You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Miguel <mi...@gmail.com> on 2010/07/16 02:56:01 UTC
jsp in WEB-INF
Hello,
I use struts 2.1.81. and I don't want that my users access directly my
.jsp, so I put them inside WEB-INF.
But the struts.xml is difficult to mantain, so I have a question:
Is there some sort of constant that defines a prefix for the JSP
inside struts.xml?
Apparently in struts1 there is something like this.
Putting the jsp directly in the app (world accessible) makes your
struts.xml look like this:
...
<package name="administracion" extends="proyectox" namespace="/admin">
<action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
<result>paisDetail.jsp</result>
</action>
...
and the JSP is: /admin/paisDetail.jsp (relative to the app root)
but if you "protect" your JSP, you need to write this:
...
<package name="administracion" extends="proyectox" namespace="/admin">
<action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
<result>/WEB-INF/admin/paisDetail.jsp</result>
</action>
...
and your JSP is : /WEB-INF/admin/paisDetail.jsp
and you lose the "auto namespace prepend" (let's say it's called that
way), and also makes the struts.xml difficult to read.
So the thing I'm asking is if there is something like this:
...
<constant name="struts.jsp_prefix" value="/WEB-INF/jsp/" />
<package name="administracion" extends="proyectox" namespace="/admin">
<action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
<result>paisDetail.jsp</result>
</action>
...
and makes struts2 search the jsp as: /WEB-INF/jsp/admin/paisDetail.jsp
Is there something like this?
Thanks
Si quieres ser más positivo, pierde un electrón
Miguel Ruiz Velasco Sobrino
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: jsp in WEB-INF
Posted by Miguel <mi...@gmail.com>.
On Fri, Jul 16, 2010 at 03:24, Johannes Geppert <jo...@web.de> wrote:
>
> together with convention plugin ther exists this constant
>
> <constant name="struts.convention.result.path" value="/WEB-INF/jasp"/>
>
> this works fine for me, bit I don't know a solution without convention
> plugin.
>
> Best Regards
>
> Johannes Geppert
This solution sounds very interesting, and it's exactly what I'm
seeking, but I don't use convention.
Does anyone knows if this can be done with plain struts2?
Maybe it would be an interesting addition, and with some luck not so difficult.
Regarding the access rules in web.xml, there are lot's of directories,
and some are assembled dynamically at build time from sub-projects, so
I think it's somewhat difficult that way as it needs a lot of manual
bookkeeping.
Thanks for the help from everyone.
Si quieres ser más positivo, pierde un electrón
Miguel Ruiz Velasco Sobrino
> Miguel-55 wrote:
>>
>> Hello,
>>
>> I use struts 2.1.81. and I don't want that my users access directly my
>> .jsp, so I put them inside WEB-INF.
>> But the struts.xml is difficult to mantain, so I have a question:
>> Is there some sort of constant that defines a prefix for the JSP
>> inside struts.xml?
>> Apparently in struts1 there is something like this.
>>
>> Putting the jsp directly in the app (world accessible) makes your
>> struts.xml look like this:
>> ...
>> <package name="administracion" extends="proyectox" namespace="/admin">
>> <action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
>> <result>paisDetail.jsp</result>
>> </action>
>> ...
>> and the JSP is: /admin/paisDetail.jsp (relative to the app root)
>>
>> but if you "protect" your JSP, you need to write this:
>> ...
>> <package name="administracion" extends="proyectox" namespace="/admin">
>> <action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
>> <result>/WEB-INF/admin/paisDetail.jsp</result>
>> </action>
>> ...
>> and your JSP is : /WEB-INF/admin/paisDetail.jsp
>> and you lose the "auto namespace prepend" (let's say it's called that
>> way), and also makes the struts.xml difficult to read.
>>
>> So the thing I'm asking is if there is something like this:
>> ...
>> <constant name="struts.jsp_prefix" value="/WEB-INF/jsp/" />
>> <package name="administracion" extends="proyectox" namespace="/admin">
>> <action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
>> <result>paisDetail.jsp</result>
>> </action>
>> ...
>> and makes struts2 search the jsp as: /WEB-INF/jsp/admin/paisDetail.jsp
>>
>> Is there something like this?
>> Thanks
>>
>> Si quieres ser más positivo, pierde un electrón
>> Miguel Ruiz Velasco Sobrino
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> For additional commands, e-mail: user-help@struts.apache.org
>>
>>
>>
>
>
> -----
> ---
> web: http://www.jgeppert.com
> twitter: http://twitter.com/jogep
>
> --
> View this message in context: http://old.nabble.com/jsp-in-WEB-INF-tp29179165p29181264.html
> Sent from the Struts - User mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: jsp in WEB-INF
Posted by Johannes Geppert <jo...@web.de>.
togehter with convention plugin ther exists this constant
<constant name="struts.convention.result.path" value="/WEB-INF/jasp"/>
this works fine for me, bit I don't know a solution without convention
plugin.
Best Regards
Johannes Geppert
Miguel-55 wrote:
>
> Hello,
>
> I use struts 2.1.81. and I don't want that my users access directly my
> .jsp, so I put them inside WEB-INF.
> But the struts.xml is difficult to mantain, so I have a question:
> Is there some sort of constant that defines a prefix for the JSP
> inside struts.xml?
> Apparently in struts1 there is something like this.
>
> Putting the jsp directly in the app (world accessible) makes your
> struts.xml look like this:
> ...
> <package name="administracion" extends="proyectox" namespace="/admin">
> <action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
> <result>paisDetail.jsp</result>
> </action>
> ...
> and the JSP is: /admin/paisDetail.jsp (relative to the app root)
>
> but if you "protect" your JSP, you need to write this:
> ...
> <package name="administracion" extends="proyectox" namespace="/admin">
> <action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
> <result>/WEB-INF/admin/paisDetail.jsp</result>
> </action>
> ...
> and your JSP is : /WEB-INF/admin/paisDetail.jsp
> and you lose the "auto namespace prepend" (let's say it's called that
> way), and also makes the struts.xml difficult to read.
>
> So the thing I'm asking is if there is something like this:
> ...
> <constant name="struts.jsp_prefix" value="/WEB-INF/jsp/" />
> <package name="administracion" extends="proyectox" namespace="/admin">
> <action name="pais_*" method="{1}" class="com.proyectox.ui.PaisAction">
> <result>paisDetail.jsp</result>
> </action>
> ...
> and makes struts2 search the jsp as: /WEB-INF/jsp/admin/paisDetail.jsp
>
> Is there something like this?
> Thanks
>
> Si quieres ser más positivo, pierde un electrón
> Miguel Ruiz Velasco Sobrino
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
-----
---
web: http://www.jgeppert.com
twitter: http://twitter.com/jogep
--
View this message in context: http://old.nabble.com/jsp-in-WEB-INF-tp29179165p29181264.html
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: jsp in WEB-INF
Posted by Greg Lindholm <gr...@gmail.com>.
Add the following to your web.xml file and change the url-pattern's to
catch any jsp files you do not want the user to have direct access to.
<security-constraint>
<display-name>Prevent access to raw pages.</display-name>
<web-resource-collection>
<web-resource-name>Raw Pages</web-resource-name>
<url-pattern>/error.jsp</url-pattern>
<url-pattern>/struts/*</url-pattern>
<url-pattern>/META-INF/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>No roles, so no direct access</description>
</auth-constraint>
</security-constraint>
On Fri, Jul 16, 2010 at 7:57 AM, J_e_f_f <ja...@gmail.com> wrote:
>
>
>
> Miguel-55 wrote:
>>
>> I use struts 2.1.81. and I don't want that my users access directly my
>> .jsp, so I put them inside WEB-INF.
>>
>
> You don't *have* to put your JSPs in WEB-INF to protect them from direct
> access. You can put them in folders under the web root named according to
> your package namespace and then add a security constraint to protect those
> folders in your web.xml.
>
> Regards,
> Jeff
>
> --
> View this message in context: http://old.nabble.com/jsp-in-WEB-INF-tp29179165p29182852.html
> Sent from the Struts - User mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: jsp in WEB-INF
Posted by J_e_f_f <ja...@gmail.com>.
Miguel-55 wrote:
>
> I use struts 2.1.81. and I don't want that my users access directly my
> .jsp, so I put them inside WEB-INF.
>
You don't *have* to put your JSPs in WEB-INF to protect them from direct
access. You can put them in folders under the web root named according to
your package namespace and then add a security constraint to protect those
folders in your web.xml.
Regards,
Jeff
--
View this message in context: http://old.nabble.com/jsp-in-WEB-INF-tp29179165p29182852.html
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org