Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adds more strict DMI logic

Browse Source
This commit is contained in:
Lukasz Lenart
2015-09-04 11:35:23 +02:00
parent 45af87655d
commit 0aaade64cd
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java
+6 -1
View File
@@ -846,7 +846,8 @@ public class XmlConfigurationProvider implements ConfigurationProvider {
NodeList allowedMethodsEls = element.getElementsByTagName("allowed-methods");
Set<String> allowedMethods;
if (packageContext.isStrictMethodInvocation()) {
if (allowedMethodsEls.getLength() > 0) {
// user defined 'allowed-methods' so used them whatever Strict DMI was enabled or not
allowedMethods = packageContext.getGlobalAllowedMethods();
if (allowedMethodsEls.getLength() > 0) {
@@ -859,7 +860,11 @@ public class XmlConfigurationProvider implements ConfigurationProvider {
}
}
}
} else if (packageContext.isStrictMethodInvocation()) {
// user enabled Strict DMI but didn't defined action specific 'allowed-methods' so we use 'global-allowed-methods' only
allowedMethods = packageContext.getGlobalAllowedMethods();
} else {
// Strict DMI is disabled to any method can be called
allowedMethods = new HashSet<>();
allowedMethods.add(ActionConfig.REGEX_WILDCARD);
}