Hey Andy, > > > I believe you are correct - ie. the doc is not accurate. Looking at > RequestContextBean.java, it seems that the following properties cannot > be EL-bound: > ...
> I think we should mark this as not-bindable and > update the doc accordingly. However, I do not buy Matthias argument that this is due to security reasons - if some intruder gets access to managed-beans, we are hosed anyways. I think, from a perspective servicing the user, it would be a good thing if the admin could enable debug-output on the fly for an application/user-session. regards, Martin
