dispatch action change request

[Dan Allen <da...@mojavelinux.com>]

I have a request for a change in dispatch action which should not
affect current uses of it but will help to increase the security.
In the dispatch action there is a method called 'unspecified' that
is executed if the parameter value does not match any method names.
This can be very useful for default actions (in my opinion it should
be named 'default' but that is another issue entirely, I can live
with unspecified).  However, the following case is not permitted by
dispatch action but would be very useful.

In the case of CRUD grouping, one normally places the create,
retrieve/read, update and delete actions together for an object
stored in the persistance.  However, the issue always comes up when
the action attempts to validate the form during the retrieve
operation (or prior to the action as it would be).  Besides breaking
the whole model of struts by putting the call to validate() in the
action, the only way around this is to create a seperate action
mapping for the retieve operation which has validate="false".  While
this works, it always introduces a HUGE hole in the validation.
With the new action mapping attached to the same dispatch action, it
is now possible to get passed the validation by appending the method
call onto the action path with the validate="false" since no
validation is being done for that action mapping.

i.e. you could call:
/ManageArticle?method=update

if the two actions where

/ManageArticle (non-validating)
/ManageArticleSubmit (validating)

So what is my solution (besides being naughty and doing things that
don't belong in an action)?  Simple.  The 'R' action, or
retrieve/read should have a mapping to the dispatch action with
validate="false" but leave off the parameter, making it null.  In
dispatch action, if the getParameter() method returns null, instead
of throwing an error, it should just call the unspecified method in
the dispatch action.  The unspecified action then becomes the
retrieve/read action, which is a safe assumption and the user is
taken to the form.

The patch for this is really minor and I believe it would be
immensely more secure than the alternative option, which is leaving
a non-validating path to the dispatch action.

In the cae of an article manager, the following struts-config action
mappings would apply:

<action
    path="/ManageArticle"
    type="webapp.ManageArticleAction"
    name="articleForm"
    scope="request"
    validate="false">
    <forward name="continue" path="manageArticle.jsp"/>
</action>

<action
    path="/ManageArticleSubmit"
    type="webapp.ManageArticleAction"
    name="articleForm"
    scope="request"
    validate="true"
    input="form"
    parameter="method">
    <forward name="form" path="manageArticle.jsp"/>
    <forward name="success" path="confirmation.jsp"/>
</action>

Dan

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
Daniel Allen, <da...@mojavelinux.com>
http://www.mojavelinux.com/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
umm... i guess this is my signature. 8-}
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 

---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org