Page History

...

•  Possible XSS vulnerability in pages not using UTF-8 was fixed, read more details in S2-028
•  Prevents possible RCE when reusing user input in tag's attributes, see more details in S2-029
•  I18NInterceptor narrows selected locale to those available in JVM to reduce possibility of another XSS vulnerability, see more details in S2-030
• New Configurationprovider type was introduced - ServletContextAwareConfigurationProvider, see WW-4410
• Setting status code in HttpHeaders isn't ignored anymore, see WW-4545
• Spring BeanPostProcessor(s) are called only once to constructed objects., see WW-4554
• OGNL was upgraded to version 3.0.13, see WW-4562
• Tiles 2 Plugin was upgraded to latest available Tiles 2 version, see WW-4568
• A dedicated assembly with minimal set of jars was defined, see WW-4570
• Struts2 Rest plugin properly handles JSESSIONID with DMI, see WW-4585
• Improved the Struts2 Rest plugin to honor Accept header, see WW-4588
• MessageStoreInterceptor was refactored to use PreResultListener to store messages, see WW-4605
• A new annotation was added to support configuring Tiles - @TilesDefinition, see WW-4606
• Fixed all reported issues related to new version of the Apache Tiles, see WW-4622, WW-4623, WW-4624
• MessageStoreInterceptor was extended to support 3rd-party RedirectResult subclasses, see WW-4618
• EmailValidator supports .cat domain, see WW-4626
• and few and many other small improvements, please see the release notes

...