Why does Liferay have so much scriptlet in JSP??

[jelmer kuperus, modifié il y a 13 années.]

Well in all fairness few jsp's contain business logic, but there's a fair bit of logic in there that in a "normal project" would reside in a controller

What can I say. It's an old under documented, under tested, overall mediocre to low quality codebase with a poor but consistent architecture

[Victor Zorin, modifié il y a 13 années.]

That brings another good topic about Liferay security and ability to bring the system down or at least to force a core dump by simply calling jsp URL. This gets extremely dangerous when jsp code contains java scriplets, because no-one knows what may happen as direct jsp invocation conditions are untestable.

Try to hit any Liferay site with http://anysitename.com/html/portal/layout/view/portlet.jsp and you can see the dumping results.
(unless site has additional anti-jsp protection)

[Victor Zorin, modifié il y a 12 années.]

Keep asking good questions, 'Liferay Question'!

[Hitoshi Ozawa, modifié il y a 12 années.]

It would be better if we can make this into something more of a realizable constructive topic that can be requested as an Liferay issue.

[Jakub Liska, modifié il y a 12 années.]

As I see it, with Struts underneath, it is no wonder there are scriptlets and logic in JSPs.... Unfortunately it is such a huge code base that it would be a tough challenge to refactor it. I believe that migration to spring-portlet-mvc would shrink those hundreds of Struts Actions into 20-40 Spring @Controllers and some custom Views ... With spring-mvc it is much easier to create jsps without logic.... The maintainability would be incomparable...

[jelmer kuperus, modifié il y a 12 années.]

yeah it's been a best practice for a very long time to place jsp's under the web root , eg, in something /WEB-INF/jsps that way these files cannot be accessed directly. But liferay does not do it.

that's been one of my pet grievances for a long time