Grouper Users - Open Discussion List

[Baron Fujimoto <>]

I'm still stuck on this, if anyone can offer assistance. Chris Hyzer suggests 
in a comment in the bug reference at 
<https://bugs.internet2.edu/jira/browse/GRP-1838> that, "you can ... unzip 
that patch and manually apply it in the classes dir and it should work". It's 
not clear to me where they should be manually applied though. If I search the 
existing grouper.ui-2.2.2 directory, I find the classes in the patch archive 
for grouper_v2_2_2_ui_patch_6 here:

$ ls -l 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer*
grouper 1164 Mar 14 17:29 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$1.class
-rw-------. 1 grouper grouper 1306 Mar 14 17:29 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$2.class
-rw-------. 1 grouper grouper 1204 Mar 14 17:29 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$3.class
-rw-------. 1 grouper grouper 1238 Mar 14 17:29 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$4.class
-rw-------. 1 grouper grouper 1204 Mar 14 17:29 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$5.class
-rw-------. 1 grouper grouper 1238 Mar 14 17:29 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$6.class
-rw-------. 1 grouper grouper 7508 Mar 14 17:29 
grouper.ui-2.2.2/temp/jarBin/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.class

Though they have the same sizes as the actual files in the patch archive, 
there are binary differences:

$ ls -l 
installer-archive/grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer*
-rw-------. 1 grouper grouper  1164 Mar  7 17:46 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$1.class
-rw-------. 1 grouper grouper  1306 Mar  7 17:46 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$2.class
-rw-------. 1 grouper grouper  1204 Mar  7 17:46 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$3.class
-rw-------. 1 grouper grouper  1238 Mar  7 17:46 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$4.class
-rw-------. 1 grouper grouper  1204 Mar  7 17:46 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$5.class
-rw-------. 1 grouper grouper  1238 Mar  7 17:46 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$6.class
-rw-------. 1 grouper grouper  7568 Mar  7 17:46 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.class

There are also still differences in the TextContainer.java as well:

$ diff -U 0 
grouper.ui-2.2.2/java/src/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.java
 
grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.java
--- 
grouper.ui-2.2.2/java/src/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.java
    2015-08-10 13:41:43.000000000 -1000
+++ 
installer-archive/grouper_v2_2_2_ui_patch_6/new/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.java
    2019-03-07 17:46:03.224878765 -1000
@@ -13,0 +14 @@
+import org.apache.commons.lang.StringEscapeUtils;
@@ -102 +103 @@
-      return "$$not found: " + key + "$$";
+      return "$$not found: " + StringEscapeUtils.escapeHtml(key) + "$$";


On Fri, Mar 15, 2019 at 05:17:57PM -1000, Baron Fujimoto wrote:
>I'm trying to bring an instance of grouper 2.2.2 up to date with available 
>patches. I'm having a problem verifying if it has been successful though.
>
>Below is a partial transcript of patching the UI. It seems to indicate the 
>successful application of patches up to and including 
>grouper_v2_2_2_ui_patch_6.
>=====
>[...]
>################ Checking patch grouper_v2_2_2_api_patch_12
>Patch doesnt exist yet (not an error): 
>http://software.internet2.edu/grouper/release/2.2.2/patches/grouper_v2_2_2_api_patch_12.tar.gz
>
>There are no new API patches to install
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_0
>Patch: grouper_v2_2_2_ui_patch_0: was applied on: 2019/03/13 16:23:30
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_1
>Patch: grouper_v2_2_2_ui_patch_1: had an error installing on: 2019/03/13 
>16:23:48
>
>File exists: 
>/home/grouper/grouper/installer-archive/grouper_v2_2_2_ui_patch_1.tar.gz, 
>should we use the local file (t|f)? [t]: Unzipped file exists: 
>/home/grouper/grouper/installer-archive/grouper_v2_2_2_ui_patch_1.tar, use 
>unzipped file (t|f)? [t]: Untarred dir exists: 
>/home/grouper/grouper/installer-archive/grouper_v2_2_2_ui_patch_1, use 
>untarred dir (t|f)? [t]: Would you like to install all patches (t|f)? [t]:
>Patch grouper_v2_2_2_ui_patch_1 is low risk, is not a security patch
>GRP-1215: unfriendly error when assigning privs and not have admin
> - set property: grouper_v2_2_2_ui_patch_1.date from: 2019/03/13 16:23:48 
> to: 2019/03/13 16:28:17
>This patch requires all processes that user Grouper to be stopped.
>  Please stop these processes if they are running and press <enter> to 
> continue...
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/grouperUi2/group/groupHeader.jsp
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject.class
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject$2.class
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject$1.class
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject$4.class
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject$3.class
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject$5.class
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject.java
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/serviceLogic/UiV2Subject$6.class
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/grouperText/grouper.text.en.us.base.properties
>Patch successfully applied: grouper_v2_2_2_ui_patch_1
> - set property: grouper_v2_2_2_ui_patch_1.state from: error to: applied
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_2
>Patch: grouper_v2_2_2_ui_patch_2: was applied on: 2019/03/13 16:23:55
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_3
>Patch: grouper_v2_2_2_ui_patch_3: was applied on: 2019/03/13 16:24:02
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_4
>File exists: 
>/home/grouper/grouper/installer-archive/grouper_v2_2_2_ui_patch_4.tar.gz, 
>should we use the local file (t|f)? [t]: Unzipped file exists: 
>/home/grouper/grouper/installer-archive/grouper_v2_2_2_ui_patch_4.tar, use 
>unzipped file (t|f)? [t]: Untarred dir exists: 
>/home/grouper/grouper/installer-archive/grouper_v2_2_2_ui_patch_4, use 
>untarred dir (t|f)? [t]: Patch grouper_v2_2_2_ui_patch_4 is low risk, is not 
>a security patch
>GRP-1222: xss vulnerability in tooltips in new UI
> - added to end of property file: grouper_v2_2_2_ui_patch_4.date = 
> 2019/03/13 16:28:26
>Applying file: 
>/home/grouper/grouper/grouper.ui-2.2.2/dist/grouper/WEB-INF/classes/grouperText/grouper.text.en.us.base.properties
>Patch successfully applied: grouper_v2_2_2_ui_patch_4
> - added to end of property file: grouper_v2_2_2_ui_patch_4.state = applied
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_5
>Patch: grouper_v2_2_2_ui_patch_5: was applied on: 2019/03/08 17:29:45
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_6
>Patch: grouper_v2_2_2_ui_patch_6: was applied on: 2019/03/08 17:29:46
>
>
>################ Checking patch grouper_v2_2_2_ui_patch_7
>Patch doesnt exist yet (not an error): 
>http://software.internet2.edu/grouper/release/2.2.2/patches/grouper_v2_2_2_ui_patch_7.tar.gz
>
>Since patches were applied, you should delete files in your app server work 
>directory,
>  in tomcat it is named 'work'.  Hit <enter> to continue:
>=====
>
>It appears that previously, patch status/history was recorded in a 
>grouperPatchStatus.properties file (e.g. 
>grouper.ui-2.2.2/dist/grouper/WEB-INF/grouperPatchStatus.properties. After 
>going through this latest round of patching, I don't see the patches noted 
>in the transcript in this file. Patches 5 and 6 are not present. A recursive 
>search in directories for the timestamp string in the transcript for the 
>applied times for patches 5 and 6 yields no results.
>=====
># added by grouper-installer
>grouper_v2_2_2_api_patch_0.date = 2015/12/03 15:40:53
>
># added by grouper-installer
>grouper_v2_2_2_api_patch_0.state = applied
>
># added by grouper-installer
>grouper_v2_2_2_api_patch_1.date = 2015/12/03 15:41:05
>
># added by grouper-installer
>grouper_v2_2_2_api_patch_1.state = applied
>
># added by grouper-installer
>grouper_v2_2_2_api_patch_2.date = 2015/12/03 15:41:11
>
># added by grouper-installer
>grouper_v2_2_2_api_patch_2.state = applied
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_0.date = 2015/12/03 15:41:41
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_0.state = applied
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_1.date = 2015/12/03 15:41:46
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_1.state = applied
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_2.date = 2015/12/03 15:41:50
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_2.state = applied
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_3.date = 2015/12/03 15:41:54
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_3.state = applied
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_4.date = 2015/12/03 15:41:56
>
># added by grouper-installer
>grouper_v2_2_2_ui_patch_4.state = applied
>=====
>
>When I look at https://bugs.internet2.edu/jira/browse/GRP-1838 (fixed in 
>patch_6) the images that are supposed to demonstrate the patched and 
>unpatched results appear to be broken(?) so I'm not sure what I should be 
>seeing there either.
>
>Any suggestions would be appreciated.
>-- 
>Baron Fujimoto <> :: UH Information Technology Services
>minutas cantorum, minutas balorum, minutas carboratum desendus pantorum

-- 
Baron Fujimoto <> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum