public class RolesInterceptor extends AbstractInterceptor
When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...
There are three extensions to the existing interceptor:<!-- START SNIPPET: example --> <!-- only allows the admin and member roles --> <action name="someAction" class="com.examples.SomeAction"> <interceptor-ref name="completeStack"/> <interceptor-ref name="roles"> <param name="allowedRoles">admin,member</param> </interceptor-ref> <result name="success">good_result.ftl</result> </action> <!-- END SNIPPET: example -->
Modifier and Type | Field and Description |
---|---|
protected List<String> |
allowedRoles |
protected List<String> |
disallowedRoles |
Constructor and Description |
---|
RolesInterceptor() |
Modifier and Type | Method and Description |
---|---|
protected boolean |
areRolesValid(List<String> roles)
Extension point for sub-classes to test if configured roles are known valid roles.
|
protected String |
handleRejection(ActionInvocation invocation,
javax.servlet.http.HttpServletResponse response)
Handles a rejection by sending a 403 HTTP error
|
String |
intercept(ActionInvocation invocation) |
protected boolean |
isAllowed(javax.servlet.http.HttpServletRequest request,
Object action)
Determines if the request should be allowed for the action
|
void |
setAllowedRoles(String roles) |
void |
setDisallowedRoles(String roles) |
protected List<String> |
stringToList(String val)
Splits a string into a List
|
destroy, init
public void setAllowedRoles(String roles)
public void setDisallowedRoles(String roles)
public String intercept(ActionInvocation invocation) throws Exception
intercept
in interface Interceptor
intercept
in class AbstractInterceptor
Exception
protected boolean isAllowed(javax.servlet.http.HttpServletRequest request, Object action)
request
- The requestaction
- The action objectprotected String handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response) throws Exception
invocation
- The invocationException
protected boolean areRolesValid(List<String> roles)
roles
- allowed and disallowed rolesCopyright © 2000-2015 Apache Software Foundation. All Rights Reserved.