czw., 23 sty 2025 o 22:37 Heikki Hyyrö <heikki.hy...@tuni.fi> napisał(a): > > Dear all, > > I am having somewhat similar problems after upgrading from 6.3.0.2 to > 7.0.0. It has become very difficult to refer to variables inside JSP code! > > The first symptom I inspected was quite identical to Murali's problem: > referring to an attribute via the iterator variable name does not seem > to work, but referring to the attribute only does work. E.g. a loop of form > > <s:iterator value="subjects" var="subject"> > <h2><s:property value="#subject.name" /></h2> > <%-- a whole lot of other stuff --%> > </s:iterator> > > does not show the values subject.name in 7.0.0 whereas in 6.3.0.2 it > does. The names show up if I refer to the name without the object > reference in the form <s:property value="name" />. > > While investigating this I noted that even the set-tag example snippet > from Struts documentation no longer works? If I embed the following lines > > X > <s:set var="janesName">Jane Doe</s:set> > <s:property value="#janesName"/> > Y > > inside a JSP page, the result is only "X Y" in 7.0.0 but the whole > expected "X Jane Doe Y" in 6.3.0.2. Here I added the X and Y just to > verify that that part of the page is processed in the first place.
Did you read through the Migration guide? It looks like one of the security factors blocks executions of your expression https://cwiki.apache.org/confluence/display/WW/Struts+6.x.x+to+7.x.x+migration#Struts6.x.xto7.x.xmigration-Strongersecurity Take a look on the allowlist capability https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=293046977#Struts6.x.xto7.x.xmigration-OGNLallowlistcapability Cheers Łukasz --------------------------------------------------------------------- To unsubscribe, e-mail: user-unsubscr...@struts.apache.org For additional commands, e-mail: user-h...@struts.apache.org
