Narcanti

Etikettenschwindel bei Lebensmitteln

Secco — Thu, 11 Mar 2010 19:50:02 +0000

Zufällig darüber gestolpert: Auf www.abgespeist.de werden Werbekampagnen und Produkte von Lebensmittelherstellern unter die Lupe genommen. Interessant: Der “Rosa-Joghurt-Riegel” hat mehr Fett und Kallorien als Vollmilchschokolade und die Nährwertangaben fehlen natürlich auf der Packung. Aber auch der neue Werbeslogan für die Schokoriegel für Kinder ist nicht schlecht: “Die Extra Portion Zucker und Fett!”.

Hardening WordPress: Basic generator obfuscation

Secco — Sun, 17 Jan 2010 20:56:38 +0000

As previously noted, here another part of my Hardening WordPress series. This time I’ll show you the really basic technique of how you can obfuscate at least the generator-tag for your blog.

The generator tag is the one in the sourcecode with . Ususally it should provide visitors or search engines some meta information on which software you use in which version. But it is also helpful to attackers. When they know which software in which version you use, they can reduce the attacks to known issues of this version. So it’s not a good idea to have this information in your blog. Also this information can help attackers to write scripts that will attack your blog on their own.

So the most basic step is to tell WordPress to remove this information, which is done by adding few methods into the functions.php within the theme folder (the plugin bs-wp-noversion will do the same thing without modifying any theme files):

remove_action('wp_head', 'rsd_link'); // remove Really Simple Discovery entry
remove_action('wp_head', 'wlwmanifest_link');  // remove Windows Live Writer Link  
remove_action('wp_head', 'wp_generator');  // remove Version output

The most important thing here is that you removes the WordPress version from the header AND the feeds.
And finally: Don’t forget to remove the files readme.html and license.txt from the root folder as an intruder may look at them to determine the version. Be aware: The removal of this files is needed everytime you update your Wordpress core.

Additionally you can include some fake generator-tags within the header of your theme, like:

Unfortunately an intruder can detect the lots of “wp-includes” and “wp-content” etc. on your page to at least determine that you’re using WordPress. There are several other strategies to obfuscate your wordpress up to a point, where it is really difficult for some intruder to tell what blogging-software you use at all.
But this extends, for now, the scope of this post (as it requires lots of changes on your theme and a lot of rewrite rules in your htaccess files to hide eveything).

Perhaps later on I’ll tie together some of my personal functions together to a plugin to do this automatically.

Hardening WordPress the geek way

Secco — Sun, 17 Jan 2010 20:30:16 +0000

My Wordpress installation was hacked several times, and all because I was too lazy to use basic protection and hardening mechanisms. After some time I decided to investigate more on the security of my blog and applied some well known protection techniques as well as some really geeky dirty hacks right in the database.

For the first part of this series, I just want to show my really geeky dirty hackish database-level protection.
Other not so geeky and more proper protection techniques can be found at:

Security whitepaper for wordpress incl. several very usefull plugins

interesting article

first wordpress antivirus plugin

PHPIDS – PHP based intrusion detection and prevention system

Perhaps I’ll cover few of them in later articles.

The dirty hack

Ususally the blogs on my dedicated system are owned and used by only one person as they are personal blogs. So there is only need for two user accounts on a Wordpress install: One for the person owning the blog and one for the admin for maintainance purposes (like updating plugins and the WP core).
When a blog is set up, changes on the wp_users are redundant for my blogs. Most hackers will try to create (by SQL-Injection) a new user with extended rights or modify the authentication data of existing users (like the one for admin). So I had the idea of preventing modifications on the wp_users. This only can be achieved within the database itself.
After experimenting with the user rights in mysql (GRANT, REVOKE) I found out that restricting the access to only the wp_users table would need to set access rights to all other tables. No option for me.
I investigated a little bit and found, that there is another possibility: TRIGGERS, which need at least mysql 5+ Version.
In my database I have some administrator user who may do everything in the database, I’ll call this one “dba”. For the wordpress I create another user as described in the security whitepaper with less rights. Then I place a trigger on the wp_users table which avoids DELETE and INSERT except by the dba:

delimiter //
 
CREATE TRIGGER `mywordpressdb`.`root_insert_only` 
  BEFORE INSERT ON `mywordpressdb`.`wp_users`
  FOR EACH ROW BEGIN
    DECLARE dummy INT;
    IF STRCMP(SUBSTRING(SESSION_USER(),1 , 4), 'dba@')<>0 THEN
      SELECT 'no' INTO dummy FROM dual.id WHERE dual.id=NEW.id;
    END IF;
  END
//
 
CREATE TRIGGER `mywordpressdb`.`root_delete_only` 
  BEFORE DELETE ON `mywordpressdb`.`wp_users`
  FOR EACH ROW BEGIN
    DECLARE dummy INT;
    IF STRCMP(SUBSTRING(SESSION_USER(),1 , 4), 'dba@')<>0 THEN
      SELECT 'no' INTO dummy FROM dual.id WHERE dual.id=12;
    END IF;
  END
//
 
delimiter ;

This both triggers only allow inserts and deletes by the dba user (who has to login into mysql by a shell account). All other users get some sql-error on trying it.
As there was the admin-account reset bug in WP, and a SQL-injection could update an existing login account, I also added a trigger to updates. Since a blog-user may want to change his email or other account data (except password and login name), the trigger for updates restricts changes to that fields:

delimiter //
 
CREATE TRIGGER `mywordpressdb`.`restricted_update_only` 
  BEFORE UPDATE ON `mywordpressdb`.`wp_users`
  FOR EACH ROW BEGIN
    DECLARE dummy INT;
    IF STRCMP(SUBSTRING(SESSION_USER(),1 , 4), 'dba@')<>0 THEN
      SET NEW.ID=OLD.ID;
      SET NEW.user_login=OLD.user_login;
      SET NEW.user_pass=OLD.user_pass;
      SET NEW.user_registered=OLD.user_registered;
      SET NEW.user_activation_key=OLD.user_activation_key;
      SET NEW.user_status=OLD.user_status;
    END IF;
  END
//
 
delimiter ;

The update trigger restricts changes to all fields but the ones set in the trigger itself. This hack prevents changing of login-accounts but to the cost of some comfort loss. If a user wants to change his password we now have to log into the database as user dba and execute some query. But at least, this gives some more security to our blog.

By the way: Since newer versions of WordPress use some different encryption for the passwords, you should use a wordpress password hasher instead of MD5 when updating user passwords manually.

Of course, this makes no sense if you use weak passwords and the intruder can apply some brute force or hash-lookup to find it, or if you have multiple users using one blog and you have to recently update login data or are no geek.

Hibernate DataViewObjects

Secco — Sun, 17 Jan 2010 20:03:54 +0000

When working with Hibernate and nested domain object models, it can be a performance problem when trying to display several (including nested) properties in a view. Usually for such cases the use of view objects is practical.
This is the first scetch of my idea to automate population of view objects with hibernate.

Meanwhile I worked out some extended example with the use of Annotations. However, the current form is not usefull enough, as using criterions for restrictions is quite difficult. But more details on the next part of this. Here the first one:

Assume we have some nested domain model consisting of a person, an address and a country as following:

@Entity
public class Person{
	private Long id;
	private String firstname:
	private String lastName;
	private Date birthdate;
	private String comment;
	private Address address;
 
	@Id
	@GeneratedValue(strategy=GenerationType.AUTO)
	public Long getId(){
		return id;
	}
 
	// appropriate getters and setter for id,
	// firstname, lastname, birthdate and comment
 
	@ManyToOne
	public Address getAddress(){
		return address;
	}
}
 
@Entity
public class Address{
	private Long id;
	private String street;
	private Country country;
 
	// appropriate getters and setter for 
	// id, street and country
 
	@ManyToOne
	public Country getCountry(){
		return country;
	}
}
 
@Entity
public class Country{
	private String iso3166; 
	// iso 3166 2 letter code 
	// (uppercase), like DE for Germany
	private String name;
 
	@Id
	@Column(length=2)
	public String getIso3166(){
		return iso3166;
	}
 
	// appropriate getters and setter for name and iso3166
}

Now let’s assume we want to build a list displaying only the lastname and the countryname of a person. In such a case it’s unneccessary to do a query like “SELECT p FROM Person p”, since even if lazy loading is enabled, hibernate will load all properties leading to lot’s of unneeded data transported from database to application.
In such a case we would prefer to build a view object, that only will hold the information we need to display:

public class PersonLastNameCountryViewObject{
	private String lastName;
	private String countryName;
 
	// appropriate getters and setter
}

So we now have a lightweight view object, but how do we get the data into it?
One possibility would be to build a custom query for this, like:

SELECT p.lastName, c.name FROM Person p LEFT JOIN p.address AS a LEFT JOIN a.country AS c

This would give us the needed data and we only would have to map the results to our view object.
Having several views may lead to lots of custom queries and code doing the retrieval and mapping stuff. So why not automating it?

I created some classes to handle this work, but there are few informations that have to be given to it, especially about which view object properties to map to which domain model properties.
In the above view object example, I decided to use a map of view object properties and define a domain model path for each, just like in commons-beanutils.
The mapping for the above example would be:

lastName -> lastName
countryName -> address.country.name

The path here starts with the initial domain class, in this case the Person class. Since Hibernate does not support nested object paths like in

SELECT p.name, p.address.country.name FROM Person p

I built some code to split the path and join the appropriate domain models into the query just to have the working query denoted previously.
So my view object mapping helpers contain of following classes:

// Just an interface that will create a 
// view object for us for each resultset row
public interface ViewObjectFactory{
  public Object createNewViewObject();
}
 
// a cimple class to hold all ,eta data needed for building our view objects
public class ViewObjectMetaData{
  // This will hold the mappings like
  // lastName -> lastName
  // countryName -> address.country.name
  private final HashMap<String, String> 
    propertiesToObjectPaths = new HashMap<String, String>();
 
  // this will hold our initial domain class, like Person.class.
  // we need this to create a criteria in hibernate later on
  private Class domainClass;
 
  // the factory we will use to create the view objects
  private ViewObjectFactory voFactory;
 
  // as default, if no object paths are given, we assume that each view object property
  // will be mapped non-nestingly to the domain class propertys with the same name.
  // so the mapping will be something like:
  // propertyA -> propertyA
  // propertyB -> propertyB
  // will need BeanUtils to work, or make some own code with reflection
  public ViewObjectMetaData(ViewObjectFactory voFactory, 
    Class domainClass){
    this.voFactory = voFactory;
    this.domainClass = domainClass;
    try {
      Map desc = BeanUtils.describe(dtoFactory.createDto());
      desc.remove("class");
      final Collection<String> properties = 
        (Collection<String>) desc.keySet();
      for (final String property:properties){
        propertiesToObjectPaths.put(property, property);
      }
    }
    catch (Exception e) {
      // just make a runtime exception from it...
      if (e instanceof RuntimeException){
        throw (RuntimeException) e;
      }
      else{
        final RuntimeException r = new RuntimeException(e);
        r.setStackTrace(e.getStackTrace());
        throw r;
      }
    }
  }
 
  public ViewObjectMetaData(ViewObjectFactory voFactory, 
    Class domainClass, 
    Map<String, String> propertiesToObjectPaths){
    this.voFactory = voFactory;
    this.domainClass = domainClass;
    this.propertiesToObjectPaths.putAll(propertiesToObjectPaths); 
  }
 
  // appropriate getters
}

Now we have all information needed to build up queries and populate the view objects. The main work will consist of building up the query from the object path and mapping the resultset to the view objects.
For building the query, I used the criteria API of hibernate, which allows to add further restrictions on the query later on. The algorithm for transforming the object path to a criteria is not that complicated. We have to think about two different cases in the object path:

1. object path consists of one part, like “lastName”. This has to be mapped to a projection, like:

SELECT p.lastName FROM Person p

2. the object consists of multiple parts, like “address.street” or “address.country.name”. In this case we have to create a hibernate alias (which internally maps to a join) for each part except the first (which is the root domain class) and the last, which has to be added as a projection as it is the property we want to have. So we have for the two part object path example:

SELECT a.street FROM Person p LEFT JOIN p.address AS a

and the three part object path example:

SELECT c.name FROM Person p LEFT JOIN p.address AS a LEFT JOIN a.country AS c

Also we’ll keep track of the indices of the projected properties in the resultset for the mapping between resultset and viewobject

public class ViewObjectCriteriaBuilder{
 
  // just a helper class to transport 
  // criteria and columnmappings
  public static class ViewObjectCriteria{
    private Criteria criteria;
    private HashMap<String, Integer> propertyToColumnMappings = 
      new HashMap<String, Integer>();
 
    // apropriate getters/setters
  }
 
  private SessionFactory sessionFactory;
 
  // appropriate setter for the sessionFactory 
  // or just pass a current session to the next method
 
  public ViewObjectCriteria buildCriteria(ViewObjectMetaData voMetaData){
    final ViewObjectCriteria voCriteria = new ViewObjectCriteria();
 
    final Criteria criteria = sessionFactory.
      getCurrentSession().
      createCriteria("d", voMetaData.getDomainClass());
    voCriteria.setCriteria(criteria);
 
    final Map<String, String> propertiesToObjectPaths = 
      voMetaData.getPropertiesToObjectPaths();
 
    // our projections
    final ProjectionList projections = Projections.projectionList();
 
    // max. amount of aggregations in object path
    int maxAggregationDeepth = 0;
    // index of property in resultset
    int propertyColumnIndex = 0;
 
    String objectPath; // objectpath of current vo property
    // amount of aggregations in current object path
    int aggregationDeepth; 
    final ArrayList<String> aggregationParts = 
      new ArrayList<String>(5); // parts of the object path, splitted
 
 
    // in the first step we only collect information 
    // about the needed aggregations,
    // the joins will be build later on
    for (final String property:propertiesToObjectPaths.keySet()){
      objectPath = propertiesToObjectPaths.get(property);
 
      // this helper just counts the 
      // occurences of '.' in the objectPath
      aggregationDeepth = StringUtil.occurences(objectPath, '.');
 
      if (aggregationDeepth<1){
        // no aggregation, like
        // lastName -> d.lastName
        projections.add(Projections.property("d."+objectPath));
      }
      else{
        maxAggregationDeepth = 
          Math.max(maxAggregationDeepth, aggregationDeepth);
        // aggregations exist
 
        // first split the object path
        aggregationParts.clear();
        // this helper splits the objectPath 
        // on "\\." and adds all parts to the 
        // aggregationParts-list. Works the same 
        // way as String.split
        CollectionSplitter.toList(aggregationParts, objectPath, "\\.");
 
        // last aggregations alias
        String lastAggregationName = null;
        String currentAggregationPart, currentAggregationName;
 
        // when we're here, there are at least two parts in the object path
        // first part is an property of the 
        // root domain class, e. g. address -> d.address
        for (int aggregationIndex=0; 
          aggregationIndex<=aggregationDeepth; aggregationIndex++){
 
          currentAggregationPart = aggregationParts.get(aggregationIndex);
          if (aggregationIndex==0){
            // equals to "LEFT JOIN d.address AS ag_address"
            lastAggregationName = "ag_"+currentAggregationPart;
            aggregations.put(
              "d."+currentAggregationPart, 
              lastAggregationName);
          }
          else if (aggregationIndex==aggregationDeepth){
            // last part in object path, which 
            // denotes a property we want to have projected
            // equals to "SELECT ... ag_address_country.name FROM ..."
            projections.add(
              Projections.property(
                lastAggregationName+"."+currentAggregationPart));
          }
          else{
            // somewhere in the middle
            // equals to 
            // "LEFT JOIN ag_address.country AS ag_address_country"
            currentAggregationName = 
              lastAggregationName+"_"+currentAggregationPart;
            aggregations.put(
              lastAggregationName+"."+currentAggregationPart, 
              currentAggregationName);
            lastAggregationName = currentAggregationName;
          }
        }
      }
 
      // update index of property in resultset
      voCriteria.getPropertyToColumnMappings().
        put(property, propertyColumnIndex++);
    }
 
    // if there are any aggregations, we have
    // to add an alias for each to the criteria
    if (maxAggregationDeepth>0){
      // sort aggregatios (joins) by their alias length
      // this is to enshure that ag_address is 
      // added before ag_address_country
 
      final List<String> aggregationsSizeSorted = 
        new ArrayList<String>(aggregations.keySet());
 
      Collections.sort(aggregationsSizeSorted, 
        // the string length comparator just compares
        // the length of two strings
        new StringLengthComparator());
      for (final String fromAggregation:aggregationsSizeSorted){
        // here we also may use LEFT JOIN or some other join type
        criteria.createAlias(
          fromAggregation, 
          aggregations.get(fromAggregation));
      }
    }
 
    // add projections to criteria
    criteria.setProjection(projections);
 
    return voCriteria;    
  }
}

Now we have build a criteria which will load all neccessary data from the database. Meanwhile we could add some restrictions or limitations to the query to only retrieve a portion of all rows. Somewhere all along the code we will need to have a valid session/transaction, but I’ll skip that, as this is just an example.

Next we build a class that will execute the criteria and map the columns from the resultset to the viewobjects. Here are several possibilites. For example using a special hibernate rowsetmapper, but the way I did it below also works fine.

public List buildViewObjects(ViewObjectCriteria voCriteria, 
  ViewObjectMetaData voMetaData){
 
  ScrollableResults result = null;
  try{
    Criteria criteria = voCriteria.getCriteria();
    Map<String, Integer> propertyColumnMappings = 
      voCriteria.getPropertyColumnMappings();
    // some cache method or scroll lock method here, if needed
    result = criteria.scroll(ScrollMode.FORWARD_ONLY);
    Object [] rowdata;
    Object resultObject;
    final ArrayList viewObjects = new ArrayList();
    while (result.next()){
      rowdata = result.get();
      resultObject = voMetaData.getViewObjectFactory().
        createNewViewObject();
      for (final String property:
        propertyColumnMapping.keySet()){
        try {
          // also possible via reflection
          PropertyUtils.setProperty(resultObject, 
            property, rowdata[propertyColumnMappings.get(property)]);
        }
        catch (Exception e) {
          if (LOG.isErrorEnabled()){
            LOG.error("While setting property \""+
              property+"\" from column \""+
              propertyColumnMapping.get(property)+"\"", e);
          }
          resultObject = null;
        }
      }
      if (resultObject!=null){
        viewObjects.add(resultObject);
      }
    }
    return viewObjects;
  }
  finally{
    if (result!=null){
      result.close();
    }
  }
}

That’s it (for now).

Limitations:

the datatype of the setter in the view object has to be the same as in the corresponding domain property

restricting the query is quite difficult, as you don’t know the aliases of the generated aggregations a priori

Further improvements could be:

some annotations so that we just annotate our view object and rest is done in background

make a full working open-source API out of it

optimizations on the queries. if we only would like to select the id of a nested domain class, like “address.id”, which already is known to the Person table (since this is the referencing foreign key), it would be great not to have to join the addresses

automatic mapping between differring property types of view object and domain object (eg. long to string convertions)

improve the possibility to restrict the generated query

Javascript Dateformatting

Secco — Sun, 17 Jan 2010 19:56:40 +0000

I just recognized that there is no convenient method in Javascript to format a date-object to a string with the help of a dateformat-pattern, like in java.text.SimpleDateFormat. So I have writen a simple method, which just does this, including most important patterns.

/*
Usage:
formatDate(new Date(), 'yyyy/MM/dd HH:mm:ss.SSS');
will return current date as something like '2010/01/01 14:41:52.957'.
 
Implemented:
y  	Year 	Year  	1996 (by using yyyy); 96 (by using yy)
M 	Month in year 	Month 	7 or 10 (by using M); 07 or 10 (by using MM)
d 	Day in month 	Number 	7 or 10 (by using d); 07 or 10 (by using dd)
H 	Hour in day (0-23) 	Number 	7 or 10 (by using H); 07 or 10 (by using HH)
k 	Hour in day (1-24) 	Number 	7 or 10 (by using k); 07 or 10 (by using kk)
m 	Minute in hour 	Number 	7 or 10 (by using m); 07 or 10 (by using mm)
s 	Second in minute 	Number 	7 or 10 (by using s); 07 or 10 (by using ss)
S 	Millisecond 	Number 	 7 or 10 or 100 (by using S); 07 or 10 or 100 (by using SS); 007 or 010 or 100 (by using SSS);
 
Not implemented:
M 	Month in year 	Month 	July; Jul; textual values (by using MMM or MMMM)
G  	Era designator 	Text  	AD
w 	Week in year 	Number 	27
W 	Week in month 	Number 	2
D 	Day in year 	Number 	189
F 	Day of week in month 	Number 	2
E 	Day in week 	Text 	Tuesday; Tue
a 	Am/pm marker 	Text 	PM
K 	Hour in am/pm (0-11) 	Number 	0
h 	Hour in am/pm (1-12) 	Number 	12
 * */
function formatDate(date, format){
	var dayInMonth = date.getDate();
	var fullDayInMonth = dayInMonth+'';
	if (fullDayInMonth.length<2){
		fullDayInMonth = "0"+fullDayInMonth;
	}
	var month = date.getMonth()+1;
	var fullMonth = month+'';
	if (fullMonth.length<2){
		fullMonth = "0"+fullMonth;
	}
	var fullYear = date.getFullYear()+'';
	var year = fullYear.substring(2);
	var hour = date.getHours();
	var fullHour = hour+'';
	if (fullHour.length<2){
		fullHour = "0"+fullHour;
	}
	var khour = hour+1;
	var fullKhour = khour+'';
	if (fullKhour.length<2){
		fullKhour = fullKhour+'';
	}
 
	var minutes = date.getMinutes();
	var fullMinutes = minutes+'';
	if (fullMinutes.length<2){
		fullMinutes = "0"+fullMinutes;
	}
	var seconds = date.getSeconds();
	var fullSeconds = seconds+'';
	if (fullSeconds.length<2){
		fullSeconds = "0"+seconds;
	}
	var millis = date.getMilliseconds();
	var fullMillis1 = millis+'';
	if (fullMillis1.length<2){
		fullMillis1 = '0'+fullMillis1;
	}
	var fullMillis2 = fullMillis1;
	if (fullMillis2.length<3){
		fullMillis2 = '0'+fullMillis2;
	}
 
	var result = format;
	result = result.replace(/MM/g, fullMonth);
	result = result.replace(/M/g, month);
	result = result.replace(/yyyy/g, fullYear);
	result = result.replace(/yy/g, year);
	result = result.replace(/dd/g, fullDayInMonth);
	result = result.replace(/d/g, dayInMonth);
	result = result.replace(/HH/g, fullHour);
	result = result.replace(/H/g, hour);
	result = result.replace(/kk/g, fullKhour);
	result = result.replace(/k/g, khour);
	result = result.replace(/mm/g, fullMinutes);
	result = result.replace(/m/g, minutes);
	result = result.replace(/ss/g, fullSeconds);
	result = result.replace(/s/g, seconds);
	result = result.replace(/SSS/g, fullMillis2);
	result = result.replace(/SS/g, fullMillis1);
	result = result.replace(/S/g, millis);
 
	return result;
}

Spring Acegi/Security auto-login

Secco — Sun, 17 Jan 2010 17:40:18 +0000

Usefull and thus noted:
In one of my current workprojects I had a registrationform the user filled. After formvalidation, I wanted to login the user automatically. This can be achieved in Spring / Acegi quite easy:

User user = createUser();
final RememberMeAuthenticationToken auth = new RememberMeAuthenticationToken(webKey, userAccount.getUser(), userAccount.getUser().getAuthorities()); 
auth.setAuthenticated(true); 
SecurityContextHolder.getContext().setAuthentication(auth);

Also logging user out (after database new creattion or session invalidation):

SecurityContextHolder.getContext().setAuthentication(null);

Java Collections

Secco — Sun, 08 Nov 2009 20:02:43 +0000

Derzeit arbeite ich viel mit Java 1.5. Durch das Interface Iterable kann man hier die kurze Schleifenvariante

Collection c = ...
for (final Object o:c){
  ...
}

einsetzen, die genauso auch für Arrays funktioniert.
Was jedoch nicht geht, ist das Hinzufügen von Arrays in Collections via collection.addAll(anArray);.
Hier hilft meine kleine Utilityklasse Collections weiter, die auch die Collection zurück liefert.
Zwei Dinge, die man bei java.util.Collections leider nicht bedacht hat…

import java.util.Collection;
import java.util.Map;
 
public final class Collections {
  private Collections(){}
 
  @SuppressWarnings("unchecked")
  public static final Collection add(final Collection collection, final Object [] values){
    for (final Object value:values){
      collection.add(value);
    }
    return collection;
  }
 
  @SuppressWarnings("unchecked")
  public static final Map put(final Map map, final Object [] keys, final Object [] values){
    for (int i=0; i<keys.length; i++){
      map.put(keys[i], values[i]);
    }
    return map;
  }
 
  public static final Collection remove(final Collection collection, final Object [] values){
    for (final Object value:values){
      collection.remove(value);
    }
    return collection; 
  }
}

Hibernate Deeper OrderBy

Secco — Sun, 08 Nov 2009 19:50:01 +0000

Hibernate unterstützt in der Criteria API bei der Angabe von Properties für Criterions oder auch Sortierungen lediglich die Angabe von Properties der Tiefe 1.
Beispielsweise ist criteria.addOrder(Order.asc("id")) möglich, jedoch criteria.addOrder(Order.asc("parent.id")) oder gar criteria.addOrder(Order.asc("parent.parent.id")) nicht möglich.
Um diese Abbilden zu können, muss man sich einiger Joins oder Aliase bedienen.
Im folgenden wird dies anhand der Sortierung gelöst.

Angenommen wir erhalten das Sortierkriterium als String orderBy, welches eine Property oder einen Property-Pfad für das entsprechende Attribut enthält.
So können mit Hilfe eines simplen “Parsers” die benötigten Aliase für Joins hinzugefügt werden.
Die Hilfsmethode StringUtil.occurences(String s, char c) zählt lediglich die Vorkommen von c in s.
Zusätzlich wird in boolean asc hinterlegt, ob absteigend (true) oder aufsteigend (false) sortiert wird.

final Criteria criteria = getCurrentSession().createCriteria(MyDomain.class, "d");
// d ist alias für unser domain objekt
 
if (orderBy!=null && orderBy.trim().length()>0){
  // erlaubt die benutzung von z. b. d.parent.object.name zum sortieren
  if (StringUtil.occurences(orderBy, '.')>0){
    final String [] parts = orderBy.split("\\.");
    criteria.createAlias("d."+parts[0], "x"+parts[0]);
    for (int t=1; t<=parts.length-2; t++){
      criteria.createAlias("x"+parts[t-1]+"."+parts[t], "x"+parts[t]);
    }
    orderBy = "x"+parts[parts.length-2]+"."+parts[parts.length-1];
  }
  if (asc){
    criteria.addOrder( Order.asc(orderBy) );
  }
  else{
    criteria.addOrder( Order.desc(orderBy) );
  }
}

Der Kode erzeugt Aliase für alle in der orderBy vorkommenden Properties und kann auch verwendet werden, um in Criterions einen entsprechenden Pfad zu bauen.

Spring Hibernate Snipplets

Secco — Sun, 08 Nov 2009 17:29:47 +0000

Few snipplets making the usage of hibernate with annotations within spring easier.

 name="systemProperties" 
  class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer" 
  lazy-init="false">
   name="location" value="classpath:myproject.properties"/>
>
 
 id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
   name="driverClassName" value="com.mysql.jdbc.Driver" />
   name="url" value="${db.url}" />
   name="username" value="${db.user}" />
   name="password" value="${db.password}" />
   name="maxActive" value="${db.maxconnections}"/>
   name="maxIdle" value="${db.minconnections}"/>
   name="maxWait" value="1500"/>
   name="poolPreparedStatements" value="true"/>
   name="initialSize" value="${db.minconnections}"/>
>
 

 id="customTableTypeMySQLInnoDBDialectInjector" 
  class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
   name="staticMethod" 
    value="de.keyboardsamurais.narcanti.common.hibernate.CustomTableTypeMySQLInnoDBDialect.setTableTypeString"/>
   name="arguments" value="DEFAULT CHARSET=utf8 COLLATE=utf8_bin"/>
>
 
	
 id="sessionFactory" 
  class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean" 
  depends-on="customTableTypeMySQLInnoDBDialectInjector">
   name="dataSource" ref="dataSource"/>
   name="annotatedPackages" value="myproject.domain"/>
   name="configurationClass" value="org.hibernate.cfg.AnnotationConfiguration"/>
   name="hibernateProperties">
    >
       key="hibernate.dialect">
        de.keyboardsamurais.narcanti.common.hibernate.CustomTableTypeMySQLInnoDBDialect
      >
       key="hibernate.hbm2ddl.auto">${db.hbm2ddl.auto}>
       key="hibernate.order_updates">true>
       key="hibernate.max_fetch_depth">1>
       key="hibernate.jdbc.batch_size">10>
       key="hibernate.connection.useUnicode">true>
       key="hibernate.connection.characterEncoding">utf8>
       key="hibernate.connection.characterSetResults">utf8>
       key="hibernate.connection.clobCharacterEncoding">utf8>
    >
  >
>
 
 id="transactionManager" class="org.springframework.orm.hibernate3.HibernateTransactionManager">
   name="sessionFactory" ref="sessionFactory" />
>
 

 id="daoTransactionProxyTemplate" abstract="true" 
  class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
   name="transactionAttributeSource">
     class="org.springframework.transaction.annotation.AnnotationTransactionAttributeSource"/>
  >
   name="transactionManager" ref="transactionManager" />
>
 

 id="daoTemplate" abstract="true">
   name="sessionFactory" ref="sessionFactory"/>
>
 

 id="myDao" parent="daoTransactionProxyTemplate">
   name="target">
     class="myproject.dao.MyDaoImpl" parent="daoTemplate"/>
  >
   name="proxyInterfaces" value="myproject.dao.MyDao"/>
>

Mukke: I need you

Secco — Sun, 01 Nov 2009 18:11:45 +0000

Diesmal ein etwas schnulziger Trance, den ich für Sarah geschrieben habe.
Die Vocals stammen aus dem Lied “So in love with you” von Duke.

Download