Cameron Braid wrote:
One problem that comes to mind with this approach is that if someone 'hacks' the request, specifying parameters that aren't meant to be coming in.
i.e - using your example
Public class CreateInvoiceAction extends ActionSupport { private Invoice invoice = new Invoice();
... } <input type="text" name="invoice.poNum" value="${invoice.poNum}"/> Calls getInvoice().setPoNum() to set the value.
If someone adds invoice.balance=0 to the http request, it will also be automatically set onto the domain object.
I have a technique that can avoid this, for actions that are using the JSP tag library to produce the forms.
It goes something like this :
A) in the taglibs, keep a list of the property names of each form field B) store this list in the session, against the form token for retrival on post C) when the form is posted, obtain this list of form fields D) the params interceptor only sets the properties defined in this list
This allows the form to define allowable properties to set on the target action, therby 'protecting' unwanted request params from affecting anything.
Cameron
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Carreira Sent: Wednesday, 17 September 2003 10:40 PM To: [EMAIL PROTECTED] Subject: RE: [OS-webwork] formbean vs. action
The fact that it's not a class built specifically for backing this form... Struts requires you to build form beans which extend an abstract base class. Here you're just using your same domain objects directly, without a mapping layer.
-----Original Message----- From: Anoop Ranganath [mailto:[EMAIL PROTECTED] Sent: Wednesday, September 17, 2003 8:29 AM To: [EMAIL PROTECTED] Subject: Re: [OS-webwork] formbean vs. action
If you're using domain objects or persisting the data, I
would suggest
you use Object properties. Say, for instance, that you have
an Invoice
domain object. You might have an CreateInvoiceAction Action class:
Ah. That's actually what I'm doing right now. So what makes
this any different than a Form Bean then? The fact that it's a POJO?
Anoop
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Opensymphony-webwork mailing list [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/opensymphony-webwork
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Opensymphony-webwork mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/opensymphony-webwork
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Opensymphony-webwork mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/opensymphony-webwork
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Opensymphony-webwork mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/opensymphony-webwork
