[jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-800) s:hasPermission vs view-id wildcards

s:hasPermission vs view-id wildcards ------------------------------------ Key: JBSEAM-800 URL: http://jira.jboss.com/jira/browse/JBSEAM-800 Project: JBoss Seam Issue Type: Bug Components: Security Affects Versions: 1.1.6.GA Reporter: Stephan Bublava Assigned To: Shane Bryzak Fix For: 1.1.7.GA Assume I have a set of protected pages, i.e. pages.xml contains: <page view-id="/foo/*"> <restrict /> </page> and now I navigate to /foo/bar.seam. In this case the security frameworks checks: #{s:hasPermission('/foo/*', 'render', null)}. I believe this is bad, escpecially as it establishes strong ties between pages.xml and my security rules (which may break whenever pages.xml is changed). It would be much better to check for the actual page being accessed, i..e. #{s:hasPermission('/foo/bar.xhtml', 'render', null)}.