Thanks, the download works now.
Just as a small observation. I had quite a hard time to update the logic
to the breaking change in https://issues.apache.org/jira/browse/WW-5626.
Maybe it is just me, maybe it helps someone else:
If you have an Action extends ActionSupport that returns Json (using
Gson here), it is not sufficient to annotate the setter
@StrutsParameter(depth = 2) publicvoidsetContents(finalList<MyObject>
contents) { this.contents= contents; }
2026-06-30 17:47:40 WARN org.apache.struts2.json.JSONInterceptor - JSON
body parameter [contents[0].title] rejected by @StrutsParameter
authorization on [org
.your.NameOfTheAction]
You need also to annotate the getter
@StrutsParameter(depth = 2) publicList<MyObject> getContents() {
returncontents; }
Because the new security mechanism first seems to use getContents to
check, if there is permission to setContents. Also note that depth = 1
is not sufficent, despite that MyObject is a flat POJO. Not sure why
that is, probably because it is a List<MyObject>.
Maybe the documentation should be updated to make this clear. It does
not seem obvious at least to me, which admittedly doesn't mean much. ;-)
Best regards
Markus
Am 30.06.26 um 10:55 schrieb Łukasz Lenart:
wt., 30 cze 2026 o 10:52 info.flyingfischer.ch via dev
<[email protected]> napisał(a):
Hi Łukasz
the download link under
https://struts.apache.org/download.cgi#struts721
is
https://dlcdn.apache.org/struts/7.2.1/struts-7.2.1-all.zip
this gives a 404, independent of any browser mode. You may also check with
wgethttps://dlcdn.apache.org/struts/7.2.1/struts-7.2.1-all.zip
… 404 Not Found
Ah right! Forgot to push the packages into CDN, already done and it
should be available soon, sorry for that :)
Cheers
Łukasz
