<div class="gmail_quote">On Wed, Jun 9, 2010 at 11:06 AM, Lincoln Baxter, III <span dir="ltr"><<a href="mailto:lincolnbaxter@gmail.com">lincolnbaxter@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Yeah - Just saw that this morning. I'd like to see a way to implement this for ALL pages, not requiring a custom tag. I believe this could be done easily using the PreRenderViewEvent to add a hidden form field to store the token in all outbound forms, then use a phase-listener after Restore_View, comparing the request parameter to the restored component value. Very similar to the <s:token> component, but as a global solution that could be enabled/disabled via XML config.<br>
</blockquote><div><br></div><div>Global solution is good. In fact, it's even more secure since it solves the "doh, I forgot to add the tag" security hole ;)</div><div><br></div><div>-Dan</div><div> </div></div>
-- <br>Dan Allen<br>Senior Software Engineer, Red Hat | Author of Seam in Action<br>Registered Linux User #231597<br><br><a href="http://mojavelinux.com">http://mojavelinux.com</a><br><a href="http://mojavelinux.com/seaminaction">http://mojavelinux.com/seaminaction</a><br>
<a href="http://www.google.com/profiles/dan.j.allen">http://www.google.com/profiles/dan.j.allen</a><br>