Version 6.8.13 built on 2013-10-06.

Release Notes for Vaadin Framework 6.8.13

Vaadin is a Java application development framework for building modern web applications that look great, perform well and make you and your users happy. Vaadin is available under the Apache 2 license (see license.html in the JAR).

Security fixes in Vaadin Framework 6.8.10

Vaadin 6.8.10 fixes a critical security issue discovered during an internal review. All users of Vaadin portlets are strongly urged to upgrade immediately.

Vaadin portlets (Portlet 2.0 - JSR-286) prior to Vaadin version 6.8.10 are vulnerable to an attack that allows a remote user who has access to a portlet on the portal to read files in the portlet deployment directory using specially crafted resource requests provided the attacker knows the file name.

The vulnerability has been classified as critical as it potentially allows unauthorized access to portlet object code and configuration information. Files outside the portlet deployment directory are not accessible using this vulnerability. Portlets that are not visible to the remote user are not vulnerable to this attack. Servlet deployments are not vulnerable to this attack.

All users of Vaadin portlets are strongly urged to upgrade Vaadin in the portlets immediately. Where that is not possible, access to affected portlets should be restricted to trusted users only.

Security fixes in Vaadin Framework 6.8.8

Vaadin 6.8.8 fixes a security issue discovered during an internal review.

Allowing unfiltered user input as the key in a map used for communication in a Vaadin UI component may enable a cross-site scripting (XSS) attack on a Vaadin application. Specifically, in certain cases it is possible to use a specially-crafted debug ID to inject arbitrary Javascript to be executed in an end user's browser. This requires specific actions both from the application developer and from the end user.

The vulnerability has been classified as moderate as it potentially allows unauthorized access to server or user data but is significantly limited by factors such as default settings, requires certain behavior from the application or is very difficult to exploit.

Certain Vaadin layout components store metadata about their child components in maps, keyed by the component ID. The IDs are not escaped when the maps are sent to the client as JSON objects, allowing a specially-crafted debug ID assigned to a child component to inject arbitrary JSON, or, in some cases, arbitrary Javascript to be executed by the user's browser.

To be used as an attack, this requires an application to accept malicious user input and assign it, unfiltered, as the debug ID of a component in another user's application instance. The following Core Vaadin layouts are vulnerable when containing a component with a malicious debug ID:

Additionally, any third-party components which invoke the com.vaadin.terminal.PaintTarget#addAttribute(String, Map) method are vulnerable if unfiltered user input is allowed as the keys of the Map argument.

Overview of Vaadin 6.8.13 Release

Vaadin 6.8.13 is a maintenance release that includes a number of important bug fixes.

Changes in Vaadin 6.8.13

This release includes the following closed issues:

The full list of the closed issues can be found at dev.vaadin.com.

Enhancements in Vaadin 6.8

Below is a list of enchacements in the current minor release branch, first released in 6.8.0.

Backwards incompatible changes in Vaadin 6.8

The following backward incompatible changes have been introduced since Vaadin 6.7:

Package Contents

Vaadin Framework is distributed as a single JAR file. Inside the JAR you will find:

Vaadin 6.8.13 dependencies

Vaadin uses GWT 2.3.0 for widget set compilation. GWT can be downloaded from http://code.google.com/webtoolkit/. GWT can also be automatically downloaded by the Vaadin Plug-in for Eclipse. Please note that GWT 2.3.0 requires the validation-api-1.0.0.GA.jar and validation-api-1.0.0.GA-sources.jar files in addition to gwt-dev.jar and gwt-user.jar for widget set compilation.

Upgrading to Vaadin 6.8

When upgrading from an earlier Vaadin version, you must:

Remember also to refresh the project in your IDE to ensure that the new version of everything is in use.

Using the "?debug" URL parameter you can verify that the version of the servlet (JAR), the theme and the widgetset all match.

Eclipse users should always check if there is a new version of the Eclipse Plug-in available. The Eclipse Plug-in can be used to update the Vaadin version in the project (Project properties » Vaadin).

Maven users should update the Vaadin dependency version in the pom.xml unless it is defined as LATEST . You must also ensure that the GWT dependency uses the correct version and recompile your project and your widget set.

Liferay and other portal users must install the new vaadin-6.8.13.jar as ROOT/WEB-INF/lib/vaadin.jar in the portal. Additionally the contents of the VAADIN folder from the JAR must be extracted to the ROOT/html/VAADIN directory in the Liferay installation. If your portal uses custom widgets, install the latest version of Vaadin Control Panel for Liferay for easy widget set compilation.

Upgrading from Vaadin 6.5 or earlier

If you are upgrading from 6.5.x or earlier, notice that Vaadin 6.8.13 uses GWT 2.3.0. Upgrade your dependencies as necessary. See the dependencies section for more information.

Upgrading from Vaadin 6.1 or earlier

The way widget sets are created was completely changed in Vaadin 6.2. Existing projects, where custom widgets (a custom widget set) are used, must be migrated when upgrading to Vaadin 6.2 or later. Projects where the default widget set is used do not need migration. See Vaadin 6.2.0 release notes for more details.

Notes and Limitations for Google App Engine

The following instructions and limitations apply when you run a Vaadin application under the Google App Engine.

For other known problems, see open tickets at developer site dev.vaadin.com.

Supported technologies

Vaadin is based on Java 5 and it is also compatible with most other operating system supporting Java 5 or newer. Vaadin is supported on the following operating systems:

Vaadin requires Java Servlet API 2.3 but also supports later versions and should work with any Java application server that conforms to the standard. The following application servers are supported:

Vaadin supports JSR-168 and JSR-286 Portlet specifications. All portals that implement either of the portlet specifications should work. The following portals are supported:

Vaadin also supports Google App Engine.

Vaadin supports the following browsers:

Vaadin supports the built-in browsers in the following mobile operating systems:

Vaadin SQL Container supports the following databases:

Vaadin on the Web