From 536d2db4b898c7155c626fce001b223a96a47da3 Mon Sep 17 00:00:00 2001
From: JCgH4164838Gh792C124B5
 <43964333+JCgH4164838Gh792C124B5@users.noreply.github.com>
Date: Wed, 21 Nov 2018 23:45:13 -0500
Subject: [PATCH] Minor update to Struts 2.5.x SecurityMemberAccess.

Code changes:
- updated SecurityMemberAccess for compatibility with future OGNL 3.1.19+ versions
- updated SecurityMemberAccess constructor (minor cleanup and added comment)
---
 .../xwork2/ognl/SecurityMemberAccess.java     | 23 ++++++++++++-------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
index e9225a0d6..4e1e964eb 100644
--- a/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
+++ b/core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
@@ -46,9 +46,16 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
     private Set<String> excludedPackageNames = Collections.emptySet();
     private boolean disallowProxyMemberAccess;
 
-    public SecurityMemberAccess(boolean method) {
+    /**
+     * SecurityMemberAccess
+     *   - access decisions based on whether member is static (or not)
+     *   - block or allow access to properties (configureable-after-construction)
+     * 
+     * @param allowStaticMethodAccess
+     */
+    public SecurityMemberAccess(boolean allowStaticMethodAccess) {
         super(false);
-        allowStaticMethodAccess = method;
+        this.allowStaticMethodAccess = allowStaticMethodAccess;
     }
 
     public boolean getAllowStaticMethodAccess() {
@@ -58,10 +65,10 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
     @Override
     public boolean isAccessible(Map context, Object target, Member member, String propertyName) {
         LOG.debug("Checking access for [target: {}, member: {}, property: {}]", target, member, propertyName);
-        
-        Class targetClass = target.getClass();
-        Class memberClass = member.getDeclaringClass();
-        
+
+        final Class memberClass = member.getDeclaringClass();
+        Class targetClass = (target != null ? target.getClass() : memberClass);  // Note: target,propertyName may be null (static field checks OGNL 3.1.19+)
+
         if (checkEnumAccess(target, member)) {
             LOG.trace("Allowing access to enum: target class [{}] of target [{}], member [{}]", targetClass, target, member);
             return true;
@@ -70,8 +77,8 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
         if (Modifier.isStatic(member.getModifiers()) && allowStaticMethodAccess) {
             LOG.debug("Support for accessing static methods [target: {}, targetClass: {}, member: {}, property: {}] is deprecated!",
                     target, targetClass, member, propertyName);
-            if (!isClassExcluded(member.getDeclaringClass())) {
-                targetClass = member.getDeclaringClass();
+            if (!isClassExcluded(memberClass)) {
+                targetClass = memberClass;
             }
         }