From afae14eb86d24d3b6f8dd1d1a23da2b355c5a0d7 Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Fri, 18 Oct 2013 08:39:11 +0000
Subject: [PATCH] WW-4162 Doesn't check for disallowed ognl expressions if
 getting from expression cache

git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1533360 13f79535-47bb-0310-9956-ffa450edef68
---
 .../java/com/opensymphony/xwork2/ognl/OgnlUtil.java  | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
index 8285b7b14..3e622d5d9 100644
--- a/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
+++ b/xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java
@@ -266,18 +266,22 @@ public class OgnlUtil {
             tree = expressions.get(expression);
             if (tree == null) {
                 tree = Ognl.parseExpression(expression);
+                checkEnableEvalExpression(tree, context);
                 expressions.putIfAbsent(expression, tree);
             }
         } else {
             tree = Ognl.parseExpression(expression);
-        }
-
-        if (!enableEvalExpression && isEvalExpression(tree, context)) {
-            throw new OgnlException("Eval expressions has been disabled");
+            checkEnableEvalExpression(tree, context);
         }
 
         return tree;
     }
+    
+    private void checkEnableEvalExpression(Object tree, Map<String, Object> context) throws OgnlException {
+        if (!enableEvalExpression && isEvalExpression(tree, context)) {
+            throw new OgnlException("Eval expressions has been disabled!");
+        }
+    }
 
     /**
      * Copies the properties in the object "from" and sets them in the object "to"