[
http://jira.jboss.com/jira/browse/JBSEAM-380?page=all ]
Gavin King closed JBSEAM-380.
-----------------------------
Resolution: Won't Fix
Assignee: Gavin King
Use a page action instead. These checks are necessary for security reasons.
But it is possible in latest version of Seam to explicitly add "safe actions"
via SafeActions.instance().addSafeAction("viewId:action.method")
actionMethod in query string not executing unless s:link rendered
first
-----------------------------------------------------------------------
Key: JBSEAM-380
URL:
http://jira.jboss.com/jira/browse/JBSEAM-380
Project: JBoss Seam
Issue Type: Feature Request
Components: JSF
Affects Versions: 1.0.1
Reporter: Jye Tucker
Assigned To: Gavin King
We are using actionMethod query string parameters to control a Seam application from an
external (Classic ASP) application. Effectively the navigation in the external application
has links similar to /seamapp/index.jsf?actionMethod=bean.method
Currently the implementation of Pages#callAction(FacesContext) checks if an action
expression exists in an Set stored in an application attribute
"org.jboss.seam.actions". If the expression doesn't exist, the action is not
executed. Usually an action expression is added to the set when an s:link is rendered on a
page. See UIAction#allowAction(String)
This is problematic in our case as there are no s:links in the external application -
therefore the set is never populated - therefore our methods aren't executed.
Suggest either:
1) A configuration flag to bypass this check system-wide or;
2) A register of methods which can be called without a security check (via components.xml
or an additional method-level annotation perhaps?)
Happy to provide a patch for this if you advise a preferred implementation. My preference
would be 2.
In the meantime, we work around it by manually creating the application attribute and
populating it with our list of action expressions.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira