WW-4785 Allows disable multipart support via an config option

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -139,6 +139,11 @@ public final class StrutsConstants {
      */
     public static final String STRUTS_MULTIPART_PARSER = "struts.multipart.parser";
 
+    /**
+     * A global switch to disable support for multipart requests
+     */
+    public static final String STRUTS_MULTIPART_ENABLED = "struts.multipart.enabled";
+
     public static final String STRUTS_MULTIPART_VALIDATION_REGEX = "struts.multipart.validationRegex";
 
     /** How Spring should autowire.  Valid values are 'name', 'type', 'auto', and 'constructor' */

core/src/main/java/org/apache/struts2/dispatcher/Dispatcher.java

@@ -129,6 +129,11 @@ public class Dispatcher {
      */
     private String multipartHandlerName;
 
+    /**
+     * Stores the value of {@link StrutsConstants#STRUTS_MULTIPART_ENABLED}
+     */
+    private boolean multipartSupportEnabled = true;
+
     /**
      * A regular expression used to validate if request is a multipart/form-data request
      */
@@ -277,6 +282,11 @@ public class Dispatcher {
         multipartHandlerName = val;
     }
 
+    @Inject(value = StrutsConstants.STRUTS_MULTIPART_ENABLED, required = false)
+    public void setMultipartSupportEnabled(String multipartSupportEnabled) {
+        this.multipartSupportEnabled = Boolean.parseBoolean(multipartSupportEnabled);
+    }
+
     @Inject(value = StrutsConstants.STRUTS_MULTIPART_VALIDATION_REGEX, required = false)
     public void setMultipartValidationRegex(String multipartValidationRegex) {
         this.multipartValidationPattern = Pattern.compile(multipartValidationRegex);
@@ -799,7 +809,7 @@ public class Dispatcher {
             return request;
         }
 
-        if (isMultipartRequest(request)) {
+        if (isMultipartSupportEnabled(request) && isMultipartRequest(request)) {
             MultiPartRequest multiPartRequest = getMultiPartRequest();
             LocaleProviderFactory localeProviderFactory = getContainer().getInstance(LocaleProviderFactory.class);
 
@@ -817,6 +827,18 @@ public class Dispatcher {
         return request;
     }
 
+    /**
+     * Checks if support to parse multipart requests is enabled
+     * 
+     * @param request current servlet request
+     * @return false if disabled
+     *
+     * @since 2.5.11
+     */
+    protected boolean isMultipartSupportEnabled(HttpServletRequest request) {
+        return multipartSupportEnabled;
+    }
+
     /**
      * Checks if request is a multipart request (a file upload request)
      *

core/src/test/java/org/apache/struts2/dispatcher/DispatcherTest.java

@@ -257,7 +257,17 @@ public class DispatcherTest extends StrutsInternalTestCase {
         mockContainer.verify();
         mockConfiguration.verify();
     }
-    
+
+    public void testMultipartSupportEnabledByDefault() throws Exception {
+        HttpServletRequest req = new MockHttpServletRequest();
+        HttpServletResponse res = new MockHttpServletResponse();
+
+        Dispatcher du = initDispatcher(Collections.<String, String>emptyMap());
+        du.prepare(req, res);
+
+        assertTrue(du.isMultipartSupportEnabled(req));
+    }
+
     class InternalConfigurationManager extends ConfigurationManager {
     	public boolean destroyConfiguration = false;