Return-Path: 
 <issues-return-27085-apmail-struts-issues-archive=struts.apache.org@struts.apache.org>
X-Original-To: apmail-struts-issues-archive@minotaur.apache.org
Delivered-To: apmail-struts-issues-archive@minotaur.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id DC0F01810F
	for <apmail-struts-issues-archive@minotaur.apache.org>;
 Thu,  4 Feb 2016 10:37:40 +0000 (UTC)
Received: (qmail 92012 invoked by uid 500); 4 Feb 2016 10:37:40 -0000
Delivered-To: apmail-struts-issues-archive@struts.apache.org
Received: (qmail 91841 invoked by uid 500); 4 Feb 2016 10:37:40 -0000
Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:issues-help@struts.apache.org>
List-Unsubscribe: <mailto:issues-unsubscribe@struts.apache.org>
List-Post: <mailto:issues@struts.apache.org>
List-Id: <issues.struts.apache.org>
Reply-To: dev@struts.apache.org
Delivered-To: mailing list issues@struts.apache.org
Received: (qmail 91731 invoked by uid 99); 4 Feb 2016 10:37:40 -0000
Received: from arcas.apache.org (HELO arcas) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 04 Feb 2016 10:37:40 +0000
Received: from arcas.apache.org (localhost [127.0.0.1])
	by arcas (Postfix) with ESMTP id DCE0A2C1F58
	for <issues@struts.apache.org>; Thu,  4 Feb 2016 10:37:39 +0000 (UTC)
Date: Thu, 4 Feb 2016 10:37:39 +0000 (UTC)
From: "Greg Huber (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12933785.1453721807000.297963.1454582259901@Atlassian.JIRA>
In-Reply-To: <JIRA.12933785.1453721807000@Atlassian.JIRA>
References: <JIRA.12933785.1453721807000@Atlassian.JIRA>
 <JIRA.12933785.1453721807463@arcas>
Subject: [jira] [Commented] (WW-4596) Strict DMI causes This method: for
 action is not allowed!
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/WW-4596?page=3Dcom.atlassian.ji=
ra.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D1513211=
6#comment-15132116 ]=20

Greg Huber commented on WW-4596:
--------------------------------

Missed the allowedMethods =3D new HashSet<>(); also ;)

#####

I tried :

<action name=3D"myView!*" method=3D"prefix{0}suffix" class=3D"ui.struts2.ed=
itor.MyView">

which needed a method in MyView for it to work=20

{code:java}
public String prefixmyViewsuffix() {
=09execute();
=09return "input";
}
{code}

Stripping out {0} and prefix{0}suffix did not seem to make a difference, it=
 stlll envoked the prefixmyViewsuffix() method but failed the SMI (ie was n=
ot blocked).

Leaving prefix{0}suffix in also made no difference, and failed the SMI (ie =
was not blocked).

PatternAllowedMethod{allowedMethodPattern=3Dprefix(.*)suffix, original=3D'p=
refix{0}suffix'},=20

Would have though removing prefix{0}suffix would break the ActionConfig, ma=
ybe its getting the method name prefixmyViewsuffix() from somewhere else?


> Strict DMI causes This method: for action is not allowed! =20
> -----------------------------------------------------------
>
>                 Key: WW-4596
>                 URL: https://issues.apache.org/jira/browse/WW-4596
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Core Actions
>    Affects Versions: 2.5
>            Reporter: Greg Huber
>             Fix For: 2.5
>
>
> I have tried adding
> {code:xml}
> <global-allowed-methods>execute,input,cancel</global-allowed-methods>
> {code}
> and get
> {noformat}
> This method: cancel for action eventAdd is not allowed! - [unknown locati=
on]
> {noformat}
> {code:xml}
> <action name=3D"eventAdd!*" method=3D"{1}"
>                 class=3D"ui.struts2.editor.EventAdd">
>             <result name=3D"input" type=3D"tiles">.EventAdd</result>
>             <result name=3D"success" type=3D"chain">eventEdit</result>
>             <result name=3D"cancel" type=3D"redirectAction">
>                 <param name=3D"actionName">memberEvents</param>
>                 <param name=3D"pgn">${bean.pageNum}</param>
>                 <param name=3D"suppressEmptyParameters">true</param>
>             </result>
>         </action>
> {code}
> checking ActionConfig:
> {code:java}
> public boolean isAllowedMethod(String method) {
>         return method.equals(methodName !=3D null ? methodName : DEFAULT_=
METHOD) || allowedMethods.isAllowed(method);
>     }
> {code}
> Debugging  I get a calls to isAllowedMethod with :
> {noformat}
> 1 methodName =3D {1}=E2=80=8B and method =3D execute
> 2 methodName =3D execute and method =3D cancel
> {noformat}
> =E2=80=8BOnly #1 has the required cancel
> #2 there is only a {{\[LiteralAllowedMethod\{allowedMethod=3D'execute'\}\=
]}}
> On further investigation {{com.opensymphony.xwork2.config.implActionConfi=
gMatcher}} seems to create a new ActionConfig but then only uses the defaul=
t allowed names:
> {code:java}
> return new ActionConfig.Builder(pkgName, orig.getName(), className)
>                 .methodName(methodName)
>                 .addParams(params)
>                 .addResultConfigs(results)
>                 .addInterceptors(orig.getInterceptors())
>                 .addExceptionMappings(exs)
>                 .location(orig.getLocation())
>                 .build();
> {code}
> Could use the original by appending .addAllowedMethod(orig.getAllowedMeth=
ods()), but I guess it should come from the ActionConfig stored in the pack=
ageContext or wherever the orig object gets its allowedMethods from.
> Cheers Greg



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)