Aw: Re: Struts 7: error when "s:action" is used on jsp page and jsp is invoked directly in browser

2024-10-20 Thread Wolfgang Knauf 
Done: https://issues.apache.org/jira/browse/WW-5475

Best regards

Wolfgang



> Gesendet: Sonntag, 20. Oktober 2024 um 11:17
> Von: "Lukasz Lenart" 
> An: "Struts Users Mailing List" 
> Betreff: Re: Struts 7: error when "s:action" is used on jsp page and jsp 
is invoked directly in browser
>
> niedz., 20 paź 2024 o 11:14 Wolfgang Knauf
>  napisał(a):
> >
> > OK, I see. Thanks for the clarification.
> >
> > Is there any chance to improve the error message or detect this
> > situation? You wrote that this is a recommendation, and it worked with
> > the old version. But the exception does not point to anything helpful
> > for analysing this.
> 
> Sure, feel free to register a bug, I can add a better error message
> when direct access to JSP is detected
> 
> 
> Cheers
> Łukasz
> 
> -
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
> 
> 


-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: Struts 7: error when "s:action" is used on jsp page and jsp is invoked directly in browser

2024-10-20 Thread Lukasz Lenart 
niedz., 20 paź 2024 o 11:14 Wolfgang Knauf
 napisał(a):
>
> OK, I see. Thanks for the clarification.
>
> Is there any chance to improve the error message or detect this
> situation? You wrote that this is a recommendation, and it worked with
> the old version. But the exception does not point to anything helpful
> for analysing this.

Sure, feel free to register a bug, I can add a better error message
when direct access to JSP is detected


Cheers
Łukasz

-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: Struts 7: error when "s:action" is used on jsp page and jsp is invoked directly in browser

2024-10-20 Thread Wolfgang Knauf 

OK, I see. Thanks for the clarification.

Is there any chance to improve the error message or detect this
situation? You wrote that this is a recommendation, and it worked with
the old version. But the exception does not point to anything helpful
for analysing this.

Best regards

Wolfgang


Am 20.10.24 um 11:02 schrieb Lukasz Lenart:

sob., 19 paź 2024 o 15:18 Wolfgang Knauf
 napisał(a):

I have a "index.jsp" and invoke an action using "s:action" tag, then render data from this action. 
In the browser I navigate to this jsp direcly ("http://localhost/index.jsp"; instead of browsing to 
".../index.action").


This is against our security recommendations and acceccing JSPs
directly won't be supported because in such case all the framework
guards are omitted
https://struts.apache.org/security/#never-expose-jsp-files-directly


Cheers
Łukasz

-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]




-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: Struts 7: error when "s:action" is used on jsp page and jsp is invoked directly in browser

2024-10-20 Thread Lukasz Lenart 
sob., 19 paź 2024 o 15:18 Wolfgang Knauf
 napisał(a):
> I have a "index.jsp" and invoke an action using "s:action" tag, then render 
> data from this action. In the browser I navigate to this jsp direcly 
> ("http://localhost/index.jsp"; instead of browsing to ".../index.action").

This is against our security recommendations and acceccing JSPs
directly won't be supported because in such case all the framework
guards are omitted
https://struts.apache.org/security/#never-expose-jsp-files-directly


Cheers
Łukasz

-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]