Turning off static method access in ognl expressions by default

WW-2160


git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@573606 13f79535-47bb-0310-9956-ffa450edef68

core/src/main/java/org/apache/struts2/StrutsConstants.java

@@ -161,5 +161,8 @@ public final class StrutsConstants {
 
     /** The name of the parameter to create when mapping an id (used by some action mappers) */
 	public static final String STRUTS_ID_PARAMETER_NAME = "struts.mapper.idParameterName";
+	
+	/** The name of the parameter to determine whether static method access will be allowed in OGNL expressions or not */
+	public static final String STRUTS_ALLOW_STATIC_METHOD_ACCESS = "struts.ognl.allowStaticMethodAccess";
 
 }

core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java

@@ -172,6 +172,9 @@ public class BeanSelectionProvider implements ConfigurationProvider {
             props.setProperty("devMode", "false");
         }
         
+        String val = props.getProperty(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS);
+        props.setProperty("allowStaticMethodAccess", val);
+        
         // TODO: This should be moved to XWork after 2.0.4
         // struts.custom.i18n.resources
 

core/src/main/resources/org/apache/struts2/default.properties

@@ -183,4 +183,7 @@ struts.xslt.nocache=false
 ### Whether to always select the namespace to be everything before the last slash or not
 struts.mapper.alwaysSelectFullNamespace=false
 
+### Whether to allow static method access in OGNL expressions or not
+struts.ognl.allowStaticMethodAccess=false
+
 ### END SNIPPET: complete_file