You are correct, this is a bug. Please enter an issue in JIRA. http://issues.appfuse.org/browse/APF
Thanks, Matt On Fri, Oct 24, 2008 at 5:08 AM, Alex Coles <[EMAIL PROTECTED]> wrote: > Looking at the following lines of security.xml, I am thinking the > comment should read "OK to remove line above"? > > <intercept-url pattern="/a4j.res/*.html*" > access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/> > <!-- APF-737, OK to remove line below if you're not using JSF --> > <intercept-url pattern="/**/*.html*" access="ROLE_ADMIN,ROLE_USER"/> > > I am using Struts 2. I do not use/need the Ajax4JSF (a4j) support. > Removing the intercept /**/*.html breaks gives unauthenticated users > access to non-admin parts of my application. > > Alex > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
