You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Manuel Correa <mc...@itos.uga.edu> on 2007/10/29 16:38:47 UTC
S2: EL in tags 2.0.11
In S2.09 is possible to use EL in the properties tags. For example:
<s:property value="${pageContext.request.contextPath}" />
That because the parameter in tld is rtexprvalue="true"
In S2.0.11 this is not possible (rtexprvalue="false"). I want to know
is some property that active and un-active this parameter in the TLD. Or
what is the best way to use EL in tags.
Thanks,
Manuel
Re: [struts] S2: EL in tags 2.0.11
Posted by Dale Newfield <Da...@Newfield.org>.
Just in case these "this didn't work" messages were copy-pasted, I'll
point out the typos:
Chris Pratt wrote:
> On 10/30/07, Manuel Correa <mc...@itos.uga.edu> wrote:
>> Didn't work: <s:property value="%{#request['javax.servlet.forward.context_path']"/>
<s:property value="%{#request['javax.servlet.forward.context_path']}"/>
> <c:set var="contextPath" value="${pageContext.request.contextPath"}"
> scope="request"/>
<c:set var="contextPath" value="${pageContext.request.contextPath}"
scope="request"/>
-Dale
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by Chris Pratt <th...@gmail.com>.
On 10/30/07, Manuel Correa <mc...@itos.uga.edu> wrote:
> That is not possible, because in Struts 2.0.11 you can't use EL in any
> Struts tag, including <s:set ...
>
That's why I recommended using the JSTL <c:set> instead.
(*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: S2: EL in tags 2.0.11
Posted by Manuel Correa <mc...@itos.uga.edu>.
That is not possible, because in Struts 2.0.11 you can't use EL in any
Struts tag, including <s:set ...
Manuel Correa.
-----Original Message-----
From: Chris Pratt [mailto:thechrispratt@gmail.com]
Sent: Tuesday, October 30, 2007 12:11 PM
To: Struts Users Mailing List
Subject: Re: S2: EL in tags 2.0.11
On 10/30/07, Manuel Correa <mc...@itos.uga.edu> wrote:
> Didn't work: <s:property
value="%{#request['javax.servlet.forward.context_path']"/>
>
> I think that the best solution is rewrite the tld. Is painful.
>
> Manuel Correa.
>
If you're looking for the simplest solution, you should be able to
define a request scoped variable at the top of the page using JSTL:
<c:set var="contextPath" value="${pageContext.request.contextPath"}"
scope="request"/>
And then whenever you need the value using OGNL, you can use:
%{#request['contextPath']}
(possibly surrounding it with <s:property> if necessary)
I agree, it's definitely much harder to understand at a glance, but
until the tag library is truly fixed, this is probably the "easiest"
solution.
(*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by Chris Pratt <th...@gmail.com>.
On 10/30/07, Manuel Correa <mc...@itos.uga.edu> wrote:
> Didn't work: <s:property value="%{#request['javax.servlet.forward.context_path']"/>
>
> I think that the best solution is rewrite the tld. Is painful.
>
> Manuel Correa.
>
If you're looking for the simplest solution, you should be able to
define a request scoped variable at the top of the page using JSTL:
<c:set var="contextPath" value="${pageContext.request.contextPath"}"
scope="request"/>
And then whenever you need the value using OGNL, you can use:
%{#request['contextPath']}
(possibly surrounding it with <s:property> if necessary)
I agree, it's definitely much harder to understand at a glance, but
until the tag library is truly fixed, this is probably the "easiest"
solution.
(*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by Ted Husted <hu...@apache.org>.
That's great, Chris!
I opened a ticket to track the feature. Let us know when you have
something to show!
* https://issues.apache.org/struts/browse/WW-2284
-Ted.
On Oct 31, 2007 11:01 AM, Chris Pratt <th...@gmail.com> wrote:
> On 10/30/07, Ted Husted <hu...@apache.org> wrote:
> > A better long-term solution might be to create a standard JSP 2.0
> > taglib for Struts 2 that follows the same external API as the Struts 1
> > EL tags, and didn't use OGNL at all.
> >
> > * http://struts.apache.org/1.3.8/struts-el/index.html
> >
> > This would mean doing without templates, but I think many people are
> > reverting to the simple theme anyway.
> >
> > I'd really love to do this myself, but I don't know how to fit it in
> > with everything else.
> >
>
> I'm actually working on something similar to this. It allows either
> OGNL or JSP EL in each tag, but not both, which should alleviate the
> security hole. It's about 1/2 done at this point. And yes, it does
> not support templates, which are my least favorite Struts 2 feature
> because they can't be turned off.
> (*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by Chris Pratt <th...@gmail.com>.
On 10/30/07, Ted Husted <hu...@apache.org> wrote:
> A better long-term solution might be to create a standard JSP 2.0
> taglib for Struts 2 that follows the same external API as the Struts 1
> EL tags, and didn't use OGNL at all.
>
> * http://struts.apache.org/1.3.8/struts-el/index.html
>
> This would mean doing without templates, but I think many people are
> reverting to the simple theme anyway.
>
> I'd really love to do this myself, but I don't know how to fit it in
> with everything else.
>
I'm actually working on something similar to this. It allows either
OGNL or JSP EL in each tag, but not both, which should alleviate the
security hole. It's about 1/2 done at this point. And yes, it does
not support templates, which are my least favorite Struts 2 feature
because they can't be turned off.
(*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by Ted Husted <hu...@apache.org>.
A better long-term solution might be to create a standard JSP 2.0
taglib for Struts 2 that follows the same external API as the Struts 1
EL tags, and didn't use OGNL at all.
* http://struts.apache.org/1.3.8/struts-el/index.html
This would mean doing without templates, but I think many people are
reverting to the simple theme anyway.
I'd really love to do this myself, but I don't know how to fit it in
with everything else.
-Ted.
On Oct 30, 2007 7:25 AM, Manuel Correa <mc...@itos.uga.edu> wrote:
> Didn't work: <s:property value="%{#request['javax.servlet.forward.context_path']"/>
>
> I think that the best solution is rewrite the tld. Is painful.
>
> Manuel Correa.
>
> -----Original Message-----
> From: Desbois Arnaud [mailto:Arnaud.Desbois@thomson.net]
> Sent: Tuesday, October 30, 2007 3:55 AM
> To: Struts Users Mailing List
>
> Subject: RE: S2: EL in tags 2.0.11
>
> Try this: %{#request['javax.servlet.forward.context_path']
>
> Arnaud
>
> -----Message d'origine-----
> De: cilquirm [mailto:aadi.deshpande@gmail.com]
> Envoyé: lundi 29 octobre 2007 17:51
> À: user@struts.apache.org
> Objet: Re: S2: EL in tags 2.0.11
>
>
>
> I believe this was a security fix, as there was an issue where ognl
> expressions could be used to do something drastic to the application server
> ( like System.exit ).
>
> I believe the expectation is that you can get around it by creating your own
> customized tld or something like :
>
> <c:set var="contextRoot" value="${pageContext.request.contextPath}"
> scope="request"/>
> <s:property value="\%{ #request.contextRoot }"/>
>
> hth,
> -a
>
>
>
> Manuel Correa wrote:
> >
> > In S2.09 is possible to use EL in the properties tags. For example:
> >
> >
> >
> > <s:property value="${pageContext.request.contextPath}" />
> >
> >
> >
> > That because the parameter in tld is rtexprvalue="true"
> >
> >
> >
> > In S2.0.11 this is not possible (rtexprvalue="false"). I want to know
> > is some property that active and un-active this parameter in the TLD. Or
> > what is the best way to use EL in tags.
> >
> >
> >
> > Thanks,
> >
> >
> >
> > Manuel
> >
> >
> >
>
> --
> View this message in context: http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13471024
> Sent from the Struts - User mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
--
HTH, Ted <http://www.husted.com/ted/blog/>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: S2: EL in tags 2.0.11
Posted by Manuel Correa <mc...@itos.uga.edu>.
Didn't work: <s:property value="%{#request['javax.servlet.forward.context_path']"/>
I think that the best solution is rewrite the tld. Is painful.
Manuel Correa.
-----Original Message-----
From: Desbois Arnaud [mailto:Arnaud.Desbois@thomson.net]
Sent: Tuesday, October 30, 2007 3:55 AM
To: Struts Users Mailing List
Subject: RE: S2: EL in tags 2.0.11
Try this: %{#request['javax.servlet.forward.context_path']
Arnaud
-----Message d'origine-----
De : cilquirm [mailto:aadi.deshpande@gmail.com]
Envoyé : lundi 29 octobre 2007 17:51
À : user@struts.apache.org
Objet : Re: S2: EL in tags 2.0.11
I believe this was a security fix, as there was an issue where ognl
expressions could be used to do something drastic to the application server
( like System.exit ).
I believe the expectation is that you can get around it by creating your own
customized tld or something like :
<c:set var="contextRoot" value="${pageContext.request.contextPath}"
scope="request"/>
<s:property value="\%{ #request.contextRoot }"/>
hth,
-a
Manuel Correa wrote:
>
> In S2.09 is possible to use EL in the properties tags. For example:
>
>
>
> <s:property value="${pageContext.request.contextPath}" />
>
>
>
> That because the parameter in tld is rtexprvalue="true"
>
>
>
> In S2.0.11 this is not possible (rtexprvalue="false"). I want to know
> is some property that active and un-active this parameter in the TLD. Or
> what is the best way to use EL in tags.
>
>
>
> Thanks,
>
>
>
> Manuel
>
>
>
--
View this message in context: http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13471024
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: S2: EL in tags 2.0.11
Posted by Desbois Arnaud <Ar...@thomson.net>.
Try this: %{#request['javax.servlet.forward.context_path']
Arnaud
-----Message d'origine-----
De : cilquirm [mailto:aadi.deshpande@gmail.com]
Envoyé : lundi 29 octobre 2007 17:51
À : user@struts.apache.org
Objet : Re: S2: EL in tags 2.0.11
I believe this was a security fix, as there was an issue where ognl
expressions could be used to do something drastic to the application server
( like System.exit ).
I believe the expectation is that you can get around it by creating your own
customized tld or something like :
<c:set var="contextRoot" value="${pageContext.request.contextPath}"
scope="request"/>
<s:property value="\%{ #request.contextRoot }"/>
hth,
-a
Manuel Correa wrote:
>
> In S2.09 is possible to use EL in the properties tags. For example:
>
>
>
> <s:property value="${pageContext.request.contextPath}" />
>
>
>
> That because the parameter in tld is rtexprvalue="true"
>
>
>
> In S2.0.11 this is not possible (rtexprvalue="false"). I want to know
> is some property that active and un-active this parameter in the TLD. Or
> what is the best way to use EL in tags.
>
>
>
> Thanks,
>
>
>
> Manuel
>
>
>
--
View this message in context: http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13471024
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by Chris Pratt <th...@gmail.com>.
On 10/29/07, Manuel Correa <mc...@itos.uga.edu> wrote:
> So, I have to write a custom library for each method that I want access
> for the request??
>
> Manuel Correa.
>
No, you wouldn't have to write any tags, just change the rtexprvalue
attributes in the tld file for the tags you want to use JSP EL with.
With a 2.4 or greater server, if the rtexprvalue=true, the JSP EL gets
processed first, then passed into the tag library as already processed
text, so the Struts tags then apply any OGNL left over and the value
is written out in the HTML.
To prevent this as an avenue for hackers to attack the system, the
struts developers set all the rtexprvalue's to false, which means the
JSP EL processor sends the unprocessed text to the taglib, since the
Struts taglib only handles OGNL (and ignores JSP EL) the unprocessed
EL ends up in the HTML, which isn't what you want.
So, by just changing the rtexprvalue's on the tags you want (and being
careful what you're using the JSP EL for) you can restore the old
functionality on a tag by tag basis.
(*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: S2: EL in tags 2.0.11
Posted by Manuel Correa <mc...@itos.uga.edu>.
So, I have to write a custom library for each method that I want access
for the request??
Manuel Correa.
-----Original Message-----
From: cilquirm [mailto:aadi.deshpande@gmail.com]
Sent: Monday, October 29, 2007 12:51 PM
To: user@struts.apache.org
Subject: Re: S2: EL in tags 2.0.11
I believe this was a security fix, as there was an issue where ognl
expressions could be used to do something drastic to the application
server
( like System.exit ).
I believe the expectation is that you can get around it by creating your
own
customized tld or something like :
<c:set var="contextRoot" value="${pageContext.request.contextPath}"
scope="request"/>
<s:property value="\%{ #request.contextRoot }"/>
hth,
-a
Manuel Correa wrote:
>
> In S2.09 is possible to use EL in the properties tags. For example:
>
>
>
> <s:property value="${pageContext.request.contextPath}" />
>
>
>
> That because the parameter in tld is rtexprvalue="true"
>
>
>
> In S2.0.11 this is not possible (rtexprvalue="false"). I want to
know
> is some property that active and un-active this parameter in the TLD.
Or
> what is the best way to use EL in tags.
>
>
>
> Thanks,
>
>
>
> Manuel
>
>
>
--
View this message in context:
http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13471024
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by cilquirm <aa...@gmail.com>.
I believe this was a security fix, as there was an issue where ognl
expressions could be used to do something drastic to the application server
( like System.exit ).
I believe the expectation is that you can get around it by creating your own
customized tld or something like :
<c:set var="contextRoot" value="${pageContext.request.contextPath}"
scope="request"/>
<s:property value="\%{ #request.contextRoot }"/>
hth,
-a
Manuel Correa wrote:
>
> In S2.09 is possible to use EL in the properties tags. For example:
>
>
>
> <s:property value="${pageContext.request.contextPath}" />
>
>
>
> That because the parameter in tld is rtexprvalue="true"
>
>
>
> In S2.0.11 this is not possible (rtexprvalue="false"). I want to know
> is some property that active and un-active this parameter in the TLD. Or
> what is the best way to use EL in tags.
>
>
>
> Thanks,
>
>
>
> Manuel
>
>
>
--
View this message in context: http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13471024
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: [struts] S2: EL in tags 2.0.11
Posted by cilquirm <aa...@gmail.com>.
My apologies if it was misinterpreted. I did not say it WOULD work, I said
it would take some effort to get it to work, but that it does not work.
At this point, I believe you have a number of options :
1) You can use the method i showed you :
<c:set var="req" value="${pageContext.request}"/>
<s:property value="\%{ attr['req'].contextPath }"/>
<s:property value="\%{ attr['req'].pathInfo }"/>
2) You can build your own custom copy of struts2 that has the tld with the
rtexpr value enabled, but be advised that you are reenabling a security
risk.
3) you can not use s2 tags, if you're that reliant on the jstl/el expression
language.
-a
Manuel Correa wrote:
>
> page <s:property value="%{#request.request.contextPath}"/>
>
> Didn't work!
>
> Have to be a way to active the EL in the Attributes..
>
>
> Manuel Correa.
>
> -----Original Message-----
> From: cilquirm [mailto:aadi.deshpande@gmail.com]
> Sent: Monday, October 29, 2007 3:17 PM
> To: user@struts.apache.org
> Subject: Re: [struts] S2: EL in tags 2.0.11
>
>
>
> I could be wrong ( and I hope I am ), but I thought the request object
> in
> that case was just a map facade to the underlying request attributes
> map.
>
> Which is why I supposed you say #request['foo'] vs.
> #request.getAttribute('foo').
>
> Same goes for session. ( #session['foo'] vs
> #session.getAttribute('foo') )
>
> I just checked Dispatcher and it seems that #request and #session are
> instances of RequestMap and SessionMap respectively, in which a Map
> wraps
> the access to getAttribute.
>
> If these were extended to have a getRequest/getSession method, then we
> might
> be able to say
>
> #request.request.contextPath.
>
>
>
>
>
> DNewfield wrote:
>>
>> cilquirm wrote:
>>> you could do this
>>>
>>> <c:set var="req" value="${pageContext.request}"/>
>>>
>>> <s:property value="\%{ attr['req'].contextPath }"/>
>>>
>>> <s:property value="\%{ attr['req'].pathInfo }"/>
>>
>> Isn't the request on the valuestack?
>> <s:property value="%{#request.contextPath}"/> should be all you
> need...
>>
>> http://wiki.opensymphony.com/display/OGNL/OGNL+Basics
>>
>> -Dale
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> For additional commands, e-mail: user-help@struts.apache.org
>>
>>
>>
>
> --
> View this message in context:
> http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13474669
> Sent from the Struts - User mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
--
View this message in context: http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13476195
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: [struts] S2: EL in tags 2.0.11
Posted by Manuel Correa <mc...@itos.uga.edu>.
page <s:property value="%{#request.request.contextPath}"/>
Didn't work!
Have to be a way to active the EL in the Attributes..
Manuel Correa.
-----Original Message-----
From: cilquirm [mailto:aadi.deshpande@gmail.com]
Sent: Monday, October 29, 2007 3:17 PM
To: user@struts.apache.org
Subject: Re: [struts] S2: EL in tags 2.0.11
I could be wrong ( and I hope I am ), but I thought the request object
in
that case was just a map facade to the underlying request attributes
map.
Which is why I supposed you say #request['foo'] vs.
#request.getAttribute('foo').
Same goes for session. ( #session['foo'] vs
#session.getAttribute('foo') )
I just checked Dispatcher and it seems that #request and #session are
instances of RequestMap and SessionMap respectively, in which a Map
wraps
the access to getAttribute.
If these were extended to have a getRequest/getSession method, then we
might
be able to say
#request.request.contextPath.
DNewfield wrote:
>
> cilquirm wrote:
>> you could do this
>>
>> <c:set var="req" value="${pageContext.request}"/>
>>
>> <s:property value="\%{ attr['req'].contextPath }"/>
>>
>> <s:property value="\%{ attr['req'].pathInfo }"/>
>
> Isn't the request on the valuestack?
> <s:property value="%{#request.contextPath}"/> should be all you
need...
>
> http://wiki.opensymphony.com/display/OGNL/OGNL+Basics
>
> -Dale
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
--
View this message in context:
http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13474669
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: [struts] S2: EL in tags 2.0.11
Posted by cilquirm <aa...@gmail.com>.
I could be wrong ( and I hope I am ), but I thought the request object in
that case was just a map facade to the underlying request attributes map.
Which is why I supposed you say #request['foo'] vs.
#request.getAttribute('foo').
Same goes for session. ( #session['foo'] vs #session.getAttribute('foo') )
I just checked Dispatcher and it seems that #request and #session are
instances of RequestMap and SessionMap respectively, in which a Map wraps
the access to getAttribute.
If these were extended to have a getRequest/getSession method, then we might
be able to say
#request.request.contextPath.
DNewfield wrote:
>
> cilquirm wrote:
>> you could do this
>>
>> <c:set var="req" value="${pageContext.request}"/>
>>
>> <s:property value="\%{ attr['req'].contextPath }"/>
>>
>> <s:property value="\%{ attr['req'].pathInfo }"/>
>
> Isn't the request on the valuestack?
> <s:property value="%{#request.contextPath}"/> should be all you need...
>
> http://wiki.opensymphony.com/display/OGNL/OGNL+Basics
>
> -Dale
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
--
View this message in context: http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13474669
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: [struts] S2: EL in tags 2.0.11
Posted by Dale Newfield <Da...@Newfield.org>.
cilquirm wrote:
> you could do this
>
> <c:set var="req" value="${pageContext.request}"/>
>
> <s:property value="\%{ attr['req'].contextPath }"/>
>
> <s:property value="\%{ attr['req'].pathInfo }"/>
Isn't the request on the valuestack?
<s:property value="%{#request.contextPath}"/> should be all you need...
http://wiki.opensymphony.com/display/OGNL/OGNL+Basics
-Dale
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: S2: EL in tags 2.0.11
Posted by cilquirm <aa...@gmail.com>.
you could do this
<c:set var="req" value="${pageContext.request}"/>
<s:property value="\%{ attr['req'].contextPath }"/>
<s:property value="\%{ attr['req'].pathInfo }"/>
Basically, stuff the object into the pageContext somehow and then reference
it again via ognl.
It's a pain, but a very slight one.
-a
Manuel Correa wrote:
>
> How I get the contextPath with OGNL?? Or the other request methods?
>
> Manuel Correa.
>
> -----Original Message-----
> From: Chris Pratt [mailto:thechrispratt@gmail.com]
> Sent: Monday, October 29, 2007 12:17 PM
> To: Struts Users Mailing List
> Subject: Re: S2: EL in tags 2.0.11
>
> On 10/29/07, Manuel Correa <mc...@itos.uga.edu> wrote:
>> In S2.09 is possible to use EL in the properties tags. For example:
>>
>> <s:property value="${pageContext.request.contextPath}" />
>>
>> That because the parameter in tld is rtexprvalue="true"
>>
>> In S2.0.11 this is not possible (rtexprvalue="false"). I want to
> know
>> is some property that active and un-active this parameter in the TLD.
> Or
>> what is the best way to use EL in tags.
>>
>
> I believe that was done as a security precaution. Since each EL is
> processed one after the other, it made it possible for some malicious
> user of your system (with enough knowledge of the internals of your
> system) to enter a value that the JSP EL would translate into naughty
> OGNL that your system would happily translate, giving away all your
> secrets.
>
> What I've done in my tag library (that isn't quite finished yet) is to
> set all the rtexprvalue's to false, but then check the value for
> either the ${ } or %{ } EL variables and process the value through one
> or the other, but never both, EL processors. It seems to be working
> nicely, is very flexible and shouldn't have the same vulnerabilities
> of the previous struts 2 tags.
> (*Chris*)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
--
View this message in context: http://www.nabble.com/S2%3A-EL-in-tags-2.0.11-tf4712519.html#a13474135
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: S2: EL in tags 2.0.11
Posted by Manuel Correa <mc...@itos.uga.edu>.
How I get the contextPath with OGNL?? Or the other request methods?
Manuel Correa.
-----Original Message-----
From: Chris Pratt [mailto:thechrispratt@gmail.com]
Sent: Monday, October 29, 2007 12:17 PM
To: Struts Users Mailing List
Subject: Re: S2: EL in tags 2.0.11
On 10/29/07, Manuel Correa <mc...@itos.uga.edu> wrote:
> In S2.09 is possible to use EL in the properties tags. For example:
>
> <s:property value="${pageContext.request.contextPath}" />
>
> That because the parameter in tld is rtexprvalue="true"
>
> In S2.0.11 this is not possible (rtexprvalue="false"). I want to
know
> is some property that active and un-active this parameter in the TLD.
Or
> what is the best way to use EL in tags.
>
I believe that was done as a security precaution. Since each EL is
processed one after the other, it made it possible for some malicious
user of your system (with enough knowledge of the internals of your
system) to enter a value that the JSP EL would translate into naughty
OGNL that your system would happily translate, giving away all your
secrets.
What I've done in my tag library (that isn't quite finished yet) is to
set all the rtexprvalue's to false, but then check the value for
either the ${ } or %{ } EL variables and process the value through one
or the other, but never both, EL processors. It seems to be working
nicely, is very flexible and shouldn't have the same vulnerabilities
of the previous struts 2 tags.
(*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: S2: EL in tags 2.0.11
Posted by Chris Pratt <th...@gmail.com>.
On 10/29/07, Manuel Correa <mc...@itos.uga.edu> wrote:
> In S2.09 is possible to use EL in the properties tags. For example:
>
> <s:property value="${pageContext.request.contextPath}" />
>
> That because the parameter in tld is rtexprvalue="true"
>
> In S2.0.11 this is not possible (rtexprvalue="false"). I want to know
> is some property that active and un-active this parameter in the TLD. Or
> what is the best way to use EL in tags.
>
I believe that was done as a security precaution. Since each EL is
processed one after the other, it made it possible for some malicious
user of your system (with enough knowledge of the internals of your
system) to enter a value that the JSP EL would translate into naughty
OGNL that your system would happily translate, giving away all your
secrets.
What I've done in my tag library (that isn't quite finished yet) is to
set all the rtexprvalue's to false, but then check the value for
either the ${ } or %{ } EL variables and process the value through one
or the other, but never both, EL processors. It seems to be working
nicely, is very flexible and shouldn't have the same vulnerabilities
of the previous struts 2 tags.
(*Chris*)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org