Broadleaf Commerce | eCommerce Without Limits @broadleaf - Tumblr Blog

Broadleaf's Unique Application Context Merge Process Explained

I'm currently in Washington, DC at the excellent SpringOne conference. I had the honor of presenting yesterday at the conference. My presentation was titled "An Introduction to Broadleaf Commerce: A Spring Enabled eCommerce Framework". I discussed the features of Broadleaf Commerce, complete with a demo of the Broadleaf starter application and administrative console.

I also presented a case study that demonstrated how to build flash sales functionality with Broadleaf. In particular, I made the case that it was quite easy to customize Broadleaf with complex functionality such as a shopping cart flow that reserves inventory when adding an item to the cart, and reclaims that inventory if the user does not initiate another action within a period of time. Of course this functionality is important for sites that sell event tickets and for sites that have brief, "flash" sales with limited, perishable inventory.

Flash sales functionality is not currently available as a standard feature in Broadleaf. But it is a very real and somewhat complex requirement for many companies, which is the reason I chose this feature for the case study portion of my presentation. The demo code can be downloaded here. (There are a few small bugs, and it is, by no means, meant to be production ready. In other words, it's meant for educational purposes only. :)

In addition to showcasing the features of Broadleaf Commerce, I was attempting to demonstrate the ease of extending and customizing the framework. Part of this involved discussing how The Spring Framework powers Broadleaf Commerce. I discussed Broadleaf's unique Spring Application Context merge process, which allows a developer to inject their own implementations of Broadleaf components into the framework to override or augment Broadleaf's default functionality at its core. And this brings me to the purpose of this blog.

First, let me describe the basics of Broadleaf's application context merge process:

The Merge Process

Broadleaf provides a number of complex default configurations, bean definitions, and associated dependencies. These are all nicely tucked away in jar files to be used by a developer. But if they're in the jar file, how do you override them? The answer is Broadleaf's Application Context Merge Process. Broadleaf provides a MergeContextLoaderListener that can be configured in your web.xml file. In order to use it, you simply set a context parameter with the XML files that you define with additional or custom bean definitions:

<context-param> <param-name>patchConfigLocation</param-name> <param-value> classpath:/bl-open-admin-contentClient-applicationContext.xml classpath:/bl-cms-contentClient-applicationContext.xml classpath:/bl-demo-applicationContext.xml /WEB-INF/applicationContext-datasource.xml /WEB-INF/applicationContext-security.xml /WEB-INF/applicationContext-email.xml /WEB-INF/applicationContext.xml </param-value> </context-param>

Broadleaf will merge these XML files with its own, adding any new bean definitions and overriding any default components that have the same bean name with the new implementations defined by you. But a question came up after the presentation: "Why do you use a merge process like this when Spring provides a Standard mechanism to override bean definitions?" On the spot, I have to admit that I was stumped. I thought, "Well that's a good question. I wonder why not."

Needless to say, I didn't have a great answer at the time. It wasn't because this is a new capability in Spring. Spring has allowed this for a long time. So why would we have a unique merge process that requires XML configurations of Spring application context files? Why wouldn't we just use Spring's default capabilities to override bean definitions? After some thought and discussion with my colleagues, I remembered that we are not simply replacing bean definitions. We are overriding partial bean definitions.

Remember that Broadleaf's default configuration and dependency graph is quite complicated, by necessity. We've attempted to provide an exceptionally rich set of features out of the box, wired together with generally accepted best design patterns in mind. We necessarily define 3 different data sources (e.g. to allow for PCI compliance if you choose to store payment card information). We've set up transaction boundaries accordingly. There are beans that depend on lists of other beans. So, what's my point? Simply replacing one bean definition can potentially lead to a lot additional of complicated configurations.

The solution was to provide a unique Spring application context merge process, using XML and XPath. This merge process defines a default strategy for how things get merged. We don't simply replace the entire bean definition in all cases, as Spring's default strategy would do. Instead, we also provide strategies for overriding partial bean definitions. For example, look at the following default Broadleaf configuration defining a list of fulfillment pricing providers that each can process different fulfillment options:

This definition is provided inside the Broadleaf libraries and defines the default list of fulfillment pricing providers. Imagine, now, that you want to add additional pricing providers, either in your own application or by adding multiple plugins that also define pricing providers. For example, you include a FedEx integration plugin that has the following snippet in its jar:

...and you also include the UPS integration plugin that has the following snippet in its jar:

Rather than knowing that you need to combine all of these together, you simply define the ones that you want to add, as with the FedEx and UPS examples above. The result after the merge occurs, will look like this:

In other words, rather than simply replacing one bean with another, the three beans are merged into one in this case. If you mistakenly added one of the defaults, to an additional configuration, it would simply replace it rather than duplicate it.

Here's how it works:

Broadleaf provides a class called MergeManager that is responsible for actually merging files together. The default strategy for most beans is to simply replace one bean definition with another. However, as described above, there are certain situations where replacing the entire bean is not the default strategy. These special strategies are defined in a file called default.properties, located in the package org.broadleafcommerce.common.extensibility.context.merge. This file contains the merge rules for certain special cases. For example, the above case is defined in default.properties like this:

handler.16=org.broadleafcommerce.common.extensibility.context.merge.handlers.NodeReplaceInsert priority.16=16 xpath.16=/beans/bean[@id='blFulfillmentPricingProviders']/* handler.16.1=org.broadleafcommerce.common.extensibility.context.merge.handlers.InsertItems priority.16.1=1 xpath.16.1=/beans/bean[@id='blFulfillmentPricingProviders']/property[@name='sourceList']/list/ref

The NodeReplaceInsert class and InsertItems class are Broadleaf special merge handlers that know how to replace or merge certain XML nodes with others based on XPath expressions. This default.properties file can be overridden by the end user. However, it's extremely rare that one should need to do this.

In addition to merging Spring context files, Broadleaf similarly merges JPA persistence.xml files and EhCache configuration files.

Conclusion

So, it should be clear by now that Broadleaf's Application Context Merge Process makes it much easier to control and override the complex, domain-specific configurations of Broadleaf Commerce without needing to know how to specifically override the entire bean definition. It is still the ability to extend The Spring Framework that makes all this possible.

And of course, SpringSouce continues to innovate in this area as well, providing more and more options, besides XML, for configuration. Broadleaf, no doubt, will continue to embrace SpringSource's innovations, standards, and recommendations. We will continue to innovate in our own right to ensure that users of the Broadleaf Framework have the simplest, most powerful, and most flexible eCommerce framework available.

Finally, I want to shout out a big thanks to SpringSource and No Fluff Just Stuff for putting on a great conference, and for allowing me the opportunity to present on Broadleaf Commerce!

#broadleaf #commerce #springone #ecommerce #demo #application #webdev #web development #flash

Preventing Session Hijacking With Spring

Session hijacking is an exploit.

Session fixation, as it is also called, relies on the fact that HTTP is a stateless protocol and users must identify themselves to servers on every request with a shared session id, which is typically stored as a cookie. The core of the attack relies on obtaining that session id and then setting your own session id to that value. This lets you "steal" another user's session and impersonate them. Obviously, this is unacceptable, especially for an open-source ecommerce framework like Broadleaf, and we need to ensure that we are protecting our users' data as much as we can. We'll cover our strategy to protect against session hijacking shortly, but first, let's analyze a couple of different attacks that we can utilize to steal a session.

Three ways to obtain another user's session id

Sniff the cookie

The most technically simple method we can use is to sniff someone's cookie....

Continue

#tech #webdev #piracy #news #website #web #development #ecommerce #privacy #technology #business

Deploying Broadleaf Commerce 2.0 on Amazon Elastic Beanstalk

In this tutorial, we'll show you how to deploy the Broadleaf Demo to Amazon Elastic Beanstalk. If you don't have the Broadleaf Demo already built and ready to go, please follow the Getting Started tutorial first.

Create an Amazon RDS Instance

We will begin by creating a MySql Database instance through the AWS console. Launch the DB Instance Wizard, and create a MySql 5 database with the following properties:

You should see the instance start up, and then note the endpoint of your database.

Modify the Demo Application to use MySql

For this tutorial, we will be using the MySql 5.1.20 connector. So, go ahead and download the latest connector and place that jar into your WEB-INF/lib directory.

Next, modify common-shared.properties to use the MySql Dialect

blPU.hibernate.dialect=org.hibernate.dialect.MySQLDialect blCMSStorage.hibernate.dialect=org.hibernate.dialect.MySQLDialect blSecurePU.hibernate.dialect=org.hibernate.dialect.MySQLDialect

Modify the root POM to add the MySql dependency

<dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <version>5.1.20</version> <scope>runtime</scope> </dependency>

Make sure to add the dependencies to your Site POM as well

<dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> </dependency>

Modify the applicationContext-dataSource.xml to point to your Amazon RDS instance -- note: For ease of this tutorial, we will use bean definitions instead of JNDI lookups.

Deploy to AWS

Rebuild the Demo Application and upload site.war to Amazon Elastic Beanstalk

Launch the Elastic Beanstalk Wizard, and choose the 32-bit Amazon Tomcat 7 instance

Follow the steps to create your new instance. You will want to create a public/private key pair in order to SSH into your instance. Follow the generating a KeyPair tutorial to learn how to do so.

SSH into your instance

You can SSH into your instance using the following user: ec2-user For example:

ssh -i ~/.ec2/blc-mykeypair.pem [email protected]

By default, AWS Elastic Beanstalk log output from Tomcat is written to/opt/tomcat7/logs/tail_catalina.out (depending on your version of tomcat)

Done!

#broadleaf #amazon #elastic #development #mysql #database #webdev #web development #ecommerce #app #application #tech #technology #business

Why your eCommerce site should integrate with Spring Social

Despite the recent departure of Eran Hammer, one of the lead authors and editors, from the OAuth 2.0 specification with what would seem to be a crippling end to the very popular protocol, the OAuth 2.0 Sky is in fact NOT falling. Hammer cites one of the main reasons for leaving the specification is the fact that the specification is "getting more complex, less interoperable, less useful, more incomplete, and most importantly, less secure." He states, "OAuth 2.0 at the hand of a developer with deep understanding of web security will likely result is a secure implementation. However, at the hands of most developers - as has been the experience from the past two years - 2.0 is likely to produce insecure implementations." This is an alarming statement considering most sites on the web use a form of OAuth to share resources. Despite this, Hammer states that the spec is not "dead", he just thinks it's bad. He shares some good points on the future of OAuth and what you need to know if you are implementing it. As of this article, the OAuth wikipedia page shows a list of service providers that actively use a form of the OAuth protocol.

So, regardless of where you think the specification is going, the reality is that so many service providers have already adopted OAuth as the de-facto standard for sharing private resources across the web, it doesn't look it will be going anywhere anytime soon.

Why Broadleaf uses Spring Social

If you have a Spring application and are looking to integrate with an OAuth provider, there's no reason not to use Spring Social. As Hammer's statement alludes to, implementing the OAuth "dance" is a non-trivial task. Because OAuth is still a moving specification, a lot of providers have their own implementations. Managing these connections across multiple providers yourself would be very hard and tedious. The good folks over at Spring know this and came up with the Spring Social framework. The framework makes it extremely easy to integrate with service providers that use OAuth such as Facebook and Twitter. One of the key benefits is the abstraction layer that it provides on top of the different authentication schemes. It currently handles both OAuth 1 and OAuth 2. Spring Social provides clear interfaces, so if you want to integrate with your own custom provider, there is an easy way to extend Spring Social Core to do so.

What does this mean to my eCommerce Site?

It's now pretty apparent that social media can play a huge part in developing a relationship between a customer and their merchant. The hard part is finding the right way to utilize social media to communicate your message clearly to your consumers. Twitter posted a case study that outlines how Zappos uses their service to generate over 1,200 conversations per month with its customers. Well the team at Broadlef realize that alot of merchants want the ability to utilize these services. We plan to make it easy for the framework to integrate with these services using Spring Social.

Why integrate Broadleaf with Facebook and Twitter?

Catering to your Customers

What if you had the ability to target specific content or promotions based on a tweet or attributes on your facebook profile? In a following post, I will discuss some ways to utilize the integrations with Facebook and Twitter to cater your content to your customers using Broadleaf.

In the meantime, let your customers sign in with their social networks

As of Broadleaf Commerce 2.1, the framework provides integrations points necessary to use Spring Social. Below, I will outline the steps necessary to add a "Sign in with Twitter" or "Sign in with Facebook" button to the Broadleaf Demo Site. If you don't have the Broadleaf Demo running, you can follow the Getting Started guide here

Step 1) Add the Spring Social dependencies to your root POM

<dependency> <groupId>org.springframework.social</groupId> <artifactId>spring-social-facebook</artifactId> <version>1.0.2.RELEASE</version> <type>jar</type> <scope>compile</scope> </dependency> <dependency> <groupId>org.springframework.social</groupId> <artifactId>spring-social-twitter</artifactId> <version>1.0.2.RELEASE</version> <type>jar</type> <scope>compile</scope> </dependency> <dependency> <groupId>org.springframework.social</groupId> <artifactId>spring-social-web</artifactId> <version>1.0.2.RELEASE</version> <type>jar</type> <scope>compile</scope> </dependency>

Make sure to add the dependencies to your Site POM as well

<dependency> <groupId>org.springframework.social</groupId> <artifactId>spring-social-facebook</artifactId> </dependency> <dependency> <groupId>org.springframework.social</groupId> <artifactId>spring-social-twitter</artifactId> </dependency> <dependency> <groupId>org.springframework.social</groupId> <artifactId>spring-social-web</artifactId> </dependency>

Step 2) Create a new applicationContext-social.xml

Modify the current applicationContext-servlet.xml and add the following bean:

Modify the current applicationContext-security.xml and add the following "https" intercept

<sec:intercept-url pattern="/signin/**" requires-channel="https" />

Step 3) Modify your Broadleaf Runtime Properties files

For example, my development.properties file looks like:

#Spring Social facebook.clientId=my_client_id facebook.clientSecret=my_client_secret twitter.consumerKey=my_consumer_key twitter.consumerSecret=my_consumer_secret application.url=http://127.0.0.1:8080

Step 4) Add your new applicationContext-social.xml to web.xml

<context-param> <param-name>patchConfigLocation</param-name> <param-value> classpath:/bl-open-admin-contentClient-applicationContext.xml classpath:/bl-cms-contentClient-applicationContext.xml classpath:/applicationContext.xml /WEB-INF/applicationContext-datasource.xml /WEB-INF/applicationContext-email.xml /WEB-INF/applicationContext-security.xml /WEB-INF/applicationContext-social.xml /WEB-INF/applicationContext.xml </param-value> </context-param>

Step 5) Change your RegisterController to extend BroadleafSocialRegisterController

By default, it extends BroadleafRegisterController

@Controller @RequestMapping("/register") public class RegisterController extends BroadleafSocialRegisterController { ... }

Step 6) Finally, add the sign in buttons to your login page

Add the following html to login.html

<h4>OR</h4> <blc:form th:action="@{/signin/twitter}" method="POST"> <button type="submit"><img th:src="@{/img/social/sign-in-with-twitter-l-sm.png}"/></button> </blc:form> <br/> <blc:form th:action="@{/signin/facebook}" method="POST"> <button type="submit"><img th:src="@{/img/social/facebook_16.png}"/> Sign in with Facebook</button> </blc:form>

Done!

Test your integrations with Facebook and Twitter! Now your customers can login with their Facebook and Twitter account instead of signing in with your application's credentials.

#ecommerce #spring social #framework #oauth #web development #webd #retail #tech #technology

Broadleaf Commerce Announces Classroom Training

Broadleaf Commerce is now offering instructor led training classes in Dallas, TX.

New Courses Overview

Fundamentals of Broadleaf Commerce for Developers

In this course, developers learn the key components of the Broadleaf Commerce framework.

Designed with challenging labs and led by an experienced member of the Broadleaf Commerce core development team, students will leave with a good understanding of the best ways to use and customize the framework.

Broadleaf Commerce Admin For Business Users

In this one day course, business users learn the details of catalog management, creating offers, and targeting content using the Broadleaf Commerce admin.

Custom Training and Quick Start Offerings are Still Available

In addition to formal trainig, the Broadleaf Commerce team can come to your location for a custom training or project kick-start. Generally 3-5 days, this highly valuable offering can be customized to meet your specific needs.

For more information, see our training page.

#broadleaf commerce #broadleaf #developers #webdev #web development #ecommerce #training #business

Securing Thymeleaf Forms Against CSRF Attacks

Security is one of my favorite topics, and I really enjoy working with it any chance I get. Recently, I wanted to establish a really easy way to secure Broadleaf Commerce against CSRF attacks. Initially, we had an implementation that relied on a user adding a CSRF token to a form that he wanted to secure and then check the token in the controller. It worked well, but it didn't seem powerful enough. Also, it was tough to get it to collaborate with Spring Security 3.1 since the login requests don't go through your own controller by default, but rather through Spring's when you're using <sec:form-login>.

I ran across a great blog by Eyal Lupu that deals with a more generic way of securing forms, and I decided to implement something similar that works with the default templating engine for Broadleaf, Thyemleaf. My goal was to have the token automatically injected into any form that submits via POST and then a security filter to check all POST requests. Let's check it out.

Adding the CSRF token to all forms

I decided to handle this by creating a Thymeleaf processor that would add a child node to a given element. I created a generic FormProcessor that could be extended to modify forms in other ways than just adding this token, but for now, that's all it does.

Keep reading

#broadleaf #commerce #ecommerce #csrf #forms #web #web development #webdev #thymeleaf

Broadleaf Continues to Choose Spring Framework

The debate about whether Spring Framework or Java EE is the best framework for building enterprise applications has been raging since Java EE 5 was released by Sun Microsystems in 2006.

Spring made things much easier than they were prior to Java EE 5. However, Java EE 5 took a few pages out of Spring's book and simplified the development of enterprise components with annotation-based dependency injection, standard object/relational mapping (JPA 1.0), transactional beans (EJB 3.0), asynchronous and timer beans, and many other much improved or innovative features. Java EE 6 took things a few steps further with Context and Dependency Injection (CDI), EJB Lite, the Web Profile, and JPA 2.0. Building standards-based enterprise applications has never been easier than it is now, with Java EE 6. But it's still, really, no easier than it has been all along with Spring. The fact, though, is that you can choose Spring, Java EE, or both and likely achieve your desired goal. They are both excellent, efficient platforms for developing enterprise applications.

And although they are usually mutually exclusive, they don't necessarily have to be. But most will make a choice between the two. We chose The Spring Framework when we developed Broadleaf Commerce. Rather than join the "Holy War" regarding which platform is better, I'll simply talk about why we chose and continue to endorse Spring.

The Reasons Broadleaf uses Spring (cont).

#spring framework #webdev #web development #tech #ecommerce #broadleaf #commerce #retail #online #business #java #framework

Using the Dynamic Image Server with Broadleaf Commerce (Part 2)

In part 1, we showed you how to manipulate an image once we had uploaded it into the Broadleaf dynamic image server. This second part will cover Named Operations, which allow us to add several filters without having incredibly long URLs.

We will now go into converting those long URLs to something more manageable while still retaining the simplicity of the filters discussed in part 1.

Named Operations

To start we will setup a mix of filters that will build from our exercise in Part 1 and we'll add more effects like resize, change color and a gaussian blur. Once we put all of these filters together we end up with a very long URL.

#dynamic #image #broadleaf #ecommerce #url #webdev #web development #web #photoshop

Deploying Broadleaf Commerce 2.0 on Heroku

This post is a continuation off of the 1.6 instructions. Most of the instructions are pretty much the same. If you don't want to follow the instructions here, you can check out a ready-to-go Heroku configured application that I have on GitHub.

Let's start with getting the latest demo site Eclipse workspace (which is at M1-5 at the time of this writing). You can find this at https://github.com/BroadleafCommerce/DemoSite/downloads. This is already a little simpler than the 1.6 archetype; there are only 3 Maven modules here; core, admin and site.

Once that is downloaded, the first thing we need to do is change the database configuration. Let's first change the dialect to Postgres. In core/common-shared.properties:

--- a/core/src/main/resources/runtime-properties/common-shared.properties +++ b/core/src/main/resources/runtime-properties/common-shared.properties @@ -55,22 +55,22 @@ store.front.webapp.prefix=http://localhost:8080/ # Settings for the default persistence unit blPU.hibernate.hbm2ddl.auto=validate -blPU.hibernate.dialect=org.hibernate.dialect.HSQLDialect +blPU.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect blPU.hibernate.show_sql=false blPU.hibernate.cache.use_second_level_cache=true blPU.hibernate.cache.use_query_cache=true blPU.hibernate.hbm2ddl.import_files=null # Settings for the CMS storage persistence unit blCMSStorage.hibernate.hbm2ddl.auto=validate -blCMSStorage.hibernate.dialect=org.hibernate.dialect.hSQLDialect +blCMSStorage.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect blCMSStorage.hibernate.show_sql=false blCMSStorage.hibernate.cache.use_second_level_cache=true blCMSStorage.hibernate.cache.use_query_cache=true blCMSStorage.hibernate.hbm2ddl.import_files=null # Settings for the secure persistence unit blSecurePU.hibernate.hbm2ddl.auto=validate -blSecurePU.hibernate.dialect=org.hibernate.dialect.HSQLDialect +blSecurePU.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect blSecurePU.hibernate.show_sql=false blSecurePU.hibernate.cache.use_second_level_cache=false

Since Heroku gives environment properties for the database configuration, we cannot use the JNDI lookup and instead have to define our datasource within an aplication context. We'll do this in applicationContext-datasource.xml for both site and admin. You can just replace the applicationContext-datasource.xml with this:

<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jee="http://www.springframework.org/schema/jee" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation=" http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.1.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd">  <bean class="java.net.URI" id="dbUrl"> <constructor-arg value="${DATABASE_URL}"/> </bean> <bean id="webDS" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close"> <property name="driverClassName" value="org.postgresql.Driver" /> <property name="url" value="#{ 'jdbc:postgresql://' + @dbUrl.getHost() + @dbUrl.getPath() }" /> <property name="username" value="#{ @dbUrl.getUserInfo().split(':')[0] }" /> <property name="password" value="#{ @dbUrl.getUserInfo().split(':')[1] }" /> </bean> <bean id="webSecureDS" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close"> <property name="driverClassName" value="org.postgresql.Driver" /> <property name="url" value="#{ 'jdbc:postgresql://' + @dbUrl.getHost() + @dbUrl.getPath() }" /> <property name="username" value="#{ @dbUrl.getUserInfo().split(':')[0] }" /> <property name="password" value="#{ @dbUrl.getUserInfo().split(':')[1] }" /> </bean> <bean id="webStorageDS" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close"> <property name="driverClassName" value="org.postgresql.Driver" /> <property name="url" value="#{ 'jdbc:postgresql://' + @dbUrl.getHost() + @dbUrl.getPath() }" /> <property name="username" value="#{ @dbUrl.getUserInfo().split(':')[0] }" /> <property name="password" value="#{ @dbUrl.getUserInfo().split(':')[1] }" /> </bean> </beans>

We now need to ensure the slug size is decreased. Heroku has raised their limit to 200MB, but with everything compiled and absent of a clean, we'll still end up going into ~220MB. The maven-clean-plugin should be included in all 3 projects, but tweaked slightly for each.

site/pom.xml (exclude the cargo directory from being deleted):

<plugin> <artifactId>maven-clean-plugin</artifactId> <version>2.4.1</version> <configuration> <filesets> <fileset> <directory>target/</directory> <includes> <include>**/*</include> </includes>  <excludes> <exclude>cargo/**</exclude> </excludes> <followSymlinks>false</followSymlinks> </fileset> </filesets> <excludeDefaultDirectories>true</excludeDefaultDirectories> </configuration> <executions> <execution> <id>auto-clean</id> <phase>install</phase> <goals> <goal>clean</goal> </goals> </execution> </executions> </plugin>

admin/pom.xml (exclude admin.war from being deleted):

<plugin> <artifactId>maven-clean-plugin</artifactId> <version>2.4.1</version> <configuration> <filesets> <fileset> <directory>target/</directory> <includes> <include>**/*</include> </includes>  <excludes> <exclude>admin.war</exclude> </excludes> <followSymlinks>false</followSymlinks> </fileset> </filesets> <excludeDefaultDirectories>true</excludeDefaultDirectories> </configuration> <executions> <execution> <id>auto-clean</id> <phase>install</phase> <goals> <goal>clean</goal> </goals> </execution> </executions> </plugin>

core/pom.xml (no need to exclude anything):

<plugin> <artifactId>maven-clean-plugin</artifactId> <version>2.4.1</version> <configuration> <filesets> <fileset> <directory>target/</directory> <includes> <include>**/*</include> </includes> <followSymlinks>false</followSymlinks> </fileset> </filesets> <excludeDefaultDirectories>true</excludeDefaultDirectories> </configuration> <executions> <execution> <id>auto-clean</id> <phase>install</phase> <goals> <goal>clean</goal> </goals> </execution> </executions> </plugin>

Now, completely remove the HSQL dependency in the parent pom, and replace it with Postgres:

<dependency> <groupId>postgresql</groupId> <artifactId>postgresql</artifactId> <version>8.4-702.jdbc3</version> <type>jar</type> <scope>compile</scope> </dependency>

You will also need to reference this in both the admin and site poms:

<dependency> <groupId>postgresql</groupId> <artifactId>postgresql</artifactId> </dependency>

As I mentioned in the previous post, I had trouble getting embedded Jetty to work and so I went for a full-blown Tomcat 7 install. This also allows us to start up both the admin and site project in the same Tomcat instance. This is available through the cargo-maven2-plugin.

in site/pom.xml

<plugin> <groupId>org.codehaus.cargo</groupId> <artifactId>cargo-maven2-plugin</artifactId> <configuration> <container> <containerId>tomcat6x</containerId> <zipUrlInstaller> <url>http://archive.apache.org/dist/tomcat/tomcat-6/v6.0.18/bin/apache-tomcat-6.0.18.zip</url> </zipUrlInstaller> <dependencies> <dependency> <groupId>javax.activation</groupId> <artifactId>activation</artifactId> </dependency> <dependency> <groupId>javax.mail</groupId> <artifactId>mail</artifactId> </dependency> </dependencies> </container> <configuration> <type>standalone</type> <deployables> <deployable> <groupId>com.phillip</groupId> <artifactId>site-war</artifactId> <type>war</type> <properties> <context>ROOT</context> </properties> </deployable> </deployables> </configuration> </configuration> <executions> <execution> <phase>package</phase> <goals> <goal>install</goal> <goal>configure</goal> <goal>deploy</goal> <goal>package</goal> </goals> </execution> </executions> </plugin>

Notice that thist is actually only deploying the site application for Tomcat. We will manually copy over the admin.war in our startup.sh file referenced from the Procfile for our web dyno

One more Tomcat-specific item. Heroku assigns a random port number for your application, but Tomcat always defaults to 8080. To allow for this, I created a heroku-server.xml that the Heroku Procfile will rename to server.xml and put in the Tomcat deployment directory.

<?xml version='1.0' encoding='utf-8'?>  <Server port="-1"> <Listener className="org.apache.catalina.core.JasperListener" /> <Service name="Catalina">  <Connector port="${http.port}" protocol="HTTP/1.1" connectionTimeout="20000"/> <Engine name="Catalina" defaultHost="localhost"> <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true"/> </Engine> </Service> </Server>

Now the only thing that's left are the Heroku-specific files. The Procfile is extremely simple. All it does is kick off a custom shell script which does all the heavy lifting

Procfile:

web: sh startup-heroku.sh

The real meat comes from startup-heroku.sh:

# point to the correct configuration and webapp CATALINA_BASE=`pwd`/site/target/cargo/configurations/tomcat7x export CATALINA_BASE #move the admin application to the tomcat deploy. Commented out because not enough memory on heroku free to deploy both applications #mv ./admin/target/admin.war $CATALINA_BASE/webapps #remove the extraneous webapps that we don't need rm -rf $CATALINA_BASE/webapps/cargocpc* rm -rf $CATALINA_BASE/host-manager rm -rf $CATALINA_BASE/manager #copy over the Heroku config files cp ./site/heroku-server.xml $CATALINA_BASE/conf/server.xml #make the Tomcat scripts executable chmod a+x ./site/target/cargo/installs/apache-tomcat-7.0.29/apache-tomcat-7.0.29/bin/*.sh #set the correct port and database settings JAVA_OPTS="$JAVA_OPTS -XX:MaxPermSize=256M -Xmx256M -Dhttp.port=$PORT -DDATABASE_URL=$DATABASE_URL" export JAVA_OPTS #start Tomcat ./site/target/cargo/installs/apache-tomcat-7.0.29/apache-tomcat-7.0.29/bin/catalina.sh run

And that's it for the configuration! Now the only thing left is to start up the app!

If you haven't already, go ahead and create the Heroku cedar application which automatically adds a new git remote

~/broadleaf/heroku > heroku create --stack cedar Creating glowing-river-8401... done, stack is cedar http://glowing-river-8401.herokuapp.com/ | [email protected]:glowing-river-8401.git Git remote heroku added

Then just deploy with 'git push heroku' and you're done! To check for startup problems, you can tail the logs with heroku logs -tail which shows you the real-time logging info.

#broadleaf #broadleaf commerce #heroku #github #web development #ecommerce #database #webdev

Broadleaf Now Offers Ratings and Reviews

Broadleaf Commerce, the Enterprise Open Source eCommerce Platform, now includes support for Ratings and Reviews of products for the demo site, The Heat Clinic. This includes:

Ratings Summaries

Your customers can now view ratings and reviews for a product. On each product page, there is a new section dedicated to displaying the average star rating given to a product by the community, as well as the total number of reviews for a product. The top three reviews voted as 'most helpful' by the community are displayed on the page by default.

Creating a Review

Each customer has the ability to give a star-rating (out of five) for a product and write a review.

Authentication

In order for a customer to create a review, the customer must be registered within the system and logged in.

Coming Soon...

In the near future the Ratings and Reviews features will be enhanced with:

The ability to vote for a review as helpful/not helpful

Update your existing rating/review for a product

View all ratings/reviews for a product

Ratings and reviews documentation

Try It Out!

Ratings and Reviews are located on any product detail page. Navigate to our Heat Clinic Demo Site. Login or register to The Heat Clinic to create a review. Click on any product, such as Hoppin' Hot Sauce. The Ratings and Reviews section is located just beneath the product images. Feel free to submit one yourself!

#broadleaf #ecommerce #open source #web #development #ratings #reviews #retail #shopping #demo #tech #website development

Apache Solr Now Powering Broadleaf Search

We are proud to announce Apache Solr-backed searches as a new feature of Broadleaf Commerce 2.0! Solr is a renouned, blazing-fast search index that Broadleaf now uses to produce product search results.

As a result of being powered by Solr, Broadleaf now offers result-specific facets, multi-selectable facets, and facet counts. We've also introduced server-side pagination.

Check out some screenshots:

Using Solr couldn't be any easier -- simply start up your Broadleaf server following the Getting Started Tutorial and an embedded Solr server instance will start up alongside.

Have a large catalog and want a standalone Solr server? No problem! We support that as well since all of the calls to Solr happen through the excellent Solrj library.

Developers, learn more about the Broadleaf Solr integration

#broadleaf #ecommerce #retail #technology #developer #search #online #web #apache solr #solr

Mustache: Effective Parallel Web Development Using Logic-less Templates

I thought it would be fitting to share some of my thoughts on the process, patterns, and technologies that were used during a recent fast & agile Java e-commerce project. We were able to successfully launch a full-featured flash sales site (Llustre.com) in six weeks using agile methodologies to implement new technologies such as Broadleaf Commerce and Mustache, the logic-less template.

Just to give you some background, we worked in a development model that many companies have started to use. Over the past few years, there’s been a growing movement to completely separate UI development from the back end. With good reason: there has been a significant advancement in client-side technologies and frameworks. Demand and adoption have risen and the availability of good client-side developers is no longer a rarity. Now I myself have worked with both the front-end and server-side. Lately, I’ve been working mostly on server-side e-commerce development (Broadleaf Commerce), but have worked on the front-end quite a bit before. I know enough to be dangerous. I know enough to appreciate very clean and semantic HTML as well as clean and readable JavaScript. That being said, and being in a role as a server-side developer, I would hate to see front-end guys adding logic in my controllers. As a front-end guy, I would expect the same. It really makes sense to separate the two responsibilities. Leave the look and feel up to the business. Have the designers and front-end developers work on the HTML, CSS, and JavaScript independently of the server-side developers.

As companies start adopting the process of completely separating UI, UX, and Development, the effectiveness of server-side frameworks that generate front-end code (i.e. GWT, JSF, etc…) really come into question. Why would anyone want to mess with ugly generated code that is hard to customize, especially if the look and feel is going to be determined by the business, which it almost always will be.

But, how do you effectively achieve that? How can two teams work separately, know nothing about each others code, but still progressively move forward to a reasonable project completion? How do you effectively integrate once both sides are complete?

Continue

#broadleaf #ecommerce #llustre #mustache #java #javascript #developer #web development #web dev #html #css #technology #tech #code #coding #develoment

Ganz, Maker of WebKinz®, Relaunches its eCommerce Engine with Broadleaf Commerce and Credera to Accommodate Virtual and Physical Currencies

Ganz, the maker of Webkinz®, relaunched its online store with the help of Broadleaf Commerce, an enterprise open source ecommerce platform, and Credera, the implementation partner. The eCommerce initiative highlighted the platform's flexibility to support a complex enterprise. Broadleaf Commerce easily accommodated mixed shopping orders of virtual (i.e., eStore points) and physical currencies, and a promotions builder to discount orders that contain both physical and virtual products.

"Ganz likes that Broadleaf Commerce has a flexible framework. Broadleaf Commerce leaves you space to extend the application, and easily add and change features. That is a big advantage. Other eCommerce platforms are not as easy to extend and may require customers to use applications he or she may not want," said Roy Reshef, Software Architect, Ganz.

"Broadleaf Commerce was created with extension and flexibility in mind. Developers can easily extend services to modify business rules and extend entities to add fields that address unique business requirements," said Jeff Fischer, Chief Technology Officer, Broadleaf Commerce. "In regards to Ganz, handling virtual and physical currencies in orders introduced complexity that the Broadleaf Commerce platform was able to address."

Ganz, Broadleaf Commerce, and Credera worked together to achieve a successful outcome. Ganz provided the majority of the development team while Broadleaf Commerce and Credera provided technical leadership, strategic guidance, and additional technical resources as needed.

"I viewed Broadleaf Commerce and Credera as one team. Whenever the Ganz team had questions or needed advice, Broadleaf Commerce and Credera were very responsive and able to answer our requests quickly. Ganz could not have completed the Broadleaf Commerce implementation without the support of the Broadleaf Commerce and Credera development teams," said Paul Blamire, Director of QA and eCommerce, Ganz.

"I am very happy with the experience I had with Broadleaf Commerce and Credera. If I were to implement an eCommerce application again, I would go through this exercise with the same partners," said Reshef. "Ganz now has a simplified application compared to the complexity we had with our home grown eCommerce engine. We can better accommodate future feature changes and business needs."

#broadleaf commerce #broadleaf #credera #ganz #webkinz #games #video games #online games #online gaming #gaming #kids games #technology #tech #ecommerce #open source #opensource #enterprise #online store

Using Active Directory with Broadleaf Commerce

Broadleaf Commerce, an enterprise class, open source eCommerce framework is built on The Spring Framework. As such, Spring Security is a natural choice to provide security for Broadleaf Commerce, even when using an authentication mechanism like Active Directory. Broadleaf Commerce provides a few entities that make up the basic domain and foundation for security. These entities include:

AdminUser (representing a user of the administrative portal)

AdminRole (a named entity representing a mapping of AdminUser to multiple AdminPerssions)

AdminPermission (a named entity representing a specific Broadleaf permission)

With this configuration you can manage security quite effectively from the Broadleaf database, requiring administrators to log in and gain access to features of the administrative console depending on their roles. However, many companies wish to maintain user credentials and roles in an LDAP server. Active Directory is a very popular LDAP server for many organizations. So how can one use Active Directory to authenticate and authorize administrative users in Broadleaf Commerce?

The answer goes back to Spring Security. Spring Security provides an LDAP module. It also provides an extension to specifically deal with Active Directory. It is a simple matter of configuration to secure the application with Spring Security and Active Directory. However, we need the principal and roles that are returned from LDAP to map to Broadleaf-specific users. In order to facilitate this, Broadleaf has implemented a bean called BroadleafActiveDirectoryUserDetailsMapper and a Servlet Filter called AdminExternalLoginStateFilter.

Continue

#ecommerce #commerce #broadleaf #ldap module #open source #development #developer #spring #spring framework #security #web security

Using the Dynamic Image Server with Broadleaf Commerce - Part 1

I recently discovered a useful tool that is part of the Broadleaf Commerce application which allows you to upload a single hi-resolution image that you can then manipulate through URL parameters.

If you've worked with mobile or tablet eCommerce applications then you know how important it can be to have web or mobile optimized images. Without a dynamic image server, you'd have to upload the same image in a variety of sizes.

Broadleaf Commerce solves that issue as well as a few others by providing an easy to use image manipulation system as part of the free open source version of the product.

This is best demonstrated by example.

Setup

If you'd like to follow along, you can create a free-demo site by following the instructions on our Broadleaf Commerce demo section.

Loading the Image

The first step is to load your hi-resolution image. I'm using one called sun.gif, negotiations were long, but Jerry's Demo store will finally be able to sell a variety of suns to remedy those gloomy, cloudy days.

To upload the image, log into the your demo store's admin. Go to Content Management -> Assets. Select 'Add', choose your file, enter the required information. I will use 'sun' for Item Name and '/sun.jpg' for Full URL.

Here is what the image looks like if I access it via the image server without any manipulation.

http://demo79ga6m.broadleafcommerce.org/heatclinic/cmsstatic/sun.jpg

Through the Looking Glass...or Filters

There are two ways to work with the asset server, filters and named operations. For filters, you enter in the all the values directly into the URL. Using named operations, you have to run through a little more setup initially, but once done, it makes accessing them much cleaner. Setting up a named operation is outside the scope of this blog but at the end you will find a link to instructions on creating your own unique named operations as well as detailed information on the default filters.

Resizing the Image

The first image manipulation I'll do is to resize the image to use for displaying thumbnails then build on that for our remaining samples.

80x80 Thumbnail

Let's start out by taking our image and making a thumbnail. This will help cut down the size of the file allowing less bandwidth to be taken up. To achieve this effect we will set the height amount and width amount to 80.

http://demo79ga6m.broadleafcommerce.org/heatclinic/cmsstatic/sun.jpg?resize-width-amount=80&resize-height-amount=80&resize-high-quality=true&resize-maintain-aspect-ratio=true&resize-reduce-only=true

Other Effects

The two examples below show how you might use effects to control the colors of the image. We will create a red variation to make my sun look extra hot and a black and white variation, for those solemn winter months.

Red Sun Link

For this effect, in addition to the resizing to 80x80, we will manipulate the HSB factors, using -1 for hue, 1 for saturation and a 0.9 for brightness to make a little darker.

http://demo79ga6m.broadleafcommerce.org/heatclinic/cmsstatic/sun.jpg?resize-width-amount=80&resize-height-amount=80&resize-high-quality=true&resize-maintain-aspect-ratio=true&resize-reduce-only=true&alterhsb-hue-amount=-1&alterhsb-saturation-amount=1&alterhsb-brightness-amount=.9

Black and White Link

Getting a black and white effect can be very straight forward by changing the saturation. To get the effect above, resize to 80x80 and the HSB factors will 1 for hue, 0 for saturation and a 1 for brightness.

http://demo79ga6m.broadleafcommerce.org/heatclinic/cmsstatic/sun.jpg?resize-width-amount=80&resize-height-amount=80&resize-high-quality=true&resize-maintain-aspect-ratio=true&resize-reduce-only=true&alterhsb-hue-amount=1&alterhsb-saturation-amount=0&alterhsb-brightness-amount=1

There's still more!

The examples above are only a small sample of what you can do with the Broadleaf Commerce Dynamic Asset Server. You can also add blurs, crop images and more. For details, see the documentation.

Once we start to tap into all the available filters available the URL links provide a great way to quickly and easily manipulate the images uploaded to the asset server; but with each filter added, we add length (and complexity) to our URLs. We could craft the URLs and gingerly copy and paste them over and over, but there is a better way. We can use Named Operations.

Named operations allow us to combine a series of filters with defined values and give them a simple name. I will go into more detail on how to set these up with examples in an upcoming blog.

In the meantime you can find instructions on how to create your own named operations and how to use the asset server here:

http://docs.broadleafcommerce.org/current/Asset-Server-Configuration.html

We'd love to hear you feedback on this release and hope that this new tool helps improve your workflow!

#ecommerce #broadleaf #application #ecommerce application #image #dynamic #mobile #tablet #opensource #demo #code #coding #developer

Broadleaf Commerce Announces Release of Version 2.0 of the Enterprise Open Source eCommerce Platform

New Demo Site and Streamlined "Getting Started" Approach Help Developers Build Solutions Quickly

DALLAS, TEXAS, USA (08/02/2012) - Broadleaf Commerce, an open source eCommerce company, is pleased to announce the release of Version 2.0 of its enterprise open source eCommerce platform. The release is coupled with a new demo site named The Heat Clinic that can be used as the starting point for a Broadleaf Commerce implementation. The release includes updated documentation and a streamlined "getting started" approach that will help developers get up and running quickly, allowing them to focus on building their custom solution.

"The Broadleaf Commerce team incorporated many lessons learned over the last few years into Version 2.0. We made a number of architecture and usability improvements that include making it easier to get started and use Broadleaf Commerce," said Brian Polster, President, Broadleaf Commerce. "We encourage all customers that are just starting their project or those that are new to Broadleaf Commerce to start using version 2.0 immediately. For those well into development cycles, we are working on a detailed migration guide from 1.6.x to 2.0."

Continue

#press release #news #ecommerce #open source #enterprise #developer #retail

Consumers who use comparison shopping engine TheFind’s Facebook shopping app now get e-mails whenever products they’ve Liked on any e-commerce site go on sale. The Universal Price Alerts are part of TheFind’s Glimpse social shopping app and are sent to whichever address users have associated with their Facebook account.

#ecommerce #shopping #facebook #social media

Trending Blogs

Recently Viewed Blogs

Broadleaf Commerce | eCommerce Without Limits