Am 07.11.2014 um 16:34 schrieb Lukasz Lenart:
2014-11-07 16:27 GMT+01:00 Volker Krebs <[email protected]>:
Ok, it has to do with the acceptParamNames in ParametersInterceptor
I'll have the following config for my action:
<interceptor-ref name="params">
<param name="acceptParamNames">orderTimeID</param>
</interceptor-ref>
In my action I have a property named "orderinfo".
In 2.3.16.3 the ParametersInterceptor only set "orderTimeID".
Calls to "orderinfo" were blocked. This is what I was expecting, a pure
white list approach, block everything which is not "orderTimeID".
In 2.3.18 the ParametersInterceptor tried to set orderinfo. Only when
explicitly excluding it, everything worked as before.
<interceptor-ref name="params">
<param name="acceptParamNames">orderTimeID</param>
<param name="excludeParams">ordertime\..*</param>
</interceptor-ref>
Does it mean you have workaround but excluding params mechanism is
broken? As I understand you had to directly exclude orderinfo param?
Yes my workaround was to directly exclude orderinfo param.
I don't know if it is broken. But when the behavior of
<param name="acceptParamNames">param1</param>
should be to ignore every parameter but param1, then it's not working as
expected.
I'll try to make a simple example on monday to test it.
Have a nice weekend :)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
