|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectcom.opensymphony.xwork2.interceptor.AbstractInterceptor
org.apache.struts2.interceptor.RolesInterceptor
public class RolesInterceptor
This interceptor ensures that the action will only be executed if the user has the correct role.
Interceptor parameters:When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...
There are three extensions to the existing interceptor:<!-- START SNIPPET: example --> <!-- only allows the admin and member roles --> <action name="someAction" class="com.examples.SomeAction"> <interceptor-ref name="completeStack"/> <interceptor-ref name="roles"> <param name="allowedRoles">admin,member</param> </interceptor-ref> <result name="success">good_result.ftl</result> </action> <!-- END SNIPPET: example -->
Field Summary | |
---|---|
protected List<String> |
allowedRoles
|
protected List<String> |
disallowedRoles
|
Constructor Summary | |
---|---|
RolesInterceptor()
|
Method Summary | |
---|---|
protected boolean |
areRolesValid(List<String> roles)
Extension point for sub-classes to test if configured roles are known valid roles. |
protected String |
handleRejection(ActionInvocation invocation,
javax.servlet.http.HttpServletResponse response)
Handles a rejection by sending a 403 HTTP error |
String |
intercept(ActionInvocation invocation)
|
protected boolean |
isAllowed(javax.servlet.http.HttpServletRequest request,
Object action)
Determines if the request should be allowed for the action |
void |
setAllowedRoles(String roles)
|
void |
setDisallowedRoles(String roles)
|
protected List<String> |
stringToList(String val)
Splits a string into a List |
Methods inherited from class com.opensymphony.xwork2.interceptor.AbstractInterceptor |
---|
destroy, init |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Field Detail |
---|
protected List<String> allowedRoles
protected List<String> disallowedRoles
Constructor Detail |
---|
public RolesInterceptor()
Method Detail |
---|
public void setAllowedRoles(String roles)
public void setDisallowedRoles(String roles)
public String intercept(ActionInvocation invocation) throws Exception
intercept
in interface Interceptor
intercept
in class AbstractInterceptor
Exception
protected List<String> stringToList(String val)
protected boolean isAllowed(javax.servlet.http.HttpServletRequest request, Object action)
request
- The requestaction
- The action object
protected String handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response) throws Exception
invocation
- The invocation
Exception
protected boolean areRolesValid(List<String> roles)
roles
- allowed and disallowed roles
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |