lutece-platform/lutece-core

Lutece Core

What is Lutece?

Lutece is an open platform that enables city governments to share, re-use and adapt digital services created by other cities. Lutece is free, modular and secure.

Through Lutece, discover more than 400 off-the shelf modules to power your digital services and respond to resident needs.

You can easily customize and enhance modules to fit their city’s needs or create digital modules from scratch and share it back with the Lutece community.

Free	Modular	Secure
Lutece is built on open-source, which means its source code is freely available.	Lutece allows you to customize one of 400 off-the-shelf modules or create your own to meet your specific needs.	Lutece is a proven, stable and secure platform that is used by public sector organizations around the world.

Project Information

• The official Lutece site : https://lutece.paris.fr
• The open source Project License
• Technical documentation Lutece WIKI
• Lutece MOOC : This course will teach you all the basics of development with Lutece.
• The Lutece demo site online (data reset every 3 hours)
• Lutece docker hub : Project's Docker built-in images
• Lutece platform Source Repository : the online repository for all the Lutece plugins.
• Lutece platform Package Repository : the package repository for all the Lutece plugins.
• Issue Tracking : Issue management system for this project (authentication needed).

Maven documentation and reports

generated by xdoc2md - do not edit directly.

lutece-core's Issues

Issue tracker not answering

Link to issue tracker (http://dev.lutece.paris.fr/jira/browse/LUTECE) available in README file lead to a server not answering (dev.lutece.paris.fr).

Project summary link in README is broken

Anywhere it should go?

The fr.paris.lutece.tools:build-config:jar:1.2.1 doesn't exist.

Site: Technical Documentation fix broken link

Hi,

The link of the Technical Documentation seems broken.

Cheers,

Miss to call clearPassword for PBEKeySpec

I am reaching out to you as we conducted an empirical study to understand the nature of cryptographic misuses in enterprise-driven projects on GitHub. During our study, we randomly inspected a few of the misuses. One of the misuses for which we could confirm the finding of the analysis, CogniCryptSAST is within this project.

In the class PasswordFactory$PBKDF2Password miss to call the method clearPassword after generating the password. This method (JCA) clears an internal copy of the password from memory. Thus, it should be called to ensure that an attacker can not obtain the password from memory.

We hope that this report helps you and would be glad to get your thoughts on this issue.

is not found HtmlTemplate.java

is not found fr.paris.lutece.util.html.HtmlTemplate.java

AppLogService makes it too easy to swallow a stacktrace

There are at least hundreds of places in our codebase where the code reads like

try
{
...
}
catch ( Exception e )
{
    AppLogService.error( e )
}

This swallows the exception stacktrace.

SLF4J decided against accepting object as an input to a log method because of this : https://www.slf4j.org/faq.html#string_or_object
(although log4j2 still has this API..)

What about adding a new override to AppLogService like this ?

public static void error( Throwable t )
{
            _loggerErrors.error( t, t );
}

If people really want to log only the exception name, then they can do AppLogService.error ( e.toString() );

@rzara @pierrelevy ?