struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF subversion and git services (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (WW-4728) JSONValidationInterceptor change static parameters names
Date Mon, 09 Jan 2017 10:40:59 GMT

    [ https://issues.apache.org/jira/browse/WW-4728?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15811427#comment-15811427
] 

ASF subversion and git services commented on WW-4728:
-----------------------------------------------------

Commit 08e181a4febb4e999e5e3366a0890eb1d5a953e5 in struts's branch refs/heads/master from
[~lukaszlenart]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=08e181a ]

WW-4728 Allows override request parameter names used to enable validation


> JSONValidationInterceptor change static parameters names
> --------------------------------------------------------
>
>                 Key: WW-4728
>                 URL: https://issues.apache.org/jira/browse/WW-4728
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Plugin - JSON
>            Reporter: Alireza Fattahi
>            Assignee: Lukasz Lenart
>             Fix For: 2.5.next
>
>
> For security reasons I want to not reveal that we are using struts2 in our site. But
the hackers can find it if they see the hidden parameters in the request.
> Is it possible to make below parameters configurable ( For example in struts.xml)
> {code}
> public static final String VALIDATE_ONLY_PARAM = "struts.validateOnly";
> public static final String VALIDATE_JSON_PARAM = "struts.enableJSONValidation";
> public static final String NO_ENCODING_SET_PARAM = "struts.JSONValidation.no.encoding";
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message