diff --git a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java index e761b4b90..4e76bb290 100644 --- a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java +++ b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java @@ -873,11 +873,13 @@ public class XmlConfigurationProvider implements ConfigurationProvider { // user enabled Strict DMI but didn't defined action specific 'allowed-methods' so we use 'global-allowed-methods' only allowedMethods = new HashSet<>(packageContext.getGlobalAllowedMethods()); } else { - // Strict DMI is disabled to any method can be called + // Strict DMI is disabled so any method can be called allowedMethods = new HashSet<>(); allowedMethods.add(ActionConfig.WILDCARD); } + LOG.debug("Collected allowed methods: {}", allowedMethods); + return Collections.unmodifiableSet(allowedMethods); }