[jira] [Commented] (TOBAGO-1576) Commands with unauthorized method-bindings (e.g. @RolesAllowed) should by default not be rendered

["Hudson (JIRA)" <de...@myfaces.apache.org>]

    [ https://issues.apache.org/jira/browse/TOBAGO-1576?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15676810#comment-15676810 ] 

Hudson commented on TOBAGO-1576:
--------------------------------

SUCCESS: Integrated in Jenkins build Tobago 3.0.x #612 (See [https://builds.apache.org/job/Tobago%203.0.x/612/])
TOBAGO-1576: Commands with unauthorized method-bindins should by default not be rendered
[developed with hnoeth] (lofwyr: [http://svn.apache.org/viewvc/?view=rev&rev=1770382])
* (edit) tobago-3.0.x/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/component/AbstractUICommandBase.java
* (edit) tobago-3.0.x/tobago-example/tobago-example-demo/src/main/webapp/script/demo.js


> Commands with unauthorized method-bindings (e.g. @RolesAllowed) should by default not be rendered
> -------------------------------------------------------------------------------------------------
>
>                 Key: TOBAGO-1576
>                 URL: https://issues.apache.org/jira/browse/TOBAGO-1576
>             Project: MyFaces Tobago
>          Issue Type: Improvement
>          Components: Core
>            Reporter: Matthias Wronka
>            Assignee: Udo Schnurpfeil
>             Fix For: 3.0.0-alpha-8, 3.0.0
>
>
> Tobago inspects the @RolesAllowed-Annotations of method-bindings, which is a great feature!
> But I think the default-behaviour is not intuitive, as methods, that cannot be executed by the current user because of missing roles are only disabled. They should be not rendered!
> Why? If an action has to be secured it is related to some kind of functionality a user might not only be not allowed to execute but not even to see that it is there (thus forcing the programmers not to rely on this feature but implement the rendered-attribute themselves). Furthermore the user might ask hisself / herself what to do to execute this method (which of course is never possible because of the missing role-assignment he/she cannot control). This is not intuitive.
> If an an command is rendered disabled it should be a matter of state. E.g. some date cannot be validated right now, because it has not been saved yet, but in a second it will be. These are commands a user is authorized to execute but something else must be done before.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)