[ 
https://issues.apache.org/struts/browse/STR-3066?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Paul Benedict updated STR-3066:
-------------------------------

    Description: 
I have never come across one user mail or program code where people are 
retrieving values on cancellation. Is there any framework which allows this 
anyway? I categorize this as an irregular practice that should not be supported 
-- and the current situation is an oversight. The action is canceled, the form 
is part of the action, and so the form has no job which is very much implied by 
the canceling of validation.

The main issue at hand is that a developer may mistakenly believe all form data 
is always validated. If a form is configured for validation, and the submission 
goes through "canceled", the form is still populated. The guarantee for 
validated data, however, is absent. 

Due to backwards compatibility concern, I recommend one of two solutions
1) A skipPopulationOnCancel property on AbstractPopulateForm
2) Rework STR-286 to include a populate cancel option.

  was:
If the action mapping does not contain a form bean name, e.g.:

<action path="/this/action"
        type="action.class.name"/>

using isCancelled() in that action will always return false.  The code in 
org.apache.struts.action.RequestProcessor.processPopulate returns if the form 
is null before setting the Globals.CANCEL_KEY attribute.  

It seems to me that since a request parameter is used to detect the cancel 
button (the return request.getParameter(Constants.CANCEL_KEY) != null line), 
the setting of the request attribute should not depend on whether the action 
mapping uses a form.

       Reporter: Paul Benedict  (was: Patrick Dumontel)
     Issue Type: Improvement  (was: Bug)
        Summary: Cancellation to prevent form population  (was: Cancellation 
can prevent form population)

> Cancellation to prevent form population
> ---------------------------------------
>
>                 Key: STR-3066
>                 URL: https://issues.apache.org/struts/browse/STR-3066
>             Project: Struts 1
>          Issue Type: Improvement
>          Components: Core
>    Affects Versions: 1.1 Final
>         Environment: Operating System: All
> Platform: All
>            Reporter: Paul Benedict
>            Assignee: Paul Benedict
>             Fix For: 1.4.0
>
>
> I have never come across one user mail or program code where people are 
> retrieving values on cancellation. Is there any framework which allows this 
> anyway? I categorize this as an irregular practice that should not be 
> supported -- and the current situation is an oversight. The action is 
> canceled, the form is part of the action, and so the form has no job which is 
> very much implied by the canceling of validation.
> The main issue at hand is that a developer may mistakenly believe all form 
> data is always validated. If a form is configured for validation, and the 
> submission goes through "canceled", the form is still populated. The 
> guarantee for validated data, however, is absent. 
> Due to backwards compatibility concern, I recommend one of two solutions
> 1) A skipPopulationOnCancel property on AbstractPopulateForm
> 2) Rework STR-286 to include a populate cancel option.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

Reply via email to