Version 6.7.0 built on 2011-10-04.

Release Notes for Vaadin Framework 6.7.0

Package Contents

Vaadin is a Java framework for building modern web applications that look great, perform well and make you and your users happy. Vaadin is available under the Apache 2 license (see license.html).

Vaadin is distributed as a single JAR file. Inside the JAR you will find:

Security fixes in Vaadin 6.7.0

Vaadin 6.7.0 incorporates fixes for the following security issues:

These issue were discovered by Wouter Coekaerts (http://wouter.coekaerts.be/) and an internal review. Immediate upgrade to a version containing the fixes (6.6.7 or later or 6.7.0 or later) is strongly recommended for all users.

The most serious of these issues is the directory traversal attack that can allow read access to the class files of an application as well as some configuration information.

If unable to immediately upgrade Vaadin to a version containing the fixes, the directory traversal vulnerability can be mitigated by not mapping the context path "/VAADIN" to a Vaadin servlet in web.xml but instead deploying such static resources (themes and widgetsets) directly on the server and serving them as files.

The other vulnerabilities typically require user actions (pasting text crafted by the attacker into the application or following a link crafted by the attacker) for a successful attack, but may be exploitable more directly in certain applications. They can allow the attacker to control the user session for the application in the browser.

Enhancements in Vaadin 6.7.0

SQLContainer

SQLContainer connects your application to an SQL database using JDBC. SQLContainer allows you to easily bind data stored in a SQL database to Table and Select components, as well as edit the data using Forms. Compared to many object-relational tools this provides you with fast, low-level database access.

SQLContainer was previously distributed as an add-on and has now been integrated into the framework.

TreeTable

TreeTable is an extended Table component that can show hierarchical structures in its first column. Users can show or hide children from a small icon before the actual column value in the first column.

TreeTable is, similarly to Table, designed to scale well with large number of rows by only sending the needed rows to the browser. With the Collapsible Container extension, a developer can build the data provider so that it does not consume too much memory on the server side either.

Chameleon Theme

Chameleon Theme provides a completely new look and feel for your application.

The theme is built on top of the Vaadin Base theme and tries to keep out of the way where appropriate, so small modifications are easy to do with CSS.

The theme contains several different useful styles for many of the basic components like big and warning for a Label. You can even combine many styles together, like big warning

If the default color scheme does not suit your taste, feel free to use the online color scheme editor at http://demo.vaadin.com to build a customized theme.You can also change the base font size for the whole theme with the same editor.

Note that the theme is intentionally simplified for some browsers, most notably old Internet Explorer versions.

Notification now supports a plain text mode for its contents

OptionGroup now supports a HTML mode for the item captions

OptionGroup now supports item icons

MenuBar now supports a HTML mode for the item captions

ComboBox now supports scrolling using the mouse wheel

Table ColumnGenerator can now generate plain text in addition to Components

TabSheet tabs can be styled individually

Button can be automatically disabled when clicked

Tree, Table and TreeTable support tooltips for individual items or cells

Table and TreeTable now support GeneratedRows that can be used for grouping or summary rows

TreeTable supports animation for expand and collapse operations

TreeTable supports expand and collapse listeners

PopupDateField and InlineDateField now support time zones

ComboBox can now be used as a replacement for NativeSelect

Audio and Video components implement support for HTML5 <audio> and <video> elements.

CDI can now also be used with @SessionScoped beans.

Sampler is no longer distributed as part of Vaadin 6.7.0. It will be available as a separate download

Book of Vaadin is no longer distributed with Vaadin 6.7.0. It is available as a separate download from http://vaadin.com/book

The full details of the enhancements can be found at dev.vaadin.com.

Fixes in Vaadin 6.7.0

#7186 SQLContainer leaves transactions open if an OptimisticLockException occurrs
#7224 Table context menu does not work before refreshing table contents
#7369 Vaadin and CDI - can't use SessionScoped beans
#7479 Vaadin apps cannot current be deployed on IBM WebSphere v8
#7561 TreeTable: expanding a row far down in the table causes IndexOutOfBoundsException
#7626 Form size is calculated incorrectly after clearing its data source
#7687 Drag between table and the last top level item in tree broken
#5780 TreeTable uses images that not display transparent in IE6
#5924 Link as generated table column does not present browser context menu on right click
#6499 AbstractApplicationServlet#handleDownload() does not close streams in case of exception
#6588 Repainting in TextChangeListener will send wrong value to client.
#7012 Table content cells & column headers get out of sync when uncollapsing columns
#7028 TreeTable: Navigating too fast with keyboard makes selection jump
#7057 Table and tree keyboard navigation completely broken if validators are used
#7292 Changing pagelength in an expand/collapse listener does not redraw a TreeTable correctly
#7433 GAE integration test should use GAEApplicationServlet
#7434 SQLContainer - reseting value of Property fails
#7443 Chameleon datefield text part and button have different heights
#7446 Keyboard Navigation with problems on Table
#7454 Table keyboard navigation breaks in IE on multiple keyboard multiselections
#7478 Util.escapeHtml incorrectly converts newline to <br> and space to "&nbsp;" in IE6-IE8
#7490 Multi-line text fields visual and height issues in Chameleon theme
#7597 NullPointerException with SQLContainer's J2EEConnectionPool
#7697 SQLContainer.containsId logs a ClassCastException
#7699 All tests that check properties of Vaadin classes fail
#3710 Width is miscalculated for the footer layouts in forms of undefined size
#3725 Form adds a description tag to the DOM even if there is no description.
#3983 Labels in IE7 are rendered as preformatted by default
#5382 Table headers and content not aligned after content modification
#5488 Link: Error when trying to use a link to a file with a percent in the filename
#5608 Item icons do not work in OptionGroup
#5683 TwinColSelect keyboard navigation selects wrong item
#5738 TabSheet's first visible tab should be rendered as if it is the first tab
#5851 isLastId() may throw NullPointerException
#5868 GridLayout's size is calculated wrong when elements span over multiple cells.
#6148 Multiselect breaks TreeTable keyboard navigation
#6770 DateField: Error indicator not shown if required
#7018 Table column drag&drop visually broken
#7032 LoginForm should explicitly define utf-8 charset in getLoginHTML() method
#7065 ConcurrentModificationException in AbstractWebApplicationContext.endTransaction() and startTransaction()
#7092 TextField does not support setting maxLength=0
#7097 Tooltip with long contents flickers
#7100 Tooltip is displayed off screen when component is at the lower edge of the screen
#7101 ComponentLocator should only return elements that are attached to the DOM
#7208 Adding SplitterClickListener to SplitPanel causes splitter to jump in Chrome when clicked.
#7230 Key Navigation in Tree-Component - Scrolling-"Bug"
#7284 Disabling a VNativeButton should set v-disabled style
#7326 Width recalculation does not work for GridLayout inside CustomComponent
#7338 Column alignment cannot be changed from right/center to left
#7340 The rendering is wrong the first time a table column is sorted
#7388 Expand/collapse icon offset in IE7
#7391 SQLContainer unconsiders modified cache
#7393 Resizing a Table column does not resize contents
#7422 AbstractComponent.setStyleName containing spaces causes illogical results
#7462 Inserting a panel in a scrolling panel scrolls up to the top
#7472 PopupDatefield button should not be focusable
#7485 Build script doesn't include resources for release-notes.html
#7493 Release notes should only list versions supported by this particular release
#7505 TreeTable arrow icons clipped in FF, IE9 & Opera
#7534 TreeTable: navigating with the left arrow key has focus issues
#7535 TreeTable: navigating with the right arrow key in a multiselect table selects too much
#7564 Resizing table column from the server only resizes the header
#7605 VTreeTable throws NPE
#7620 TreeTable generated columns Components out of sync after node expand
#7644 Table: Odd/even row styles get mixed up when lazy loading
#7667 Resizing column in Safari 5.1 causes scrollbar to return to the left
#7508 Table column being dragged has pixels from following sprite at the bottom with reindeer
#2669 Tabsheet failes to render cached tab

The full details of the defects can be found at dev.vaadin.com.

Backwards incompatible changes in Vaadin 6.7.0

Table.ColumnGenerator.generateCell has been changed to return Object instead of Component to enable generation of plain text.

Package names for SQLContainer, TreeTable and Chameleon Theme java files have been changed from com.vaadin.addons.* to com.vaadin.*

If you have been using SQLContainer, TreeTable or Chameleon Theme as add-ons, remove the add-on jars from the project.

The DOM structure of Forms without descriptions has changed, which means that any TestBench scripts testing this kind of Form need to be updated. If your tests start failing, subtract one from the index in the test script, e.g. change 

VForm[0]/domChild[0]/domChild[3]
into 
VForm[0]/domChild[0]/domChild[2]
and your tests will pass again.

Vaadin 6.7.0 dependencies

Vaadin uses GWT 2.3.0 for widget set compilation. GWT can be downloaded from http://code.google.com/webtoolkit/. GWT can also be automatically downloaded by the Vaadin Plug-in for Eclipse. Please note that GWT 2.3.0 requires the validation-api-1.0.0.GA.jar and validation-api-1.0.0.GA-sources.jar files in addition to gwt-dev.jar and gwt-user.jar for widget set compilation.

Upgrading to Vaadin 6.7

When upgrading from an earlier Vaadin version, you must

Remember also to refresh the project in your IDE to ensure that the new version of everything is in use.

Using the "?debug" URL parameter you can verify that the version of the servlet (JAR), the theme and the widgetset all match.

Eclipse users should always check if there is a new version of the Eclipse Plug-in available. The Eclipse Plug-in can be used to update the Vaadin version in the project (Project properties » Vaadin).

Maven users should update the Vaadin dependency version in the pom.xml unless it is defined as LATEST . You must also ensure that the GWT dependency uses the correct version and recompile your project and your widget set.

Liferay and other portal users must install the new vaadin-6.7.0.jar as ROOT/WEB-INF/lib/vaadin.jar in the portal. Additionally the contents of the VAADIN folder from the JAR must be extracted to the ROOT/html/VAADIN directory in the Liferay installation. If your portal uses custom widgets, install the latest version of Vaadin Control Panel for Liferay for easy widget set compilation.

Upgrading from Vaadin 6.5 or earlier

If you are upgrading from 6.5.x or earlier, notice that Vaadin 6.7.0 uses GWT 2.3.0. Upgrade your dependencies as necessary. See the dependencies section for more information.

Upgrading from Vaadin 6.1 or earlier

The way widget sets are created was completely changed in Vaadin 6.2. Existing projects, where custom widgets (a custom widget set) are used, must be migrated when upgrading to Vaadin 6.2 or later. Projects where the default widget set is used do not need migration. See Vaadin 6.2.0 release notes for more details.

Known problems and limitations in Vaadin 6.7.0

Notes and Limitations for Google App Engine

The following instructions and limitations apply when you run a Vaadin application under the Google App Engine.

For other known problems, see open tickets at developer site dev.vaadin.com.

Supported technologies

Vaadin is based on Java 5 and it is also compatible with most other operating system supporting Java 5 or newer. Vaadin is supported on the following operating systems:

Vaadin requires Java Servlet API 2.3 but also supports later versions and should work with any Java application server that conforms to the standard. The following application servers are supported:

Vaadin supports JSR-168 and JSR-286 Portlet specifications. All portals that implement either of the portlet specifications should work. The following portals are supported:

Vaadin also supports Google App Engine.

Vaadin supports the following browsers:

Vaadin on the Web