allow the switch to be a toggle, defaulted to false

git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@437855 13f79535-47bb-0310-9956-ffa450edef68

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -121,4 +121,7 @@ public final class StrutsConstants {
     
     /** If static content served by the Struts filter should set browser caching header properties or not */
     public static final String STRUTS_SERVE_STATIC_BROWSER_CACHE = "struts.serve.static.browserCache";
+
+    /** Allows one to disable dynamic method invocation from the URL */
+    public static final String STRUTS_DISABLE_DYNAMIC_METHOD_INVOCATIOn = "struts.core.disableDynamicMethodInvocation";
 }

core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java

@@ -19,6 +19,7 @@ package org.apache.struts2.dispatcher.mapper;
 
 import org.apache.struts2.RequestUtils;
 import org.apache.struts2.StrutsConstants;
+import org.apache.struts2.config.Settings;
 import org.apache.struts2.dispatcher.ServletRedirectResult;
 import org.apache.struts2.util.PrefixTrie;
 
@@ -148,6 +149,8 @@ public class DefaultActionMapper implements ActionMapper {
     static final String REDIRECT_PREFIX = "redirect:";
     static final String REDIRECT_ACTION_PREFIX = "redirect-action:";
 
+    private static boolean disableDyanmicMethodCalls = "true".equals(Settings.get(StrutsConstants.STRUTS_SERVE_STATIC_BROWSER_CACHE));
+
     private PrefixTrie prefixTrie = null;
     public DefaultActionMapper() {
         prefixTrie = new PrefixTrie() {
@@ -205,18 +208,22 @@ public class DefaultActionMapper implements ActionMapper {
 
         parseNameAndNamespace(uri, mapping, config);
 
-        handleSpecialParameters(request, mapping);
+        if (!disableDyanmicMethodCalls) {
+            handleSpecialParameters(request, mapping);
+        }
 
         if (mapping.getName() == null) {
             return null;
         }
 
-        // handle "name!method" convention.
-        String name = mapping.getName();
-        int exclamation = name.lastIndexOf("!");
-        if (exclamation != -1) {
-            mapping.setName(name.substring(0, exclamation));
-            mapping.setMethod(name.substring(exclamation + 1));
+        if (!disableDyanmicMethodCalls) {
+            // handle "name!method" convention.
+            String name = mapping.getName();
+            int exclamation = name.lastIndexOf("!");
+            if (exclamation != -1) {
+                mapping.setName(name.substring(0, exclamation));
+                mapping.setMethod(name.substring(exclamation + 1));
+            }
         }
 
         return mapping;

core/src/main/resources/org/apache/struts2/default.properties

@@ -71,6 +71,11 @@ struts.serve.static=true
 ###            headers)
 struts.serve.static.browserCache=true
 
+### Set this to true if you wish to disable all forms of dynamic method invocation
+### via the URL request. This includes URLs like foo!bar.action, as well as params
+### like method:bar. See the DefaultActionMapper for more info.
+struts.core.disableDynamicMethodInvocation = false
+
 ### use alternative syntax that requires %{} in most places
 ### to evaluate expressions for String attributes for tags
 struts.tag.altSyntax=true