diff --git a/core/src/main/java/org/apache/struts2/StrutsConstants.java b/core/src/main/java/org/apache/struts2/StrutsConstants.java index 7fc6d34b2..e2773b786 100644 --- a/core/src/main/java/org/apache/struts2/StrutsConstants.java +++ b/core/src/main/java/org/apache/struts2/StrutsConstants.java @@ -161,5 +161,8 @@ public final class StrutsConstants { /** The name of the parameter to create when mapping an id (used by some action mappers) */ public static final String STRUTS_ID_PARAMETER_NAME = "struts.mapper.idParameterName"; + + /** The name of the parameter to determine whether static method access will be allowed in OGNL expressions or not */ + public static final String STRUTS_ALLOW_STATIC_METHOD_ACCESS = "struts.ognl.allowStaticMethodAccess"; } diff --git a/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java b/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java index a2e2e2ea4..31e431fea 100644 --- a/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java +++ b/core/src/main/java/org/apache/struts2/config/BeanSelectionProvider.java @@ -172,6 +172,9 @@ public class BeanSelectionProvider implements ConfigurationProvider { props.setProperty("devMode", "false"); } + String val = props.getProperty(StrutsConstants.STRUTS_ALLOW_STATIC_METHOD_ACCESS); + props.setProperty("allowStaticMethodAccess", val); + // TODO: This should be moved to XWork after 2.0.4 // struts.custom.i18n.resources diff --git a/core/src/main/resources/org/apache/struts2/default.properties b/core/src/main/resources/org/apache/struts2/default.properties index 697b1ec34..d6ddbb158 100644 --- a/core/src/main/resources/org/apache/struts2/default.properties +++ b/core/src/main/resources/org/apache/struts2/default.properties @@ -183,4 +183,7 @@ struts.xslt.nocache=false ### Whether to always select the namespace to be everything before the last slash or not struts.mapper.alwaysSelectFullNamespace=false +### Whether to allow static method access in OGNL expressions or not +struts.ognl.allowStaticMethodAccess=false + ### END SNIPPET: complete_file