This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/struts-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 10e135608 Automatic Site Publish by Buildbot
10e135608 is described below
commit 10e1356088c8c880c42166acd95a4d95d71b6228
Author: buildbot <[email protected]>
AuthorDate: Wed Jul 29 07:05:26 2026 +0000
Automatic Site Publish by Buildbot
---
output/core-developers/chaining-interceptor.html | 25 ++++++++++++++++++++++++
output/core-developers/default-properties.html | 9 +++++++++
2 files changed, 34 insertions(+)
diff --git a/output/core-developers/chaining-interceptor.html
b/output/core-developers/chaining-interceptor.html
index 01682f93c..23a0ef8de 100644
--- a/output/core-developers/chaining-interceptor.html
+++ b/output/core-developers/chaining-interceptor.html
@@ -210,6 +210,31 @@ no properties are copied.</li>
<li>This is a <strong>global</strong> constant only — there is no
per-interceptor override.</li>
</ul>
+<h2 id="security-considerations">Security Considerations</h2>
+
+<p>Action chaining makes the data path into the target action implicit: the
target is populated
+from whatever happens to be on the value stack rather than from an explicit
call. Keep that in
+mind when designing chained actions:</p>
+
+<ul>
+ <li><strong>Do not carry authorization, trust, identity, or approval state
across a chain.</strong> Re-derive
+such state from the session or your security context inside the target action,
so it never
+depends on what a previous action left on the stack.</li>
+ <li><strong>Prefer avoiding chaining where practical.</strong> It couples
the two actions together and makes
+the target’s inputs harder to reason about; a shared service or an explicit
redirect is
+usually clearer.</li>
+ <li><strong>If chaining is required, narrow what is copied.</strong>
Implement
+<a
href="/maven/struts2-core/apidocs/org/apache/struts2/Unchainable">Unchainable</a>
on objects that must
+never be copied from, and use the interceptor’s <code
class="language-plaintext highlighter-rouge">includes</code> or <code
class="language-plaintext highlighter-rouge">excludes</code> parameters to limit
+the copied properties to the ones the target genuinely needs.</li>
+ <li><strong>Do not expose a public setter on the target action for state
that must not be settable from
+outside that action.</strong> Anything with a public setter is, by design,
part of the action’s
+input surface.</li>
+</ul>
+
+<p>See also <a
href="struts-parameter-annotation.html#where-authorization-applies">Where
authorization applies</a>
+for an overview of the channels that can populate an action.</p>
+
<h2 id="parameters">Parameters</h2>
<ul>
diff --git a/output/core-developers/default-properties.html
b/output/core-developers/default-properties.html
index 148170a28..8b3f4d106 100644
--- a/output/core-developers/default-properties.html
+++ b/output/core-developers/default-properties.html
@@ -235,7 +235,10 @@ struts.multipart.parser=jakarta
### Uses jakarta.servlet.context.tempdir by default
struts.multipart.saveDir=
struts.multipart.maxSize=2097152
+# Maximum number of uploaded files (files only, not form fields)
struts.multipart.maxFiles=256
+# Maximum number of non-file form fields (parameters)
+struts.multipart.maxParameterCount=256
struts.multipart.maxStringLength=4096
# struts.multipart.maxFileSize=
@@ -314,6 +317,12 @@ struts.mapper.action.prefix.crossNamespaces = false
### them right away.
struts.devMode = false
+### When set to true, a field's remaining validators are skipped once that
field
+### has a type conversion error, avoiding a duplicate error (WW-2934).
+### The field's own conversion validator still runs, so its message is still
shown.
+### valid values are: true, false (false is the default)
+struts.validators.skipValidatorsOnConversionError = false
+
### when set to true, resource bundles will be reloaded on _every_ request.
### this is good during development, but should never be used in production
# struts.i18n.reload=false
