Hi,

Vidar Ramdal schrieb:
> On Mon, Feb 23, 2009 at 1:49 PM, Alexander Klimetschek <aklim...@day.com> 
> wrote:
>> On Mon, Feb 23, 2009 at 1:37 PM, Vidar Ramdal <vi...@idium.no> wrote:
>>> How about including resourceType as well when selecting a non-GET
>>> script? This would make the process more in line with GET script
>>> selection.
>> Not sure what you mean... The resource type is respected for all
>> cases. The samples Felix gave in his answer are all using a resource
>> type: he requested the resource /content/a which has the node type
>> nt:file, which leads to /libs/nt/file/POST.jsp or
>> /apps/nt/file/POST.jsp for the simple POST case.
>>
>> Similarly, if you'd set a resource type "sample/type" on the resource,
>> the POST script would be at /libs/sample/type/POST.jsp or
>> /apps/sample/type/POST.jsp. This has always worked in Sling that way.
> 
> Ah, sorry, I see that my message was confusing.
> What I mean is considering resourceType when posting NEW content. That
> would imply picking it up from the request params (the posted data),
> as you say below.
> 
> Let's say I have a script at /apps/test/something/POST.esp.
> Now, I POST some data to /testcontent:
> name: testcontent
> sling:resourceType: test/something
> 
> Because /testcontent did not already exist, the POST.esp script is not
> run. However, when I do the exact same request again, the script is
> invoked, producing a different result. This seems illogical to me.

That's kind of an inherent problem when accessing non-existing content ...

Your proposal would more be like an extension to SLING-864 [1]: If the
adressed resource does not exist, extract the sling:resourceType
parameter and use that as the resourceType ? Right.

Or maybe better: In case of a non-existing resource use the
sling:resourceType parameter as the value of the
Resource.getResourceSuperType() call.

This would allow handling of this request parameter, but would not break
existing code expecting non-existing resource to have the predefined
resource type "sling:nonexisting".

There is just one catch: Do we open up here for a security or
vulnerability issue ?

Regards
Felix

[1] https://issues.apache.org/jira/browse/SLING-864

> 
>>> I've had some cases where I want to post some content of a certain
>>> resourceType, to any location, while doing something special to the
>>> data being posted.
>>>
>>> The resourceType should be extracted from the fields being posted (if
>>> available), or from the already existing node (if it exists).
>> I don't think it is a good idea to let the resource type be defined in
>> the request. Inside Sling however, using include or forward, you can
>> override the resource type.
> 
> Yes, but you would have to implement that logic in a generic POST
> servlet/script, which would examine the resourceType field of the
> posted data, before forwarding.
> 

Reply via email to