[jboss-jira] [JBoss JIRA] Updated: (JBSEAM-380) actionMethod in query string not executing unless s:link rendered first

[Gavin King (JIRA)]

     [ http://jira.jboss.com/jira/browse/JBSEAM-380?page=all ]

Gavin King updated JBSEAM-380:
------------------------------

    Component/s: JSF

> actionMethod in query string not executing unless s:link rendered first
> -----------------------------------------------------------------------
>
>                 Key: JBSEAM-380
>                 URL: http://jira.jboss.com/jira/browse/JBSEAM-380
>             Project: JBoss Seam
>          Issue Type: Feature Request
>          Components: JSF
>    Affects Versions: 1.0.1
>            Reporter: Jye Tucker
>
> We are using actionMethod query string parameters to control a Seam application from an external (Classic ASP) application. Effectively the navigation in the external application has links similar to /seamapp/index.jsf?actionMethod=bean.method
> Currently the implementation of Pages#callAction(FacesContext) checks if an action expression exists in an Set stored in an application attribute "org.jboss.seam.actions". If the expression doesn't exist, the action is not executed. Usually an action expression is added to the set when an s:link is rendered on a page. See UIAction#allowAction(String)
> This is problematic in our case as there are no s:links in the external application - therefore the set is never populated - therefore our methods aren't executed.
> Suggest either:
> 1) A configuration flag to bypass this check system-wide or;
> 2) A register of methods which can be called without a security check (via components.xml or an additional method-level annotation perhaps?)
> Happy to provide a patch for this if you advise a preferred implementation. My preference would be 2.
> In the meantime, we work around it by manually creating the application attribute and populating it with our list of action expressions.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira