From 0aaade64cd332a7a5f45ae5068b8f7be1abb3817 Mon Sep 17 00:00:00 2001 From: Lukasz Lenart Date: Fri, 4 Sep 2015 11:35:23 +0200 Subject: [PATCH] Adds more strict DMI logic --- .../xwork2/config/providers/XmlConfigurationProvider.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java index 950d4a12b..7d2e065d5 100644 --- a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java +++ b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java @@ -846,7 +846,8 @@ public class XmlConfigurationProvider implements ConfigurationProvider { NodeList allowedMethodsEls = element.getElementsByTagName("allowed-methods"); Set allowedMethods; - if (packageContext.isStrictMethodInvocation()) { + if (allowedMethodsEls.getLength() > 0) { + // user defined 'allowed-methods' so used them whatever Strict DMI was enabled or not allowedMethods = packageContext.getGlobalAllowedMethods(); if (allowedMethodsEls.getLength() > 0) { @@ -859,7 +860,11 @@ public class XmlConfigurationProvider implements ConfigurationProvider { } } } + } else if (packageContext.isStrictMethodInvocation()) { + // user enabled Strict DMI but didn't defined action specific 'allowed-methods' so we use 'global-allowed-methods' only + allowedMethods = packageContext.getGlobalAllowedMethods(); } else { + // Strict DMI is disabled to any method can be called allowedMethods = new HashSet<>(); allowedMethods.add(ActionConfig.REGEX_WILDCARD); }