You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@struts.apache.org by Lukasz Lenart <lu...@apache.org> on 2013/10/03 17:21:30 UTC
Strict DMI
Hi,
I'm working on extending Strict DMI mode to be enabled by default -
basically you won't be able to disable it. Thus means you will have to
define "allowedActions" and "allowedMethods" globally or per action.
There be no defaults (as for now) so if you don't define
"allowedActions"/"allowedMethods" calls like these: "myAction!show",
"method:index", "action:ListUser" won't work. I'm planning to add two
types of logic: coma separated strings and regex (so you can add "*"
but then it will be your problem ;-)
To give you a brief example:
<package name="default" extends="struts-default"
strict-dmi-mode="strings|regex">
<global-allowed-actions>Search,Index</global-allowed-actions>
<global-allowed-methods>index,form,input</global-allowed-methods>
<action name="HelloWorld" class="example.HelloWorld">
<param name="allowedActions">ListUser,EditUser</param>
<param name="allowedMethods">index, edit, submit, form</param>
<result>/example/HelloWorld.jsp</result>
</action>
</package>
@Action(value ="HelloWorld", allowedActions="ListUser,EditUser",
allowedMethods="index, edit, submit, form")
I have one doubt about global configs with annotations - should I add
it to @Namespace/@ParentPackage? Or base on xml config? Or maybe
define new annotation - @Package or @StrictDMI?
Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: Strict DMI
Posted by Paul Benedict <pb...@apache.org>.
If @Action is to be allowed at the method level, do its annotation's
attributes still make sense? I am not asking rhetorically. If not, it is
better to create a new annotation.
On Thu, Oct 10, 2013 at 9:21 AM, Ken McWilliams <ke...@gmail.com>wrote:
> I didn't mean to say that "action:" didn't make any sense, which I agree it
> doesn't; But that "method:" really isn't any different. The @Action
> annotation can be applied at the method level of the action class. The
> use-case for the method prefix seems to be completely addressed by using
> the @Action annotation at the method level, multiple times in one action.
> Thus a @Method annotation would serve little purpose since there is already
> an obvious remedy.
>
> What I meant by the definition of action being taken in a different
> context... the documentation of the "method:" prefix seems to indicate that
> the Action Class is the "action" and that it is somehow convenient to be
> able to address another method of the _action_. Why not just do it
> directly? That is why I ask: What am I missing?
>
>
> On Wed, Oct 9, 2013 at 9:40 PM, Paul Benedict <pb...@apache.org>
> wrote:
>
> > Ken,
> >
> > I don't think "action:" will be supported beyond 2.5. It is a feature
> that
> > doesn't make sense. All buttons that belong to a form need to be
> processed
> > by the action of the form for security to work. That's what I think.
> >
> > Paul
> >
> >
> > On Wed, Oct 9, 2013 at 5:58 PM, Ken McWilliams <ken.mcwilliams@gmail.com
> > >wrote:
> >
> > > What am I missing? Why not just the @action annotation? The whole
> method
> > > annotation seems to have risen out of a poor definition of "action". I
> > > consider the action the entire follow of execution. From mapping to
> > result
> > > (Interceptors and the Action class too).
> > >
> > > From the DefaultActionMapper documentation:
> > >
> > > *With method-prefix, instead of calling baz action's execute() method
> (by
> > > default if it isn't overriden in struts.xml to be something else), the
> > baz
> > > action's anotherMethod() will be called. A very elegant way determine
> > which
> > > button is clicked. Alternatively, one would have submit button set a
> > > particular value on the action when clicked, and the execute() method
> > > decides on what to do with the setted value depending on which button
> is
> > > clicked. *
> > >
> > > If you need an annotation on "anotherMethod" @action would be
> > functionally
> > > equivalent to @method. Of course you wouldn't be able to use the
> > "method:"
> > > prefix but then you wouldn't have any need.
> > >
> > >
> > > On Sun, Oct 6, 2013 at 11:23 PM, Lukasz Lenart <
> lukaszlenart@apache.org
> > > >wrote:
> > >
> > > > I think @ActionMethod or @Method is very handy. I'm still wondering
> > > > about how to map which actions are allowed to be used with "action:"
> > > > prefix - what about dropping "action:" prefix and stick only with
> > > > "method:" and "<s:form method=...>" ?
> > > >
> > > >
> > > > Regards
> > > > --
> > > > Łukasz
> > > > + 48 606 323 122 http://www.lenart.org.pl/
> > > >
> > > > 2013/10/4 Steven Benitez <st...@gmail.com>:
> > > > > I suggested this because I wrote an interceptor to require the
> > > > > @ActionMethod annotation years ago to lock down DMI. The upside to
> a
> > > > > separate annotation was that it was completely compatible with XML
> > > > > configuration (which I use). It also had a nice benefit of being
> > > > > documentation, as well. No ambiguity as to whether an method was an
> > > > > invocable action method or just a method that returned a String.
> > > > >
> > > > >
> > > > > On Fri, Oct 4, 2013 at 10:37 AM, Paul Benedict <
> pbenedict@apache.org
> > >
> > > > wrote:
> > > > >
> > > > >> I like that WAY better. Instead of using opaque strings in
> @Action,
> > > use
> > > > >> @ActionMethod on the destination methods. +1
> > > > >>
> > > > >>
> > > > >> On Fri, Oct 4, 2013 at 4:31 AM, Lukasz Lenart <
> > > lukaszlenart@apache.org
> > > > >> >wrote:
> > > > >>
> > > > >> > 2013/10/3 Steven Benitez <st...@gmail.com>:
> > > > >> > > Why not just have an @ActionMethod annotation? If its on the
> > > action
> > > > >> > method,
> > > > >> > > you can invoke it, if not, you can't. The global config option
> > for
> > > > >> > allowed
> > > > >> > > methods sounds reasonable (e.g., execute, input, etc.)
> > > > >> >
> > > > >> > Nice idea and quite simple :-) What about "allowedActions" ?
> Maybe
> > > > >> > extend @Action annotation and add "callable = true|false" which
> > will
> > > > >> > indicate if action can be called by action: prefix.
> > > > >> >
> > > > >> >
> > > > >> > Regards
> > > > >> > --
> > > > >> > Łukasz
> > > > >> > + 48 606 323 122 http://www.lenart.org.pl/
> > > > >> >
> > > > >> >
> > > ---------------------------------------------------------------------
> > > > >> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > > > >> > For additional commands, e-mail: dev-help@struts.apache.org
> > > > >> >
> > > > >> >
> > > > >>
> > > > >>
> > > > >> --
> > > > >> Cheers,
> > > > >> Paul
> > > > >>
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > > > For additional commands, e-mail: dev-help@struts.apache.org
> > > >
> > > >
> > >
> >
> >
> >
> > --
> > Cheers,
> > Paul
> >
>
--
Cheers,
Paul
Re: Strict DMI
Posted by Ken McWilliams <ke...@gmail.com>.
I didn't mean to say that "action:" didn't make any sense, which I agree it
doesn't; But that "method:" really isn't any different. The @Action
annotation can be applied at the method level of the action class. The
use-case for the method prefix seems to be completely addressed by using
the @Action annotation at the method level, multiple times in one action.
Thus a @Method annotation would serve little purpose since there is already
an obvious remedy.
What I meant by the definition of action being taken in a different
context... the documentation of the "method:" prefix seems to indicate that
the Action Class is the "action" and that it is somehow convenient to be
able to address another method of the _action_. Why not just do it
directly? That is why I ask: What am I missing?
On Wed, Oct 9, 2013 at 9:40 PM, Paul Benedict <pb...@apache.org> wrote:
> Ken,
>
> I don't think "action:" will be supported beyond 2.5. It is a feature that
> doesn't make sense. All buttons that belong to a form need to be processed
> by the action of the form for security to work. That's what I think.
>
> Paul
>
>
> On Wed, Oct 9, 2013 at 5:58 PM, Ken McWilliams <ken.mcwilliams@gmail.com
> >wrote:
>
> > What am I missing? Why not just the @action annotation? The whole method
> > annotation seems to have risen out of a poor definition of "action". I
> > consider the action the entire follow of execution. From mapping to
> result
> > (Interceptors and the Action class too).
> >
> > From the DefaultActionMapper documentation:
> >
> > *With method-prefix, instead of calling baz action's execute() method (by
> > default if it isn't overriden in struts.xml to be something else), the
> baz
> > action's anotherMethod() will be called. A very elegant way determine
> which
> > button is clicked. Alternatively, one would have submit button set a
> > particular value on the action when clicked, and the execute() method
> > decides on what to do with the setted value depending on which button is
> > clicked. *
> >
> > If you need an annotation on "anotherMethod" @action would be
> functionally
> > equivalent to @method. Of course you wouldn't be able to use the
> "method:"
> > prefix but then you wouldn't have any need.
> >
> >
> > On Sun, Oct 6, 2013 at 11:23 PM, Lukasz Lenart <lukaszlenart@apache.org
> > >wrote:
> >
> > > I think @ActionMethod or @Method is very handy. I'm still wondering
> > > about how to map which actions are allowed to be used with "action:"
> > > prefix - what about dropping "action:" prefix and stick only with
> > > "method:" and "<s:form method=...>" ?
> > >
> > >
> > > Regards
> > > --
> > > Łukasz
> > > + 48 606 323 122 http://www.lenart.org.pl/
> > >
> > > 2013/10/4 Steven Benitez <st...@gmail.com>:
> > > > I suggested this because I wrote an interceptor to require the
> > > > @ActionMethod annotation years ago to lock down DMI. The upside to a
> > > > separate annotation was that it was completely compatible with XML
> > > > configuration (which I use). It also had a nice benefit of being
> > > > documentation, as well. No ambiguity as to whether an method was an
> > > > invocable action method or just a method that returned a String.
> > > >
> > > >
> > > > On Fri, Oct 4, 2013 at 10:37 AM, Paul Benedict <pbenedict@apache.org
> >
> > > wrote:
> > > >
> > > >> I like that WAY better. Instead of using opaque strings in @Action,
> > use
> > > >> @ActionMethod on the destination methods. +1
> > > >>
> > > >>
> > > >> On Fri, Oct 4, 2013 at 4:31 AM, Lukasz Lenart <
> > lukaszlenart@apache.org
> > > >> >wrote:
> > > >>
> > > >> > 2013/10/3 Steven Benitez <st...@gmail.com>:
> > > >> > > Why not just have an @ActionMethod annotation? If its on the
> > action
> > > >> > method,
> > > >> > > you can invoke it, if not, you can't. The global config option
> for
> > > >> > allowed
> > > >> > > methods sounds reasonable (e.g., execute, input, etc.)
> > > >> >
> > > >> > Nice idea and quite simple :-) What about "allowedActions" ? Maybe
> > > >> > extend @Action annotation and add "callable = true|false" which
> will
> > > >> > indicate if action can be called by action: prefix.
> > > >> >
> > > >> >
> > > >> > Regards
> > > >> > --
> > > >> > Łukasz
> > > >> > + 48 606 323 122 http://www.lenart.org.pl/
> > > >> >
> > > >> >
> > ---------------------------------------------------------------------
> > > >> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > > >> > For additional commands, e-mail: dev-help@struts.apache.org
> > > >> >
> > > >> >
> > > >>
> > > >>
> > > >> --
> > > >> Cheers,
> > > >> Paul
> > > >>
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > > For additional commands, e-mail: dev-help@struts.apache.org
> > >
> > >
> >
>
>
>
> --
> Cheers,
> Paul
>
Re: Strict DMI
Posted by Paul Benedict <pb...@apache.org>.
Ken,
I don't think "action:" will be supported beyond 2.5. It is a feature that
doesn't make sense. All buttons that belong to a form need to be processed
by the action of the form for security to work. That's what I think.
Paul
On Wed, Oct 9, 2013 at 5:58 PM, Ken McWilliams <ke...@gmail.com>wrote:
> What am I missing? Why not just the @action annotation? The whole method
> annotation seems to have risen out of a poor definition of "action". I
> consider the action the entire follow of execution. From mapping to result
> (Interceptors and the Action class too).
>
> From the DefaultActionMapper documentation:
>
> *With method-prefix, instead of calling baz action's execute() method (by
> default if it isn't overriden in struts.xml to be something else), the baz
> action's anotherMethod() will be called. A very elegant way determine which
> button is clicked. Alternatively, one would have submit button set a
> particular value on the action when clicked, and the execute() method
> decides on what to do with the setted value depending on which button is
> clicked. *
>
> If you need an annotation on "anotherMethod" @action would be functionally
> equivalent to @method. Of course you wouldn't be able to use the "method:"
> prefix but then you wouldn't have any need.
>
>
> On Sun, Oct 6, 2013 at 11:23 PM, Lukasz Lenart <lukaszlenart@apache.org
> >wrote:
>
> > I think @ActionMethod or @Method is very handy. I'm still wondering
> > about how to map which actions are allowed to be used with "action:"
> > prefix - what about dropping "action:" prefix and stick only with
> > "method:" and "<s:form method=...>" ?
> >
> >
> > Regards
> > --
> > Łukasz
> > + 48 606 323 122 http://www.lenart.org.pl/
> >
> > 2013/10/4 Steven Benitez <st...@gmail.com>:
> > > I suggested this because I wrote an interceptor to require the
> > > @ActionMethod annotation years ago to lock down DMI. The upside to a
> > > separate annotation was that it was completely compatible with XML
> > > configuration (which I use). It also had a nice benefit of being
> > > documentation, as well. No ambiguity as to whether an method was an
> > > invocable action method or just a method that returned a String.
> > >
> > >
> > > On Fri, Oct 4, 2013 at 10:37 AM, Paul Benedict <pb...@apache.org>
> > wrote:
> > >
> > >> I like that WAY better. Instead of using opaque strings in @Action,
> use
> > >> @ActionMethod on the destination methods. +1
> > >>
> > >>
> > >> On Fri, Oct 4, 2013 at 4:31 AM, Lukasz Lenart <
> lukaszlenart@apache.org
> > >> >wrote:
> > >>
> > >> > 2013/10/3 Steven Benitez <st...@gmail.com>:
> > >> > > Why not just have an @ActionMethod annotation? If its on the
> action
> > >> > method,
> > >> > > you can invoke it, if not, you can't. The global config option for
> > >> > allowed
> > >> > > methods sounds reasonable (e.g., execute, input, etc.)
> > >> >
> > >> > Nice idea and quite simple :-) What about "allowedActions" ? Maybe
> > >> > extend @Action annotation and add "callable = true|false" which will
> > >> > indicate if action can be called by action: prefix.
> > >> >
> > >> >
> > >> > Regards
> > >> > --
> > >> > Łukasz
> > >> > + 48 606 323 122 http://www.lenart.org.pl/
> > >> >
> > >> >
> ---------------------------------------------------------------------
> > >> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > >> > For additional commands, e-mail: dev-help@struts.apache.org
> > >> >
> > >> >
> > >>
> > >>
> > >> --
> > >> Cheers,
> > >> Paul
> > >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail: dev-help@struts.apache.org
> >
> >
>
--
Cheers,
Paul
Re: Strict DMI
Posted by Ken McWilliams <ke...@gmail.com>.
What am I missing? Why not just the @action annotation? The whole method
annotation seems to have risen out of a poor definition of "action". I
consider the action the entire follow of execution. From mapping to result
(Interceptors and the Action class too).
>From the DefaultActionMapper documentation:
*With method-prefix, instead of calling baz action's execute() method (by
default if it isn't overriden in struts.xml to be something else), the baz
action's anotherMethod() will be called. A very elegant way determine which
button is clicked. Alternatively, one would have submit button set a
particular value on the action when clicked, and the execute() method
decides on what to do with the setted value depending on which button is
clicked. *
If you need an annotation on "anotherMethod" @action would be functionally
equivalent to @method. Of course you wouldn't be able to use the "method:"
prefix but then you wouldn't have any need.
On Sun, Oct 6, 2013 at 11:23 PM, Lukasz Lenart <lu...@apache.org>wrote:
> I think @ActionMethod or @Method is very handy. I'm still wondering
> about how to map which actions are allowed to be used with "action:"
> prefix - what about dropping "action:" prefix and stick only with
> "method:" and "<s:form method=...>" ?
>
>
> Regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> 2013/10/4 Steven Benitez <st...@gmail.com>:
> > I suggested this because I wrote an interceptor to require the
> > @ActionMethod annotation years ago to lock down DMI. The upside to a
> > separate annotation was that it was completely compatible with XML
> > configuration (which I use). It also had a nice benefit of being
> > documentation, as well. No ambiguity as to whether an method was an
> > invocable action method or just a method that returned a String.
> >
> >
> > On Fri, Oct 4, 2013 at 10:37 AM, Paul Benedict <pb...@apache.org>
> wrote:
> >
> >> I like that WAY better. Instead of using opaque strings in @Action, use
> >> @ActionMethod on the destination methods. +1
> >>
> >>
> >> On Fri, Oct 4, 2013 at 4:31 AM, Lukasz Lenart <lukaszlenart@apache.org
> >> >wrote:
> >>
> >> > 2013/10/3 Steven Benitez <st...@gmail.com>:
> >> > > Why not just have an @ActionMethod annotation? If its on the action
> >> > method,
> >> > > you can invoke it, if not, you can't. The global config option for
> >> > allowed
> >> > > methods sounds reasonable (e.g., execute, input, etc.)
> >> >
> >> > Nice idea and quite simple :-) What about "allowedActions" ? Maybe
> >> > extend @Action annotation and add "callable = true|false" which will
> >> > indicate if action can be called by action: prefix.
> >> >
> >> >
> >> > Regards
> >> > --
> >> > Łukasz
> >> > + 48 606 323 122 http://www.lenart.org.pl/
> >> >
> >> > ---------------------------------------------------------------------
> >> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> >> > For additional commands, e-mail: dev-help@struts.apache.org
> >> >
> >> >
> >>
> >>
> >> --
> >> Cheers,
> >> Paul
> >>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>
Re: Strict DMI
Posted by Lukasz Lenart <lu...@apache.org>.
I think @ActionMethod or @Method is very handy. I'm still wondering
about how to map which actions are allowed to be used with "action:"
prefix - what about dropping "action:" prefix and stick only with
"method:" and "<s:form method=...>" ?
Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
2013/10/4 Steven Benitez <st...@gmail.com>:
> I suggested this because I wrote an interceptor to require the
> @ActionMethod annotation years ago to lock down DMI. The upside to a
> separate annotation was that it was completely compatible with XML
> configuration (which I use). It also had a nice benefit of being
> documentation, as well. No ambiguity as to whether an method was an
> invocable action method or just a method that returned a String.
>
>
> On Fri, Oct 4, 2013 at 10:37 AM, Paul Benedict <pb...@apache.org> wrote:
>
>> I like that WAY better. Instead of using opaque strings in @Action, use
>> @ActionMethod on the destination methods. +1
>>
>>
>> On Fri, Oct 4, 2013 at 4:31 AM, Lukasz Lenart <lukaszlenart@apache.org
>> >wrote:
>>
>> > 2013/10/3 Steven Benitez <st...@gmail.com>:
>> > > Why not just have an @ActionMethod annotation? If its on the action
>> > method,
>> > > you can invoke it, if not, you can't. The global config option for
>> > allowed
>> > > methods sounds reasonable (e.g., execute, input, etc.)
>> >
>> > Nice idea and quite simple :-) What about "allowedActions" ? Maybe
>> > extend @Action annotation and add "callable = true|false" which will
>> > indicate if action can be called by action: prefix.
>> >
>> >
>> > Regards
>> > --
>> > Łukasz
>> > + 48 606 323 122 http://www.lenart.org.pl/
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
>> > For additional commands, e-mail: dev-help@struts.apache.org
>> >
>> >
>>
>>
>> --
>> Cheers,
>> Paul
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: Strict DMI
Posted by Steven Benitez <st...@gmail.com>.
I suggested this because I wrote an interceptor to require the
@ActionMethod annotation years ago to lock down DMI. The upside to a
separate annotation was that it was completely compatible with XML
configuration (which I use). It also had a nice benefit of being
documentation, as well. No ambiguity as to whether an method was an
invocable action method or just a method that returned a String.
On Fri, Oct 4, 2013 at 10:37 AM, Paul Benedict <pb...@apache.org> wrote:
> I like that WAY better. Instead of using opaque strings in @Action, use
> @ActionMethod on the destination methods. +1
>
>
> On Fri, Oct 4, 2013 at 4:31 AM, Lukasz Lenart <lukaszlenart@apache.org
> >wrote:
>
> > 2013/10/3 Steven Benitez <st...@gmail.com>:
> > > Why not just have an @ActionMethod annotation? If its on the action
> > method,
> > > you can invoke it, if not, you can't. The global config option for
> > allowed
> > > methods sounds reasonable (e.g., execute, input, etc.)
> >
> > Nice idea and quite simple :-) What about "allowedActions" ? Maybe
> > extend @Action annotation and add "callable = true|false" which will
> > indicate if action can be called by action: prefix.
> >
> >
> > Regards
> > --
> > Łukasz
> > + 48 606 323 122 http://www.lenart.org.pl/
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail: dev-help@struts.apache.org
> >
> >
>
>
> --
> Cheers,
> Paul
>
Re: Strict DMI
Posted by Paul Benedict <pb...@apache.org>.
I like that WAY better. Instead of using opaque strings in @Action, use
@ActionMethod on the destination methods. +1
On Fri, Oct 4, 2013 at 4:31 AM, Lukasz Lenart <lu...@apache.org>wrote:
> 2013/10/3 Steven Benitez <st...@gmail.com>:
> > Why not just have an @ActionMethod annotation? If its on the action
> method,
> > you can invoke it, if not, you can't. The global config option for
> allowed
> > methods sounds reasonable (e.g., execute, input, etc.)
>
> Nice idea and quite simple :-) What about "allowedActions" ? Maybe
> extend @Action annotation and add "callable = true|false" which will
> indicate if action can be called by action: prefix.
>
>
> Regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>
--
Cheers,
Paul
Re: Strict DMI
Posted by Lukasz Lenart <lu...@apache.org>.
2013/10/3 Steven Benitez <st...@gmail.com>:
> Why not just have an @ActionMethod annotation? If its on the action method,
> you can invoke it, if not, you can't. The global config option for allowed
> methods sounds reasonable (e.g., execute, input, etc.)
Nice idea and quite simple :-) What about "allowedActions" ? Maybe
extend @Action annotation and add "callable = true|false" which will
indicate if action can be called by action: prefix.
Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: Strict DMI
Posted by Steven Benitez <st...@gmail.com>.
Why not just have an @ActionMethod annotation? If its on the action method,
you can invoke it, if not, you can't. The global config option for allowed
methods sounds reasonable (e.g., execute, input, etc.)
On Thu, Oct 3, 2013 at 11:21 AM, Lukasz Lenart <lu...@apache.org>wrote:
> Hi,
>
> I'm working on extending Strict DMI mode to be enabled by default -
> basically you won't be able to disable it. Thus means you will have to
> define "allowedActions" and "allowedMethods" globally or per action.
> There be no defaults (as for now) so if you don't define
> "allowedActions"/"allowedMethods" calls like these: "myAction!show",
> "method:index", "action:ListUser" won't work. I'm planning to add two
> types of logic: coma separated strings and regex (so you can add "*"
> but then it will be your problem ;-)
>
> To give you a brief example:
>
> <package name="default" extends="struts-default"
> strict-dmi-mode="strings|regex">
>
> <global-allowed-actions>Search,Index</global-allowed-actions>
> <global-allowed-methods>index,form,input</global-allowed-methods>
>
> <action name="HelloWorld" class="example.HelloWorld">
> <param name="allowedActions">ListUser,EditUser</param>
> <param name="allowedMethods">index, edit, submit, form</param>
> <result>/example/HelloWorld.jsp</result>
> </action>
>
> </package>
>
> @Action(value ="HelloWorld", allowedActions="ListUser,EditUser",
> allowedMethods="index, edit, submit, form")
>
> I have one doubt about global configs with annotations - should I add
> it to @Namespace/@ParentPackage? Or base on xml config? Or maybe
> define new annotation - @Package or @StrictDMI?
>
>
> Regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>