String[v.size()]);
+        if (v != null && !v.isEmpty()) {
+            return v.toArray(new String[0]);
        }

        return null;
@@ -310,14 +332,14 @@ public class JakartaMultiPartRequest extends AbstractMultiPartRequest {
    }

    /* (non-Javadoc)
-    * @see org.apache.struts2.dispatcher.multipart.MultiPartRequest#cleanUp()
-    */
+     * @see org.apache.struts2.dispatcher.multipart.MultiPartRequest#cleanUp()
+     */
    public void cleanUp() {
        Set<String> names = files.keySet();
        for (String name : names) {
            List<FileItem> items = files.get(name);
            for (FileItem item : items) {
-                LOG.debug("Removing file {} {}", name, item );
+                LOG.debug("Removing file {} {}", name, item);
                if (!item.isInMemory()) {
                    item.delete();
                }
@@ -343,6 +343,14 @@ public class FileUploadInterceptor extends AbstractInterceptor {
                validation.addFieldError(inputName, errMsg);
            }

+            if (LOG.isWarnEnabled()) {
+                LOG.warn(errMsg);
+            }
+        } else if (file.getContent() == null) {
+            String errMsg = getTextMessage(action, "struts.messages.error.uploading", new String[]{filename});
+            if (validation != null) {
+                validation.addFieldError(inputName, errMsg);
+            }
            if (LOG.isWarnEnabled()) {
                LOG.warn(errMsg);
            }
@@ -149,7 +149,7 @@ public class PostbackResult extends StrutsResultSupport {
        } else {
            String location = getLocation();
            // Do not prepend if the URL is a FQN
-            if (!location.matches("^([a-zA-z]+:)?//.*")) {
+            if (!location.matches("^([a-zA-Z]+:)?//.*")) {
                // If the URL is relative to the servlet context, prepend the servlet context path
                if (prependServletContext && (request.getContextPath() != null) && (request.getContextPath().length() > 0)) {
                    location = request.getContextPath() + location;
@@ -19,6 +19,8 @@
 package org.apache.struts2.result;

 import com.opensymphony.xwork2.ActionInvocation;
+import com.opensymphony.xwork2.inject.Inject;
+import com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;

@@ -100,6 +102,8 @@ public class StreamResult extends StrutsResultSupport {
    protected int bufferSize = 1024;
    protected boolean allowCaching = true;

+    private NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns;
+
    public StreamResult() {
        super();
    }
@@ -115,6 +119,11 @@ public class StreamResult extends StrutsResultSupport {
        return allowCaching;
    }

+    @Inject
+    public void setNotExcludedAcceptedPatterns(NotExcludedAcceptedPatternsChecker notExcludedAcceptedPatterns) {
+        this.notExcludedAcceptedPatterns = notExcludedAcceptedPatterns;
+    }
+
    /**
     * Set allowCaching to <tt>false</tt> to indicate that the client should be requested not to cache the data stream.
     * This is set to <tt>false</tt> by default
@@ -219,14 +228,17 @@ public class StreamResult extends StrutsResultSupport {
        OutputStream oOutput = null;

        try {
-            if (inputStream == null) {
+            String parsedInputName = conditionalParse(inputName, invocation);
+            boolean evaluated = parsedInputName != null && !parsedInputName.equals(inputName);
+            boolean reevaluate = !evaluated || isAcceptableExpression(parsedInputName);
+            if (inputStream == null && reevaluate) {
                LOG.debug("Find the inputstream from the invocation variable stack");
-                inputStream = (InputStream) invocation.getStack().findValue(conditionalParse(inputName, invocation));
+                inputStream = (InputStream) invocation.getStack().findValue(parsedInputName);
            }

            if (inputStream == null) {
-                String msg = ("Can not find a java.io.InputStream with the name [" + inputName + "] in the invocation stack. " +
-                    "Check the <param name=\"inputName\"> tag specified for this action.");
+                String msg = ("Can not find a java.io.InputStream with the name [" + parsedInputName + "] in the invocation stack. " +
+                    "Check the <param name=\"inputName\"> tag specified for this action is correct, not excluded and accepted.");
                LOG.error(msg);
                throw new IllegalArgumentException(msg);
            }
@@ -243,15 +255,16 @@ public class StreamResult extends StrutsResultSupport {

            LOG.debug("Set the content length: {}", contentLength);
            if (contentLength != null) {
-                String _contentLength = conditionalParse(contentLength, invocation);
-                int _contentLengthAsInt;
+                String translatedContentLength = conditionalParse(contentLength, invocation);
+                int contentLengthAsInt;
                try {
-                    _contentLengthAsInt = Integer.parseInt(_contentLength);
-                    if (_contentLengthAsInt >= 0) {
-                        oResponse.setContentLength(_contentLengthAsInt);
+                    contentLengthAsInt = Integer.parseInt(translatedContentLength);
+                    if (contentLengthAsInt >= 0) {
+                        oResponse.setContentLength(contentLengthAsInt);
                    }
                } catch(NumberFormatException e) {
-                    LOG.warn("failed to recognize {} as a number, contentLength header will not be set", _contentLength, e);
+                    LOG.warn("failed to recognize {} as a number, contentLength header will not be set",
+                            translatedContentLength, e);
                }
            }

@@ -292,4 +305,22 @@ public class StreamResult extends StrutsResultSupport {
        }
    }

+    /**
+     * Checks if expression doesn't contain vulnerable code
+     *
+     * @param expression of result
+     * @return true|false
+     * @since 2.5.27
+     */
+    protected boolean isAcceptableExpression(String expression) {
+        NotExcludedAcceptedPatternsChecker.IsAllowed isAllowed = notExcludedAcceptedPatterns.isAllowed(expression);
+        if (isAllowed.isAllowed()) {
+            return true;
+        }
+
+        LOG.warn("Expression [{}] isn't allowed by pattern [{}]! See Accepted / Excluded patterns at\n" +
+                "https://struts.apache.org/security/", expression, isAllowed.getAllowedPattern());
+
+        return false;
+    }
 }
@@ -102,7 +102,7 @@ public class StrutsUtil {
            return responseWrapper.getData();
        }
        catch (Exception e) {
-            LOG.debug("Cannot include {}", aName.toString(), e);
+            LOG.debug("Cannot include {}", aName, e);
            throw e;
        }
    }
@@ -125,7 +125,7 @@ public class StrutsUtil {
    }

    public String getText(String text) {
-        return (String) stack.findValue("getText('" + text + "')");
+        return (String) stack.findValue("getText('" + text.replace('\'', '"') + "')");
    }

    /*
@@ -68,9 +68,13 @@ public class SetTag extends ContextBeanTag {
    @Override
    protected String getBody() {
        if (trimBody) {
-            return super.getBody();
+            if (bodyContent == null) {
+                return null;
+            } else {
+                return bodyContent.getString().trim();
+            }
        } else {
-            return (bodyContent == null ? "" : bodyContent.getString());
+            return (bodyContent == null ? null : bodyContent.getString());
        }
    }
 }
@@ -18,9 +18,7 @@
 */
 package org.apache.struts2.views.jsp.ui;

-import org.apache.commons.lang3.ObjectUtils;
 import org.apache.struts2.components.UIBean;
-import org.apache.struts2.util.ComponentUtils;
 import org.apache.struts2.views.jsp.ComponentTagSupport;

 import javax.servlet.jsp.JspException;
@@ -32,6 +30,7 @@ import java.util.Map;
 * Abstract base class for all UI tags.
 */
 public abstract class AbstractUITag extends ComponentTagSupport implements DynamicAttributes {
+
    protected String cssClass;
    protected String cssErrorClass;
    protected String cssStyle;
@@ -40,7 +39,9 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
    protected String disabled;
    protected String label;
    protected String labelSeparator;
+    @Deprecated
    protected String labelposition;
+    protected String labelPosition;
    protected String requiredPosition;
    protected String errorPosition;
    protected String name;
@@ -78,7 +79,7 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
    protected String tooltipIconPath;

    // dynamic attributes.
-    protected Map<String, Object> dynamicAttributes = new HashMap<>();
+    protected Map<String, String> dynamicAttributes = new HashMap<>();

    protected void populateParams() {
        super.populateParams();
@@ -92,7 +93,11 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
        uiBean.setDisabled(disabled);
        uiBean.setLabel(label);
        uiBean.setLabelSeparator(labelSeparator);
-        uiBean.setLabelposition(labelposition);
+        if (labelposition != null && labelPosition == null) {
+            uiBean.setLabelposition(labelposition);
+        } else {
+            uiBean.setLabelPosition(labelPosition);
+        }
        uiBean.setRequiredPosition(requiredPosition);
        uiBean.setErrorPosition(errorPosition);
        uiBean.setName(name);
@@ -137,6 +142,10 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
        this.cssClass = cssClass;
    }

+    /**
+     * @deprecated Use {@link #setCssClass(String)} instead
+     */
+    @Deprecated
    public void setClass(String cssClass) {
        this.cssClass = cssClass;
    }
@@ -169,8 +178,17 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
        this.label = label;
    }

-    public void setLabelposition(String labelPosition) {
-        this.labelposition = labelPosition;
+    /**
+     * Deprecated since 2.5.27
+     * @deprecated use {@link #setLabelPosition(String)} instead
+     */
+    @Deprecated
+    public void setLabelposition(String labelposition) {
+        this.labelposition = labelposition;
+    }
+
+    public void setLabelPosition(String labelPosition) {
+        this.labelPosition = labelPosition;
    }

    public void setRequiredPosition(String requiredPosition) {
@@ -302,11 +320,7 @@ public abstract class AbstractUITag extends ComponentTagSupport implements Dynam
    }

    public void setDynamicAttribute(String uri, String localName, Object value) throws JspException {
-        if (ComponentUtils.altSyntax(getStack()) && ComponentUtils.isExpression(value.toString())) {
-            dynamicAttributes.put(localName, String.valueOf(ObjectUtils.defaultIfNull(findValue(value.toString()), value)));
-        } else {
-            dynamicAttributes.put(localName, value);
-        }
+        dynamicAttributes.put(localName, String.valueOf(value));
    }

 }
@@ -18,13 +18,12 @@
 */
 package org.apache.struts2.views.jsp.ui;

-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
+import com.opensymphony.xwork2.util.ValueStack;
 import org.apache.struts2.components.Checkbox;
 import org.apache.struts2.components.Component;

-import com.opensymphony.xwork2.util.ValueStack;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;

 /**
 * @see Checkbox
@@ -68,6 +68,7 @@ struts.multipart.parser=jakarta
 # uses javax.servlet.context.tempdir by default
 struts.multipart.saveDir=
 struts.multipart.maxSize=2097152
+struts.multipart.maxStringLength=4096

 ### Load custom property files (does not override struts.properties!)
 # struts.custom.properties=application,org/apache/struts2/extension/custom
@@ -26,6 +26,7 @@ struts.messages.invalid.content.type=Could not find a Content-Type for {0}. Veri
 struts.messages.removing.file=Removing file {0} {1}
 struts.messages.error.uploading=Error uploading: {0}
 struts.messages.error.file.too.large=File {0} is too large to be uploaded. Maximum allowed size is {4} bytes!
+struts.messages.upload.error.parameter.too.long=The request parameter "{0}" was too long.  Max length allowed is {1}, but found {2}!
 struts.messages.error.content.type.not.allowed=Content-Type not allowed: {0} "{1}" "{2}" {3}
 struts.messages.error.file.extension.not.allowed=File extension not allowed: {0} "{1}" "{2}" {3}

@@ -73,7 +73,19 @@
                com.opensymphony.xwork2.inject.,
                com.opensymphony.xwork2.ognl.,
                com.opensymphony.xwork2.security.,
-                com.opensymphony.xwork2.util." />
+                com.opensymphony.xwork2.util.,
+                org.apache.tomcat.,
+                org.apache.catalina.core.,
+                com.ibm.websphere.,
+                org.apache.geronimo.,
+                org.apache.openejb.,
+                org.apache.tomee.,
+                org.eclipse.jetty.,
+                org.mortbay.jetty.,
+                org.glassfish.,
+                org.jboss.as.,
+                org.wildfly.,
+                weblogic.," />

    <bean class="com.opensymphony.xwork2.ObjectFactory" name="struts"/>
    <bean type="com.opensymphony.xwork2.factory.ResultFactory" name="struts" class="org.apache.struts2.factory.StrutsResultFactory" />
@@ -190,6 +202,7 @@

    <bean type="com.opensymphony.xwork2.security.ExcludedPatternsChecker" name="struts" class="com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker" scope="prototype" />
    <bean type="com.opensymphony.xwork2.security.AcceptedPatternsChecker" name="struts" class="com.opensymphony.xwork2.security.DefaultAcceptedPatternsChecker" scope="prototype" />
+    <bean type="com.opensymphony.xwork2.security.NotExcludedAcceptedPatternsChecker" name="struts" class="com.opensymphony.xwork2.security.DefaultNotExcludedAcceptedPatternsChecker" scope="singleton" />

    <bean type="com.opensymphony.xwork2.config.providers.ValueSubstitutor" class="com.opensymphony.xwork2.config.providers.EnvsValueSubstitutor" scope="singleton"/>

@@ -24,16 +24,16 @@
  #set ($hasFieldErrors = $fieldErrors.get($parameters.name))
  #foreach ($error in $fieldErrors.get($parameters.name))
    <tr errorFor="$parameters.id">
-        #if ($parameters.labelposition == 'top')<td align="left" valign="top" colspan="2">#else<td align="center" valign="top" colspan="2">#end<span class="errorMessage">$!struts.htmlEncode($error)</span></td>
+        #if ($parameters.labelPosition == 'top')<td align="left" valign="top" colspan="2">#else<td align="center" valign="top" colspan="2">#end<span class="errorMessage">$!struts.htmlEncode($error)</span></td>
    </tr>
  #end
 #end
 ## if the label position is top,
 ## then give the label it's own row in the table
 <tr>
-#if ($parameters.labelposition && $parameters.labelposition == 'top')<td align="left" valign="top" colspan="2">#else<td align="right" valign="top">#end#if ($parameters.label)<label #if ($parameters.id) for="$!struts.htmlEncode($parameters.id)"#end#if ($hasFieldErrors) class="errorLabel"#else class="label"#end>#if ($parameters.required)<span class="required">*</span>#end$!struts.htmlEncode($parameters.label):</label>#end</td>
+#if ($parameters.labelPosition && $parameters.labelPosition == 'top')<td align="left" valign="top" colspan="2">#else<td align="right" valign="top">#end#if ($parameters.label)<label #if ($parameters.id) for="$!struts.htmlEncode($parameters.id)"#end#if ($hasFieldErrors) class="errorLabel"#else class="label"#end>#if ($parameters.required)<span class="required">*</span>#end$!struts.htmlEncode($parameters.label):</label>#end</td>
 ## add the extra row
-#if ($parameters.labelposition && $parameters.labelposition == 'top')
+#if ($parameters.labelPosition && $parameters.labelPosition == 'top')
 </tr>
 <tr>
 #end
@@ -23,12 +23,12 @@ NOTE: The 'header' stuff that follows is in this one file for checkbox due to th
 that for checkboxes we do not want the label field to show up as checkboxes handle their own
 lables
 -->
-<#assign hasFieldErrors = fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <div <#rt/><#if parameters.id??>id="wwgrp_${parameters.id}"<#rt/></#if> class="wwgrp">

 <#if hasFieldErrors>
 <div <#rt/><#if parameters.id??>id="wwerr_${parameters.id}"<#rt/></#if> class="wwerr">
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
    <div<#rt/>
    <#if parameters.id??>
     errorFor="${parameters.id}"<#rt/>
@@ -39,12 +39,12 @@ lables
 </#list>
 </div><#t/>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"") == 'left'>
+<#if (labelPos!"") == 'left'>
 <span <#rt/>
 <#if parameters.id??>id="wwlbl_${parameters.id}"<#rt/></#if> class="wwlbl">
 <label<#t/>
@@ -60,7 +60,7 @@ lables
 </span>
 </#if>

-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -72,14 +72,14 @@ lables
 </#if>

 <#include "/${parameters.templateDir}/simple/checkbox.ftl" />
-<#if (labelpos!"") != 'left'>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"") != 'left'>
+<#if (labelPos!"top") == 'top'>
 </div> <#rt/>
 <#else>
 </span>  <#rt/>
 </#if>
 <#if parameters.label??>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -98,7 +98,7 @@ lables
 </#if>
 </#if>
 <#if parameters.label??>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#rt/>
 <#else>
 </span> <#rt/>
@@ -20,21 +20,21 @@
 -->
 ${parameters.after!}<#t/>
    <#lt/>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#rt/>
 <#else>
 </span> <#rt/>
 </#if>
 <#if (parameters.errorposition!"top") == 'bottom'>
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
 <div <#rt/><#if parameters.id??>id="wwerr_${parameters.id}"<#rt/></#if> class="wwerr">
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
    <div<#rt/>
    <#if parameters.id??>
     errorFor="${parameters.id}"<#rt/>
@@ -46,4 +46,4 @@ ${parameters.after!}<#t/>
 </div><#t/>
 </#if>
 </#if>
-</div>
+</div>
@@ -22,13 +22,13 @@
 	Only show message if errors are available.
 	This will be done if ActionSupport is used.
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <div <#rt/><#if parameters.id??>id="wwgrp_${parameters.id}"<#rt/></#if> class="wwgrp">
-	
+
 <#if (parameters.errorposition!"top") == 'top'>
 <#if hasFieldErrors>
 <div <#rt/><#if parameters.id??>id="wwerr_${parameters.id}"<#rt/></#if> class="wwerr">
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
    <div<#rt/>
    <#if parameters.id??>
     errorFor="${parameters.id}"<#rt/>
@@ -41,13 +41,13 @@
 </#if>
 </#if>

-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
 <#if parameters.label??>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -69,7 +69,7 @@
        ${parameters.label?html}${parameters.labelseparator!":"?html}
 <#include "/${parameters.templateDir}/xhtml/tooltip.ftl" />
 	</label><#t/>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <br /><#rt/>
 <#else>
 </span> <#rt/>
@@ -19,15 +19,14 @@
 */
 -->
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/controlheader-core.ftl">
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
 </#if>
 <#if parameters.id??>id="wwctrl_${parameters.id}"<#rt/></#if> class="wwctrl">
-    
@@ -21,8 +21,8 @@
 <#if parameters.validate!false == true>
 <script type="text/javascript" src="${base}/struts/css_xhtml/validation.js"></script>
    <#if parameters.onsubmit??>
-        ${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.id}();")}
+        ${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.escapedId}();")}
    <#else>
-        ${tag.addParameter('onsubmit', "return validateForm_${parameters.id}();")}
+        ${tag.addParameter('onsubmit', "return validateForm_${parameters.escapedId}();")}
    </#if>
 </#if>
@@ -18,12 +18,12 @@
 * under the License.
 */
 -->
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -34,7 +34,7 @@
 </#if>
 ><#t/>
 <#include "/${parameters.templateDir}/simple/reset.ftl" />
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#t/>
 <#else>
 </span> <#t/>
@@ -19,12 +19,12 @@
 */
 -->
 <#include "/${parameters.templateDir}/simple/submit-close.ftl" />
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 </div> <#t/>
 <#else>
 </span> <#t/>
@@ -18,12 +18,12 @@
 * under the License.
 */
 -->
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"top") == 'top'>
+<#if (labelPos!"top") == 'top'>
 <div <#rt/>
 <#else>
 <span <#rt/>
@@ -30,7 +30,7 @@
        <#assign itemKeyStr = stack.findString('top')>
    </#if>
    <#if parameters.listLabelKey??>
-    <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale 
+    <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale
       file for it's localized value.  This is then used as a label -->
        <#assign itemValue = struts.getText(stack.findString(parameters.listLabelKey))/>
    <#elseif parameters.listValue??>
@@ -95,9 +95,10 @@
    <#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl" />
    <#include "/${parameters.templateDir}/${parameters.expandTheme}/scripting-events.ftl" />
    <#include "/${parameters.templateDir}/${parameters.expandTheme}/common-attributes.ftl" />
+    <#global evaluate_dynamic_attributes = true/>
    <#include "/${parameters.templateDir}/${parameters.expandTheme}/dynamic-attributes.ftl" />
        />
-<label<#rt/> 
+<label<#rt/>
    <#if parameters.id?has_content>
        for="${parameters.id?html}-${itemCount}"<#rt/>
    <#else>
@@ -106,11 +107,10 @@
        class="checkboxLabel">${itemValue?html}</label>
 </@s.iterator>
    <#else>
-    &nbsp;
 </#if>
 <input type="hidden" id="__multiselect_${parameters.id?html}" name="__multiselect_${parameters.name?html}"
       value=""<#rt/>
 <#if parameters.disabled!false>
       disabled="disabled"<#rt/>
 </#if>
- />
+ />
@@ -21,7 +21,7 @@
 <script type="text/javascript">
 	function autoPopulate_${parameters.escapedId?html}(targetElement) {
 		<#if parameters.headerKey?? && parameters.headerValue??>
-		if (targetElement.options[targetElement.selectedIndex].value == '${parameters.headerKey?html}') {
+		if (targetElement.options[targetElement.selectedIndex].value == '${parameters.headerKey?js_string}') {
 			return;
 		}
 		</#if>
@@ -30,7 +30,7 @@
 		    return;
 		}
 		</#if>
-		targetElement.form.elements['${parameters.name?html}'].value=targetElement.options[targetElement.selectedIndex].value;
+		targetElement.form.elements['${parameters.name?js_string}'].value=targetElement.options[targetElement.selectedIndex].value;
 	}
 </script>
 <#include "/${parameters.templateDir}/simple/text.ftl" />
@@ -18,7 +18,7 @@
 * under the License.
 */
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if parameters.cssClass?has_content && !(hasFieldErrors && parameters.cssErrorClass??)>
 class="${parameters.cssClass?html}"<#rt/>
 <#elseif parameters.cssClass?has_content && (hasFieldErrors && parameters.cssErrorClass??)>
@@ -72,9 +72,9 @@
 </#if>
 <script type="text/javascript">
    <#assign itemCount = startCount/>
-    var ${parameters.id}Group = new Array(${parameters.listSize} + ${startCount});
-    for (var i = 0; i < (${parameters.listSize} + ${startCount}); i++) {
-        ${parameters.id}Group[i] = [];
+    var ${parameters.escapedId}Group = new Array(${parameters.listSize?number?c} + ${startCount});
+    for (var i = 0; i < (${parameters.listSize?number?c} + ${startCount}); i++) {
+        ${parameters.escapedId}Group[i] = [];
    }

    <@s.iterator value="parameters.list">
@@ -90,11 +90,11 @@
        </#if>
        <#assign doubleItemCount = 0/>
        <#if parameters.doubleHeaderKey?? && parameters.doubleHeaderValue??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}] = new Option("${parameters.doubleHeaderValue?js_string}", "${parameters.doubleHeaderKey?js_string}");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}] = new Option("${parameters.doubleHeaderValue?js_string}", "${parameters.doubleHeaderKey?js_string}");
            <#assign doubleItemCount = doubleItemCount + 1/>
        </#if>
        <#if parameters.doubleEmptyOption??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}] = new Option("", "");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}] = new Option("", "");
            <#assign doubleItemCount = doubleItemCount + 1/>
        </#if>
    <@s.iterator value="${parameters.doubleList}">
@@ -130,15 +130,15 @@
              <#assign itemDoubleTitle = ''/>
            </#if>
        </#if>
-    ${parameters.id}Group[${itemCount}][${doubleItemCount}] = new Option("${doubleItemValue?js_string}", "${doubleItemKeyStr?js_string}");
+    ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}] = new Option("${doubleItemValue?js_string}", "${doubleItemKeyStr?js_string}");
        <#if itemDoubleCssClass??>
-    ${parameters.id}Group[${itemCount}][${doubleItemCount}].setAttribute("class","${itemDoubleCssClass?html}");
+    ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}].setAttribute("class","${itemDoubleCssClass}");
        </#if>
        <#if itemDoubleCssStyle??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}].setAttribute("style","${itemDoubleCssStyle?html}");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}].setAttribute("style","${itemDoubleCssStyle}");
        </#if>
        <#if itemDoubleTitle??>
-        ${parameters.id}Group[${itemCount}][${doubleItemCount}].setAttribute("title","${itemDoubleTitle?html}");
+        ${parameters.escapedId}Group[${itemCount}][${doubleItemCount}].setAttribute("title","${itemDoubleTitle}");
        </#if>

        <#assign doubleItemCount = doubleItemCount + 1/>
@@ -146,7 +146,7 @@
        <#assign itemCount = itemCount + 1/>
    </@s.iterator>

-    var ${parameters.id}Temp = document.${parameters.formName}.${parameters.doubleId};
+    var ${parameters.escapedId}Temp = document.${parameters.formName}.${parameters.doubleId};
    <#assign itemCount = startCount/>
    <#assign redirectTo = 0/>
    <@s.iterator value="parameters.list">
@@ -160,34 +160,34 @@
        </#if>
        <#assign itemCount = itemCount + 1/>
    </@s.iterator>
-    ${parameters.id}Redirect(${redirectTo});
-    function ${parameters.id}Redirect(x) {
+    ${parameters.escapedId}Redirect(${redirectTo});
+    function ${parameters.escapedId}Redirect(x) {
        var selected = false;
-        for (var m = ${parameters.id}Temp.options.length - 1; m >= 0; m--) {
-            ${parameters.id}Temp.remove(m);
+        for (var m = ${parameters.escapedId}Temp.options.length - 1; m >= 0; m--) {
+            ${parameters.escapedId}Temp.remove(m);
        }

-        for (var i = 0; i < ${parameters.id}Group[x].length; i++) {
-            ${parameters.id}Temp.options[i] = new Option(${parameters.id}Group[x][i].text, ${parameters.id}Group[x][i].value);
+        for (var i = 0; i < ${parameters.escapedId}Group[x].length; i++) {
+            ${parameters.escapedId}Temp.options[i] = new Option(${parameters.escapedId}Group[x][i].text, ${parameters.escapedId}Group[x][i].value);
        <#if parameters.doubleNameValue??>
            <#if parameters.doubleMultiple??>
                for (var j = 0; j < ${parameters.doubleNameValue}.length; j++) {
-                    if (${parameters.id}Temp.options[i].value == ${parameters.doubleNameValue?js_string}[j]) {
-                        ${parameters.id}Temp.options[i].selected = true;
+                    if (${parameters.escapedId}Temp.options[i].value == ${parameters.doubleNameValue?js_string}[j]) {
+                        ${parameters.escapedId}Temp.options[i].selected = true;
                        selected = true;
                    }
                }
                <#else>
-                    if (${parameters.id}Temp.options[i].value == '${parameters.doubleNameValue?js_string}') {
-                        ${parameters.id}Temp.options[i].selected = true;
+                    if (${parameters.escapedId}Temp.options[i].value == '${parameters.doubleNameValue?js_string}') {
+                        ${parameters.escapedId}Temp.options[i].selected = true;
                        selected = true;
                    }
            </#if>
        </#if>
        }

-        if ((${parameters.id}Temp.options.length > 0) && (! selected)) {
-            ${parameters.id}Temp.options[0].selected = true;
+        if ((${parameters.escapedId}Temp.options.length > 0) && (! selected)) {
+            ${parameters.escapedId}Temp.options[0].selected = true;
        }
    }
 </script>
@@ -23,10 +23,14 @@
 <#list aKeys as aKey><#rt/>
  <#assign keyValue = parameters.dynamicAttributes.get(aKey)/>
  <#if keyValue?is_string>
-      <#assign value = struts.translateVariables(keyValue)!keyValue/>
+    <#if evaluate_dynamic_attributes!false == true>
+      <#assign value = struts.translateVariables(keyValue)!keyValue/><#rt/>
+    <#else>
+      <#assign value = keyValue/><#rt/>
+    </#if>
  <#else>
-      <#assign value = keyValue?string/>
+    <#assign value = keyValue?string/><#rt/>
  </#if>
 ${aKey}="${value?html}"<#rt/>
 </#list><#rt/>
-</#if><#rt/>
+</#if><#rt/>
@@ -29,7 +29,7 @@
            <#list eKeys as eKey><#t/>
                <#if (eKey = fieldErrorFieldName)><#t/>
                    <#assign haveMatchedErrorField=true><#t/>
-                    <#assign eValue = fieldErrors[fieldErrorFieldName]><#t/>
+                    <#assign eValue = fieldErrors.get(fieldErrorFieldName)><#t/>
                    <#if (haveMatchedErrorField && (!doneStartUlTag))><#t/>
                    <ul<#rt/>
                        <#if parameters.id?has_content>
@@ -69,7 +69,7 @@
            </#if>
                >
            <#list eKeys as eKey><#t/>
-                <#assign eValue = fieldErrors[eKey]><#t/>
+                <#assign eValue = fieldErrors.get(eKey)><#t/>
                <#list eValue as eEachValue><#t/>
                    <li><span><#if parameters.escape>${eEachValue!?html}<#else>${eEachValue!}</#if></span></li>
                </#list><#t/>
@@ -27,15 +27,15 @@
  submission.
 -->
 <#if (parameters.optiontransferselectIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign selectObjIds = parameters.optiontransferselectIds.keySet() />
 	<#list selectObjIds as selectObjectId>
 		StrutsUtils.addEventListener(containingForm, "submit", 
 			function(evt) {
-				var selectObj = document.getElementById("${selectObjectId}");
+				var selectObj = document.getElementById("${selectObjectId?js_string}");
 				<#if parameters.optiontransferselectIds.get(selectObjectId)??>
 					<#assign selectTagHeaderKey = parameters.optiontransferselectIds.get(selectObjectId)/>
-					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey}");
+					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(selectObj, "key", "");
 				</#if>
@@ -43,15 +43,15 @@
 	</#list>
 </#if>
 <#if (parameters.inputtransferselectIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign selectObjIds = parameters.inputtransferselectIds.keySet() />
 	<#list selectObjIds as selectObjectId>
 		StrutsUtils.addEventListener(containingForm, "submit",
 			function(evt) {
-				var selectObj = document.getElementById("${selectObjectId}");
+				var selectObj = document.getElementById("${selectObjectId?js_string}");
 				<#if parameters.inputtransferselectIds.get(selectObjectId)??>
 					<#assign selectTagHeaderKey = parameters.inputtransferselectIds.get(selectObjectId)/>
-					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey}");
+					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(selectObj, "key", "");
 				</#if>
@@ -59,15 +59,15 @@
 	</#list>
 </#if>
 <#if (parameters.optiontransferselectDoubleIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign selectDoubleObjIds = parameters.optiontransferselectDoubleIds.keySet() />
 	<#list selectDoubleObjIds as selectObjId>
 		StrutsUtils.addEventListener(containingForm, "submit", 
 			function(evt) {
-				var selectObj = document.getElementById("${selectObjId}");
+				var selectObj = document.getElementById("${selectObjId?js_string}");
 				<#if parameters.optiontransferselectDoubleIds.get(selectObjId)??>
 					<#assign selectTagHeaderKey = parameters.optiontransferselectDoubleIds.get(selectObjId)/>
-					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey}");
+					selectAllOptionsExceptSome(selectObj, "key", "${selectTagHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(selectObj, "key", "");
 				</#if>
@@ -81,15 +81,15 @@
 	submission
 -->
 <#if (parameters.updownselectIds!?size > 0)>
-	var containingForm = document.getElementById("${parameters.id}");
+	var containingForm = document.getElementById("${parameters.id?js_string}");
 	<#assign tmpIds = parameters.updownselectIds.keySet() />
 	<#list tmpIds as tmpId>
 		StrutsUtils.addEventListener(containingForm, "submit", 
 			function(evt) {
-				var updownselectObj = document.getElementById("${tmpId}");
+				var updownselectObj = document.getElementById("${tmpId?js_string}");
 				<#if parameters.updownselectIds.get(tmpId)??>
 					<#assign tmpHeaderKey = parameters.updownselectIds.get(tmpId) />
-					selectAllOptionsExceptSome(updownselectObj, "key", "${tmpHeaderKey}");
+					selectAllOptionsExceptSome(updownselectObj, "key", "${tmpHeaderKey?js_string}");
 				<#else>
 					selectAllOptionsExceptSome(updownselectObj, "key", "");
 				</#if>
@@ -27,7 +27,7 @@
        <#assign itemKeyStr = stack.findString('top')>
    </#if>
    <#if parameters.listValueKey??>
-        <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale 
+        <#-- checks the valueStack for the 'valueKey.' The valueKey is then looked-up in the locale
             file for it's localized value.  This is then used as a label -->
        <#assign valueKey = stack.findString(parameters.listValueKey)!''/>
        <#if valueKey?has_content>
@@ -94,9 +94,10 @@
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl" />
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/scripting-events.ftl" />
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/common-attributes.ftl" />
+<#global evaluate_dynamic_attributes = true/>
 <#include "/${parameters.templateDir}/${parameters.expandTheme}/dynamic-attributes.ftl" />
 /><#rt/>
 <label for="${parameters.id?html}${itemKeyStr?html}"<#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl"/>><#rt/>
    ${itemValue}<#t/>
 </label>
-</@s.iterator>
+</@s.iterator>
@@ -18,9 +18,9 @@
 * under the License.
 */
 -->
-<#assign hasFieldErrors = fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
 <tr<#rt/>
 <#if parameters.id??>
 errorFor="${parameters.id}"<#rt/>
@@ -32,12 +32,12 @@
 </tr>
 </#list>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
 <tr>
    <td colspan="2">
 <#if parameters.label??> <label<#t/>
@@ -71,7 +71,7 @@ ${parameters.label?html}<#t/>
 <#else>
 <tr>
 	<td class="tdCheckboxLabel">
-<#if (labelpos!"") == 'left'>
+<#if (labelPos!"") == 'left'>
 <#if parameters.label??> <label<#t/>
 <#if parameters.id??>
 for="${parameters.id?html}"<#rt/>
@@ -96,7 +96,7 @@ ${parameters.label?html}<#t/>
 </label><#t/>
 </#if>
 </#if>
-<#if (labelpos!"") == 'right'>
+<#if (labelPos!"") == 'right'>
    <#if parameters.required!false>
        <span class="required">*</span><#t/>
    </#if>
@@ -107,10 +107,10 @@ ${parameters.label?html}<#t/>
    </td>
    <td class="tdCheckboxInput">

-<#if (labelpos!"") != 'top'>
+<#if (labelPos!"") != 'top'>
 <#include "/${parameters.templateDir}/simple/checkbox.ftl" />
-</#if>                    
-<#if (labelpos!"") != 'top' && (labelpos!"") != 'left'>
+</#if>
+<#if (labelPos!"") != 'top' && (labelPos!"") != 'left'>
 <#if parameters.label??> <label<#t/>
 <#if parameters.id??>
 for="${parameters.id?html}"<#rt/>
@@ -22,9 +22,9 @@ ${parameters.after!}<#t/>
    </td><#lt/>
 </tr>
 <#if (parameters.errorposition!"top") == 'bottom'>
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if hasFieldErrors>
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
 <tr errorFor="${parameters.id}">
    <td class="tdErrorMessage" colspan="2"><#rt/>
        <span class="errorMessage">${error?html}</span><#t/>
@@ -22,10 +22,10 @@
 	Only show message if errors are available.
 	This will be done if ActionSupport is used.
 -->
-<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/>
+<#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors.get(parameters.name)??/>
 <#if (parameters.errorposition!"top") == 'top'>
 <#if hasFieldErrors>
-<#list fieldErrors[parameters.name] as error>
+<#list fieldErrors.get(parameters.name) as error>
 <tr errorFor="${parameters.id}">
    <td class="tdErrorMessage" colspan="2"><#rt/>
        <span class="errorMessage">${error?html}</span><#t/>
@@ -34,17 +34,17 @@
 </#list>
 </#if>
 </#if>
-<#if !parameters.labelposition?? && (parameters.form.labelposition)??>
-<#assign labelpos = parameters.form.labelposition/>
-<#elseif parameters.labelposition??>
-<#assign labelpos = parameters.labelposition/>
+<#if !parameters.labelPosition?? && (parameters.form.labelPosition)??>
+<#assign labelPos = parameters.form.labelPosition/>
+<#elseif parameters.labelPosition??>
+<#assign labelPos = parameters.labelPosition/>
 </#if>
 <#--
 	if the label position is top,
 	then give the label it's own row in the table
 -->
 <tr>
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
    <td class="tdLabelTop" colspan="2"><#rt/>
 <#else>
    <td class="tdLabel"><#rt/>
@@ -73,7 +73,7 @@ ${parameters.labelseparator!":"?html}<#t/>
 </#if>
    </td><#lt/>
 <#-- add the extra row -->
-<#if (labelpos!"") == 'top'>
+<#if (labelPos!"") == 'top'>
 </tr>
 <tr>
 </#if>
@@ -33,7 +33,7 @@ END SNIPPET: supported-validators
 -->
 <#if ((parameters.validate!false == true) && (parameters.performValidation!false == true))>
 <script type="text/javascript">
-    function validateForm_${parameters.id?replace('[^a-zA-Z0-9_]', '_', 'r')}() {
+    function validateForm_${parameters.escapedId}() {
        <#--
            In case of multiselect fields return only the first value.
        -->
@@ -54,7 +54,7 @@ END SNIPPET: supported-validators
            }
            return field.value;
        }
-        form = document.getElementById("${parameters.id}");
+        form = document.getElementById("${parameters.id?js_string}");
        clearErrorMessages(form);
        clearErrorLabels(form);

@@ -62,10 +62,10 @@ END SNIPPET: supported-validators
        var continueValidation = true;
    <#list parameters.tagNames as tagName>
        <#list tag.getValidators("${tagName}") as aValidator>
-        // field name: ${aValidator.fieldName}
+        // field name: ${aValidator.fieldName?js_string}
        // validator name: ${aValidator.validatorType}
-        if (form.elements['${aValidator.fieldName}']) {
-            field = form.elements['${aValidator.fieldName}'];
+        if (form.elements['${aValidator.fieldName?js_string}']) {
+            field = form.elements['${aValidator.fieldName?js_string}'];
            <#if aValidator.validatorType = "field-visitor">
                <#assign validator = aValidator.fieldValidator >
                //visitor validator switched to: ${validator.validatorType}
@@ -24,7 +24,7 @@
 <#if parameters.focusElement??>
 <script type="text/javascript">
    StrutsUtils.addOnLoad(function() {
-        var element = document.getElementById("${parameters.focusElement?html}");
+        var element = document.getElementById("${parameters.focusElement?js_string}");
        if(element) {
            element.focus();
        }
@@ -22,8 +22,8 @@
 	<script type="text/javascript" src="${base}/struts/xhtml/validation.js"></script>
 	<script type="text/javascript" src="${base}/struts/utils.js"></script>
 	<#if parameters.onsubmit??>
-		${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.id?replace('[^a-zA-Z0-9_]', '_', 'r')}();")}
+		${tag.addParameter('onsubmit', "${parameters.onsubmit}; return validateForm_${parameters.escapedId}();")}
 	<#else>
-		${tag.addParameter('onsubmit', "return validateForm_${parameters.id?replace('[^a-zA-Z0-9_]', '_', 'r')}();")}
+		${tag.addParameter('onsubmit', "return validateForm_${parameters.escapedId}();")}
 	</#if>
 </#if>
@@ -63,7 +63,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -193,6 +193,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -207,7 +215,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">method</td>
@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>
@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>
@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -137,6 +137,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -151,7 +159,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left), also 'right' is supported when using 'xhtml' theme</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">name</td>
@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -129,6 +129,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -143,7 +151,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>
@@ -47,7 +47,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">The css class to use for element - it's an alias of cssClass attribute.</td>
+					<td align="left" valign="top">(Deprecated) The css class to use for element - it's an alias of cssClass attribute.</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">cssClass</td>
@@ -153,6 +153,14 @@ Please do not edit it directly.
 					<td align="left" valign="top">String</td>
 					<td align="left" valign="top">Label expression used for rendering an element specific label</td>
 				</tr>
+				<tr>
+					<td align="left" valign="top">labelPosition</td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top"></td>
+					<td align="left" valign="top">false</td>
+					<td align="left" valign="top">String</td>
+					<td align="left" valign="top">Define label position of form element (top/left)</td>
+				</tr>
 				<tr>
 					<td align="left" valign="top">labelSeparator</td>
 					<td align="left" valign="top">false</td>
@@ -167,7 +175,7 @@ Please do not edit it directly.
 					<td align="left" valign="top"></td>
 					<td align="left" valign="top">false</td>
 					<td align="left" valign="top">String</td>
-					<td align="left" valign="top">Define label position of form element (top/left)</td>
+					<td align="left" valign="top">(Deprecated) Define label position of form element (top/left)</td>
 				</tr>
 				<tr>
 					<td align="left" valign="top">list</td>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Lukasz Lenart	bfb6c5431b	[maven-release-plugin] prepare release STRUTS_2_5_32	2023-09-11 08:17:13 +02:00
Lukasz Lenart	4257bd99c1	Uses proper maven version	2023-09-06 19:33:48 +02:00
Lukasz Lenart	4e7b8a466f	Uses latest maven version supporting Java 7	2023-09-06 19:30:52 +02:00
Lukasz Lenart	bf54436869	Always delete uploaded file	2023-09-03 08:52:11 +02:00
Lukasz Lenart	00b000bd5b	[maven-release-plugin] prepare for next development iteration	2023-06-13 10:05:14 +02:00
Lukasz Lenart	8274f77bc1	[maven-release-plugin] prepare release STRUTS_2_5_31	2023-06-13 10:05:05 +02:00
Lukasz Lenart	87a18db15f	Uses proper plugin attribute to disable doclint	2023-06-13 10:01:22 +02:00
Yasser Zamani	e58edfba83	add some improvements	2023-06-05 01:15:15 +04:30
Lukasz Lenart	2520513310	[maven-release-plugin] prepare for next development iteration	2022-03-15 14:53:45 +01:00
Lukasz Lenart	e4db6b720e	[maven-release-plugin] prepare release STRUTS_2_5_30	2022-03-15 14:53:37 +01:00
Lukasz Lenart	e1209fde05	Merge pull request #496 from apache/fix/double_evaluations_2_5 Fixes double evaluations	2022-03-15 14:33:04 +01:00
Lukasz Lenart	cf1c674feb	WW-5172 Upgrades Freemarker to version 2.3.31	2022-03-15 14:26:33 +01:00
Lukasz Lenart	992ca3a525	WW-5170 Upgrades Jackson Core to 2.10.5 and Jackson Databind to 2.10.5.1	2022-02-14 07:52:18 +01:00
Yasser Zamani	e7834d4345	Revert "keep dynamic attributes order" This reverts commit `8a46e931`	2022-01-20 02:22:13 +03:30
Yasser Zamani	bb6c186078	fix test for jdk8+	2022-01-20 02:17:05 +03:30
Yasser Zamani	88f04fa337	Revert "keep dynamic attributes order" This reverts commit `8a46e931`	2022-01-20 01:30:00 +03:30
Yasser Zamani	8a46e9313f	keep dynamic attributes order	2022-01-19 23:10:46 +03:30
Yasser Zamani	4e05233cc2	reorder to pass tests after merge	2022-01-18 10:18:06 +03:30
Yasser Zamani	e647e5cbfc	Merge branch 'struts-2-5-x' into fix/double_evaluations_2_5	2022-01-18 10:10:16 +03:30
Lukasz Lenart	8d0382c34e	[maven-release-plugin] prepare for next development iteration	2022-01-13 08:48:34 +01:00
Lukasz Lenart	00be9803d5	[maven-release-plugin] prepare release STRUTS_2_5_29	2022-01-13 08:48:24 +01:00
Lukasz Lenart	e6b9aaba54	Fixes wrong SNAPSHOT version in BOM	2022-01-13 08:39:48 +01:00
Lukasz Lenart	c495824e56	Merge pull request #524 from apache/WW-5117-evaluate-dynamic-attributes [WW-5117] Evaluates dynamic attributes	2022-01-13 08:16:49 +01:00
Lukasz Lenart	5c247b38ed	WW-5117 Uses translateVariables instead of findString to allow join expressions	2022-01-06 09:06:26 +01:00
Lukasz Lenart	a7fdf13446	WW-5117 Does a conditional evaluation depending on the tag Some tags requires to perform a lazy evaluation which can only happen in ftl template as performing it in the component class is not possible	2022-01-06 09:06:26 +01:00
Lukasz Lenart	2825fdb41a	WW-5117 Evaluates dynamic attributes when assigning them to tag Reverts https://github.com/apache/struts/pull/447/commits/8bbe1949e17d58e1b5aef9c71e1279ad12ad7ba7#diff-0a39f082871f48bd14037ab2e3a3911b0b1046506c1d93338024d77d412a7075L305-L309	2022-01-06 09:06:26 +01:00
Lukasz Lenart	5e624faa82	WW-5117 Restores previous behavior where tag was before action on stack	2022-01-06 09:06:26 +01:00
Lukasz Lenart	377c0cb20b	Fixes versioning after the latest release	2022-01-06 09:05:08 +01:00
Lukasz Lenart	25da849d0a	[maven-release-plugin] prepare for next development iteration	2021-12-30 07:34:55 +01:00
Lukasz Lenart	9f14276c00	[maven-release-plugin] prepare release STRUTS_2_5_28_3	2021-12-30 07:34:46 +01:00
Lukasz Lenart	45ccf7d83b	Upgrades Log4j to version 2.12.4	2021-12-30 07:29:43 +01:00
Lukasz Lenart	6ae6283f5e	[maven-release-plugin] prepare for next development iteration	2021-12-22 07:43:19 +01:00
Lukasz Lenart	53aeafd7a2	[maven-release-plugin] prepare release STRUTS_2_5_28_2	2021-12-22 07:43:10 +01:00
Lukasz Lenart	3dd751b730	Upgrades Log4j to version 2.12.3	2021-12-22 07:38:22 +01:00
Lukasz Lenart	93303b45cb	[maven-release-plugin] prepare for next development iteration	2021-12-16 16:33:51 +01:00
Lukasz Lenart	8ce5811fe7	[maven-release-plugin] prepare release STRUTS_2_5_28_1	2021-12-16 16:33:42 +01:00
Lukasz Lenart	dc349dd356	Upgrades Log4j to version 2.12.2	2021-12-16 16:29:14 +01:00
Lukasz Lenart	18ff6c1ef4	[maven-release-plugin] prepare for next development iteration	2021-11-29 08:34:12 +01:00
Lukasz Lenart	dc579c0ccc	[maven-release-plugin] prepare release STRUTS_2_5_28	2021-11-29 08:33:44 +01:00
Yasser Zamani	cae7a5f25c	Merge pull request #510 from apache/WW-5149-labelposition [WW-5149] Puts back "labelposition" with a warning of deprecation	2021-11-27 14:17:39 +03:30
Lukasz Lenart	62d46b62da	WW-5149 Makes labelPosition preferred option than labelposition	2021-11-25 07:37:40 +01:00
Lukasz Lenart	43358dee85	WW-5149 Puts back labelposition with a warning of deprecation	2021-11-23 19:33:42 +01:00
Lukasz Lenart	d9ba299412	[maven-release-plugin] prepare for next development iteration	2021-10-19 09:54:26 +02:00
Lukasz Lenart	26e1535b58	[maven-release-plugin] prepare release STRUTS_2_5_27	2021-10-19 09:54:17 +02:00
Yasser Zamani	8d6e26e0fe	fix double evaluations address known issues reported at https://securitylab.github.com/research/apache-struts-double-evaluation/	2021-07-09 10:45:22 +04:30
Yasser Zamani	a96dd31be6	Merge pull request #493 from apache/WW-5136-class-deprecated [WW-5136] Makes class attribute deprecated	2021-07-01 11:43:46 +04:30
Lukasz Lenart	fe45511712	WW-5136 Makes class attribute deprecated	2021-06-27 09:48:43 +02:00
Lukasz Lenart	90ea4d8aa1	Merge pull request #490 from apache/WW-5132-labelposition [WW-5132] [WW-5123] labelposition	2021-06-27 09:17:10 +02:00
Lukasz Lenart	d04ed76f1b	WW-5135 Upgrades Xstream to version 1.4.17	2021-06-20 20:52:21 +02:00
Lukasz Lenart	f1824b5393	WW-5132 Marks old labelposition as Deprecated	2021-06-18 07:02:20 +02:00
Lukasz Lenart	675deff599	WW-5123 Adds right option to TLD for Checkbox tag	2021-06-14 20:28:24 +02:00
Lukasz Lenart	256cd14bf0	WW-5123 Makes labelpostion deprecated	2021-06-14 20:27:48 +02:00
Lukasz Lenart	620b8c3a0c	Merge pull request #484 from apache/ww_5125_2_5 [WW-5125] use .get(...) instead of [...] for fieldErrors	2021-05-02 12:05:10 +02:00
Yasser Zamani	20e4529e35	[WW-5125] use .get(...) instead of [...] for fieldErrors All [ occurrences in all ftl files reviewed. Only fieldErrors had used [...] which replaced by .get(...) to fix WW-5125 as well as aligning with other ftl files conduct.	2021-04-25 14:56:47 +04:30
Lukasz Lenart	8a26c0d753	WW-5118 Upgrades OGNL to ver 3.1.29 to fix Long conversion	2021-04-06 07:20:24 +02:00
Lukasz Lenart	b2580e1d76	WW-5122 Upgrades Xstream to version 1.4.16	2021-03-28 10:11:49 +02:00
Lukasz Lenart	a65b8d5d51	[WW-5117] Reorders stack (#475 ) * Moves action on top just before the tag * Moves pushes out of try-finally block	2021-03-25 17:26:13 +04:30
Yasser Zamani	7e912a2985	Merge pull request #479 from davoustp/contention-in-singleton-injection-2.5.x [WW-5121] Fix: remove contention during Scope.SINGLETON injection	2021-03-23 20:31:28 +04:30
Lukasz Lenart	1b9563d366	Merge pull request #477 from davoustp/contention-in-localized-resources-2.5.x [WW-5119] Fix: remove contention during localized text lookup (JDK 1.7+)	2021-03-22 10:40:43 +01:00
Pascal Davoust	ce8b75de58	[WW-5121] Fix: remove contention during Scope.SINGLETON injection	2021-03-22 09:40:02 +01:00
Pascal Davoust	280f25d2fe	Update AbstractLocalizedTextProvider.java Applied code review comments from JCgH4164838Gh792C124B5 into account	2021-03-22 08:50:59 +01:00
Pascal Davoust	69669d6cf7	Fix: remove contention during localized text lookup (JDK 1.7+)	2021-03-15 11:56:41 +01:00
Lukasz Lenart	39d70e3944	Merge pull request #472 from Marcono1234/struts-2-5-x 2.5.x backport: WW-5116 Fix wrong regex range	2021-02-08 20:06:27 +01:00
Marcono1234	cb5e55b06c	WW-5116 Fix wrong regex range	2021-02-08 17:10:49 +01:00
Lukasz Lenart	ea23ce295a	[maven-release-plugin] prepare for next development iteration	2020-11-25 17:32:09 +01:00
Lukasz Lenart	4cf9093cc5	[maven-release-plugin] prepare release STRUTS_2_5_26	2020-11-25 17:31:54 +01:00
Lukasz Lenart	46bae3ce68	Reverts version to 2.5.26-SNAPSHOT	2020-11-25 17:13:51 +01:00
Lukasz Lenart	dfa8fb3e4c	Fixes translating id in Form tag	2020-11-25 17:12:57 +01:00
Lukasz Lenart	a2df8f9890	[maven-release-plugin] prepare for next development iteration	2020-11-24 08:22:00 +01:00
Lukasz Lenart	7253edeada	[maven-release-plugin] prepare release STRUTS_2_5_26	2020-11-24 08:16:43 +01:00
Lukasz Lenart	2efe3cec7a	Adds additional excludes packages and uses strict SMI declaration	2020-11-24 07:51:43 +01:00
Lukasz Lenart	4506d5716d	Reverts version to 2.5.26-SNAPSHOT	2020-11-24 07:49:59 +01:00
Lukasz Lenart	83aff6e470	[maven-release-plugin] prepare for next development iteration	2020-11-21 08:40:22 +01:00
Lukasz Lenart	3138dc7fbd	[maven-release-plugin] prepare release STRUTS_2_5_26	2020-11-21 08:40:09 +01:00
Lukasz Lenart	4566734662	Merge pull request #446 from apache/WW-5096-fix-static [WW-5096] Fix StaticParametersInterceptor param overwrite	2020-11-20 07:47:20 +01:00
Lukasz Lenart	d591b7e3b9	WW-5096 Adds tests to cover overwrite	2020-11-18 09:34:49 +01:00
Lukasz Lenart	9c45d6b025	WW-5096 Fixes params overwriting	2020-11-14 21:50:14 +01:00
Lukasz Lenart	482af41673	Adds some additional excluded packages	2020-11-13 19:37:02 +01:00
Lukasz Lenart	0a75d8e8fa	Avoids recursion in tags	2020-11-11 07:31:36 +01:00
Lukasz Lenart	1d18e8f9a8	WW-5095 Sets ActionMapping when preparing a test nv	2020-11-11 07:27:40 +01:00
Lukasz Lenart	f6365e7363	Uses proper tools labels	2020-11-05 08:08:44 +01:00
Lukasz Lenart	84aeb77011	[maven-release-plugin] prepare for next development iteration	2020-09-17 13:37:00 +02:00
Lukasz Lenart	b3a9d82d58	[maven-release-plugin] prepare release STRUTS_2_5_25	2020-09-17 13:36:38 +02:00
Lukasz Lenart	828d02fcbd	Merge pull request #438 from yasserzamani/WW-5087 WW-5087 handle Parameter.Empty properly	2020-09-15 07:48:19 +02:00
Yasser Zamani	88b05cdaed	WW-5087 handle Parameter.Empty properly There was a bug with AliasInterceptor not handling the Parameter.Empty that is returned from HttpParameters.get(). Since HttpParameters.get() always returns a non-null value, the Evaluated object is treated as always being defined, which results in the empty value being set incorrectly on the stack.	2020-09-14 18:00:54 +04:30
Lukasz Lenart	e60df05c27	Merge pull request #437 from gregh3269/struts-2-5-x Empty file upload, storeLocation null gives wrong error message.	2020-09-09 12:57:59 +02:00
Greg Huber	1efcc938cf	Empty file upload, storeLocation null gives wrong error message.	2020-09-09 11:02:55 +01:00
Lukasz Lenart	7b1c3b0fca	Merge pull request #436 from JCgH4164838Gh792C124B5/WW-5075_S2_5_OSGiPluginBackportfix Backport a few PR#433 OSGi plugin-related changes from 2.6 to 2.5.	2020-09-09 07:52:57 +02:00
JCgH4164838Gh792C124B5	10a834a54c	Backport a few PR#433 OSGi plugin-related changes from 2.6 to 2.5. - Fix to allow the OSGi plugin to initialize with no internet connection. - Fix an unintended JS change for the admin bundle. - Fix the OSGi Demo bundle so it works under 2.5.x as well.	2020-09-08 15:25:02 -04:00
Lukasz Lenart	abb1ac3c99	[maven-release-plugin] prepare for next development iteration	2020-08-18 07:38:38 +02:00
Lukasz Lenart	dcc59937a8	[maven-release-plugin] prepare release STRUTS_2_5_24	2020-08-18 07:38:25 +02:00
Lukasz Lenart	22c88faf38	WW-5086 Fixes s:set tag to persists empty body	2020-08-17 09:46:27 +02:00
Lukasz Lenart	1191ca3ed0	WW-5086 Fixes s:set tag with empty body	2020-08-17 08:30:56 +02:00
Yasser Zamani	bcfb769005	Merge pull request #427 from JCgH4164838Gh792C124B5/WW-5075_S2_5_OSGiPluginUpdate WW-5075 Fixes for OSGi plugin in 2.5.x	2020-07-29 08:08:57 +04:30
JCgH4164838Gh792C124B5	d61be3e4ce	Updated with suggested changes from review. - BundlePackageLoader changes suggested by L. Lenart. - FelixOsgiHost changes to better handle Felix bundle cache location processing (Windows and Linux). - FelixOsgIHost test modified to not fail if felix-cache directory cannot be created (warn only) to avoid failing the whole build.	2020-07-25 16:11:02 -04:00
JCgH4164838Gh792C124B5	c7149ab1bc	Initial attempt to fix OSGi Plugin issues discovered during examination of WW-5075. - Indication is that the OSGi Plugin has been failing since Struts 2.3.4. - Applied fix to ResourceFinder to restore 2.3.x logic that was broken in 2.5.x. - Implemented changes to restore OSGi Plugin functionality for 2.5.x. - Applied changes to the OSGi Admin Bundle to function under 2.5.x. - Updated the OSGi Admin Bundle JS libraries and related CSS to newer versions. - Added new unit tests for the OSGi plugin. - The OSGi plugin will only function properly with exploded/expanded WAR files.	2020-07-20 01:12:12 -04:00
Yasser Zamani	4504e610f1	Merge pull request #425 from apache/WW-5077-dmi-aware [WW-5077] DMI aware pattern	2020-07-17 14:16:36 +04:30
Lukasz Lenart	9b3a23eb28	WW-5077 Adjusts DMI aware Regex to be more narrowed	2020-07-17 08:08:57 +02:00
Lukasz Lenart	3220d832d2	WW-5077 Restores escaped brackets	2020-07-16 07:30:06 +02:00
Lukasz Lenart	bd007953ea	Sets a proper timestamp as maven-jar-plugin doesn't support "now"	2020-07-11 20:39:55 +02:00
Lukasz Lenart	1b0c743e85	WW-5077 Uses a different pattern if DMI is enabled	2020-07-11 20:31:30 +02:00
Lukasz Lenart	89e02a4fb4	Adds outputTimestamp property to support reproducible build See the link for more details https://lists.apache.org/thread.html/r27ebcfec6431dc5f4830744e3567f082d8f140dc579f2a35408ea25c%40%3Cusers.maven.apache.org%3E	2020-07-11 19:45:33 +02:00
Lukasz Lenart	8cb93ad39a	[maven-release-plugin] prepare for next development iteration	2020-07-02 07:53:53 +02:00