Apache Wicket

Wicket 1.5.6 released

2012-05-07T00:00:00+03:00

This is the sixth maintenance release of the Wicket 1.5.x series. This release brings over 40 bug fixes and improvements.

Git tag
Changelog
To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>1.5.6</version>
</dependency>

Download the full distribution (including source)

Wicket 6.0.0-beta1 released

2012-03-26T00:00:00+03:00

The Wicket team is proud to announce the first beta release of the Wicket 6.x series. This release brings over many improvements over the 1.5.x series.

Check the roadmap with a list of the major goals. And the migration guide with all major and some minor changes between 1.5.x and 6.x series.

The Jira changelog of all closed ticket at Jira

To use it in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>6.0.0-beta1</version>
</dependency>

If you don’t use dependencies management build tool then you can download the full distribution (including source).

There are no more planned API breaks but if you find something that can be made better now it the time to discuss it! We will try to avoid making any API changes in the Release Candidates that will follow this beta release.

Any feedback about the new features, their implementation and their documentation is very welcome!

The Wicket team!

CVE-2012-1089 - Apache Wicket serving of hidden files vulnerability

2012-03-22T00:00:00+02:00

Vendor: The Apache Software Foundation

Versions Affected: Apache Wicket 1.4.x and 1.5.x

Description: It is possible to view the content of any file of a web application by using an Url to a Wicket resource which resolves to a ‘null’ package. With such a Url the attacker can request the content of any file by specifying its relative path, i.e. the attacker must know the file name to be able to request it.

Mitigation: Setup a custom org.apache.wicket.markup.html.IPackageResourceGuard that provides a whitelist of allowed resources. Since versions 1.4.20 and 1.5.5 Apache Wicket uses by default org.apache.wicket.markup.html.SecurePackageResourceGuard with a preconfigured list of allowed file extensions. Either setup SecurePackageResourceGuard with code like:

public class MyApp extends WebApplication {
    public void init() {
        super.init();
        SecurePackageResourceGuard guard = new SecurePackageResourceGuard();
        guard.addPattern(...);
        guard.addPattern(...);
        getResourceSettings().setPackageResourceGuard(guard);
    }
}

or upgrade Apache Wicket 1.4.20 or Apache Wicket 1.5.5

Credit: This issue was discovered by Sebastian van Erk.

CVE-2012-0047 - Apache Wicket XSS vulnerability via pageMapName request parameter

2012-03-22T00:00:00+02:00

Vendor: The Apache Software Foundation

Versions Affected: Apache Wicket 1.4.x

Apache Wicket 1.3.x and 1.5.x are not affected

Description: A Cross Site Scripting (XSS) attack is possible by manipulating the value of ‘wicket:pageMapName’ request parameter.

Mitigation: Upgrade to Apache Wicket 1.4.20 or Apache Wicket 1.5.5

Credit: This issue was discovered by Jens Schenck and Stefan Schmidt.

Wicket 1.5.5 released

2012-03-12T00:00:00+02:00

This is the fifth maintenance release of the Wicket 1.5.x series. This release brings over 50 bug fixes and improvements.

Git tag
Changelog
To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>1.5.5</version>
</dependency>

Download the full distribution (including source)

Wicket 1.4.20 released

2012-03-12T00:00:00+02:00

This is twentieth release of the Wicket 1.4.x series. This is primarily a minor bugfix release on the 1.4.x (stable) branch.

Subversion tag
Changelog
To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket</artifactId>
    <version>1.4.20</version>
</dependency>

Download the full distribution (including source)

Wicket 1.5.4 released

2012-01-23T00:00:00+02:00

This is the fourth maintenance release of the Wicket 1.5.x series. This release brings over 68 bug fixes and improvements.

Git tag
Changelog
To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>1.5.4</version>
</dependency>

Download the full distribution (including source)

Wicket 1.5.3 released

2011-11-14T00:00:00+02:00

This is the third maintenance release of the Wicket 1.5.x series. This release brings over 40 bug fixes and improvements.

Subversion tag
Changelog
To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>1.5.3</version>
</dependency>

Download the full distribution (including source)

Wicket 1.5.2 released

2011-10-24T00:00:00+03:00

This is the second maintenance release of the Wicket 1.5.x series. This release brings over 25 bug fixes and 5 improvements.

Subversion tag
Changelog
To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>1.5.2</version>
</dependency>

Download the full distribution (including source)

Wicket 1.4.19 released

2011-10-17T00:00:00+03:00

This is nineteenth release of the Wicket 1.4.x series. This is primarily a minor bugfix release on the 1.4.x (stable) branch.

Subversion tag
Changelog
To use in Maven:

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket</artifactId>
    <version>1.4.19</version>
</dependency>

Download the full distribution (including source)