Completing the Stack - Stripes...and Java Web Development is Fun Again - page 247

Stripersist and Security
Stripersist is very powerful but also very dangerous if you're not
careful. Users should not be allowed to arbitrarily send values to
the properties of objects that are connected to the JPA Entity-
Manager , because a call to commit ( ) saves all modifications to
associated objects.
Fortunately, you can avoid trouble by restricting which proper-
ties are allowed to be bound, as we'll discuss in Section 14.1 ,
Controlling Parameter Binding, on page 307 .
The StripersistInit Interface
Stripersist provides one more feature: the StripersistInit interface, which
is handy when you want to use Stripersist for code that needs to run at
application startup. By implementing that interface and the init ( ) and
by placing your class in an extension package, your code will automati-
cally be executed after Stripersist has finished loading. We'll talk about
StripersistInit in more detail when we use it in Section 14.6 , Using Roles,
on page 321 .
“But I Want to Use Native Hibernate/OpenJPA/JPOX/Etc.!”
Although working with JPA means your code is independent of the
underlying implementation, you might be ready to concede that gener-
icity in exchange for using the extras that your implementation provides
beyond JPA.
For example, Hibernate has a query-by-criteria API that can sometimes
be nicer to work with than constructing String queries. To use criteria,
you need to obtain a Hibernate Session . The JPA's EntityManager inter-
face provides the getDelegate ( ) method specifically for that purpose: to
obtain the underlying implementation. In the BaseDaoImpl class, you can
add a method to obtain the Hibernate Session :
Download email_24/src/stripesbook/dao/impl/stripersist/BaseDaoImpl.java
protected Session getSession() {
return (Session) Stripersist.getEntityManager().getDelegate();
}