[
https://issues.apache.org/jira/browse/WW-5786?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart reassigned WW-5786:
---------------------------------
Assignee: Lukasz Lenart
> Verify HTTP method restrictions for Convention plugin actions
> -------------------------------------------------------------
>
> Key: WW-5786
> URL: https://issues.apache.org/jira/browse/WW-5786
> Project: Struts 2
> Issue Type: Task
> Components: Plugin - Convention
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
>
> Follow-up to WW-3717, which adds an {{http-method}} attribute to {{<action>}}
> in {{struts.xml}}, enforced by {{HttpMethodInterceptor}}, with a 405 response
> (and an {{Allow}} header) when no {{bad-request}} result is mapped.
> Actions discovered by the Convention plugin have no XML declaration, so they
> cannot use the new attribute. The expectation is that they are already
> covered by the existing annotations ({{@HttpGet}}, {{@HttpPost}},
> {{@HttpPut}}, {{@HttpDelete}}, {{@HttpGetOrPost}}, {{@AllowedHttpMethod}}) on
> the action class or method.
> Verify this and pick one outcome:
> * *Covered:* add tests in the Convention plugin that pin it: an annotated
> Convention action (class-level and method-level, including an
> {{@Action}}-mapped method) rejects a disallowed method with the mapped
> {{bad-request}} result, or with 405 + {{Allow}} when none is mapped, and
> accepts an allowed one.
> * *Gap confirmed:* document what is missing (for example, a case the
> annotations cannot express for Convention actions) and open a New Feature
> ticket at 8.0.0 for an {{@Action(httpMethod = ...)}} style attribute, linking
> it here.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
