java - struts2 2.3.20 ognl allowStaticMethodAccess -
i updated project struts2 version 2.3.20 . cases in jsps uses static method access not work.
ie.
<s:set var="linkescaped" value="@org.apache.commons.lang.stringescapeutils@escapehtml(#attr.myobject.link)" />
i have set in struts.properties ->
struts.ognl.allowstaticmethodaccess=true
and tried in struts.xml ->
<constant name="struts.ognl.allowstaticmethodaccess" value="true"/>
with no success. know has changed , need enable them again?
update
lukasz lenart commented:
to clear, in context of 2.3.20 it's bug , temporally fixed, see issues.apache.org/jira/browse/ww-4429 2.5 access static methods dropped.
---
allowing static method access never preferred way of doing things , in 2.3.20
won't work if struts.ognl.allowstaticmethodaccess
set true
.
from wiki:
accessing static methods
in case still use static methods in expressions (setting
struts.ognl.allowstaticmethodaccess
true
) please aware won't work anymore internal security mechanism consider accessjava.lang.class
on excluded list of classes (see above). temporary solution copy abovestruts.xml
, removejava.lang.class
excluded classes.support accessing static methods expression disabled soon, please consider re-factoring application avoid further problems! please check ww-4348.
also ww-4429.
Comments
Post a Comment