[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-780) support message severities in redirect with message
by Keith Naas (JIRA)
support message severities in redirect with message
---------------------------------------------------
Key: JBSEAM-780
URL: http://jira.jboss.com/jira/browse/JBSEAM-780
Project: JBoss Seam
Issue Type: Feature Request
Components: Core
Affects Versions: 1.1.5.GA
Reporter: Keith Naas
Priority: Minor
It would be nice if redirect directives would allow for message severities to be defined for them. This happens a lot for scenarios where exceptions cause a redirect. Instead of the user seeing an INFO message, we want them to see an ERROR or WARN FacesMessage.
For instance, if a severity flag was added to the message, we could do this in pages.xml using the following:
{code}
<exception class="org.jboss.seam.security.AuthorizationException">
<end-conversation />
<redirect view-id="/myglobal/unprot/pages/login.xhtml" >
<message severity="error">
Login failed. Please try again.
</message>
</redirect>
</exception>
{code}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 11 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-800) s:hasPermission vs view-id wildcards
by Stephan Bublava (JIRA)
s:hasPermission vs view-id wildcards
------------------------------------
Key: JBSEAM-800
URL: http://jira.jboss.com/jira/browse/JBSEAM-800
Project: JBoss Seam
Issue Type: Bug
Components: Security
Affects Versions: 1.1.6.GA
Reporter: Stephan Bublava
Assume I have a set of protected pages, i.e. pages.xml contains:
<page view-id="/foo/*">
<restrict />
</page>
and now I navigate to /foo/bar.seam.
In this case the security frameworks checks: #{s:hasPermission('/foo/*', 'render', null)}.
I believe this is bad, escpecially as it establishes strong ties between pages.xml and my security rules (which may break whenever pages.xml is changed). It would be much better to check for the actual page being accessed, i..e. #{s:hasPermission('/foo/bar.xhtml', 'render', null)}.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years, 11 months