Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@struts.apache.org
Date: Wed, 5 Jun 2013 22:30:21 +0000 (UTC)
From: "Johno Crawford (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12651214.1370467765160.74545.1370471421232@arcas>
In-Reply-To: <JIRA.12651214.1370467765160@arcas>
References: <JIRA.12651214.1370467765160@arcas>
Subject: [jira] [Commented] (WW-4094) struts.allowed.action.names
 inconsistency
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/WW-4094?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13676435#comment-13676435 ] 

Johno Crawford commented on WW-4094:
------------------------------------

We are observing the same misbehaviour in cleanupActionName.

2013-06-05 20:20:33,881 WARN  [http-8080-exec-5] (org.apache.struts2.dispatcher.mapper.DefaultActionMapper) Action [logout_ok] do not match allowed action names pattern [[a-z]*[A-Z]*[0-9]*[.\-_!/]*], cleaning it up! [userId=1 url=/account/logout_ok referer=null ip=127.0.0.1 parameters=[token:7f4a0dfce0]]
                
> struts.allowed.action.names inconsistency
> -----------------------------------------
>
>                 Key: WW-4094
>                 URL: https://issues.apache.org/jira/browse/WW-4094
>             Project: Struts 2
>          Issue Type: Bug
>    Affects Versions: 2.3.14.3
>            Reporter: Andreas Sachs
>            Priority: Minor
>
> I think there is a inconsistency in DefaultActionMapper.cleanupActionName
> According to http://struts.apache.org/development/2.x/docs/s2-015.html struts.allowed.action.names defines a regex the action name must match.
> The default regex is: [a-z]*[A-Z]*[0-9]*[.\-_!/]*
> I have an action with the name "core_blz"
> This action name does not match the regex (underscore is not at the end)(maybe the default value should be changed).
> DefaultActionMapper reports Action [#0] do not match allowed action names pattern [#1], cleaning it up!
> But the cleaned action name is still core_blz.
> If this function is only to remove suspicious characters, then the warning should not be displayed.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira