Struts 2 Convention插件和WEB-INF下的JSP文件 [英] Struts 2 Convention Plugin and JSP files under WEB-INF

问题描述

使用Struts2 convention插件时，插件会自动将 hello-world.action 请求转发给 / WEB-INF / content / hello-world .jsp 即使没有定义 HelloWorld.java 。

When using Struts2 convention plugin, the plugin automatically forwards a hello-world.action request to /WEB-INF/content/hello-world.jsp even if no HelloWorld.java is defined.

请参阅 http://struts.apache.org/release/2.1.x/docs /convention-plugin.html 。

另一方面，我们将JSP文件放在WEB-INF下以避免任何直接访问JSP文件。

On the other hand, we put JSP files under WEB-INF to avoid any direct access to JSP files.

我认为约定插件的这种行为破坏了JSP访问策略。任何人都可以通过简单地调用a，动态构建，动作来直接访问JSP。

I think this behavior of convention plugin ruins JSP access policy. Any one can make a direct access to a JSP by simply calling a, build on the fly, action.

我是否正确？！如果是，我们可以禁用此功能吗？

Am I correct?! If yes, can we disable this feature?

推荐答案

不，你不太正确。如果页面位于 WEB-INF 下，则页面无法直接访问。约定插件按照约定从 Action 类创建额外的基于XML的配置。因此，您只能访问这些操作返回的结果。约定插件将其配置放在XWork包下，如文档和此答案中所述。因此，解决冲突，如果您未指定父包，则可能会发生冲突。您还可以使用约定注释来自定义生成的配置。默认情况下，约定插件扫描基本包下的类，可以是 struts 或 actions ，它们是可配置的并具有操作后缀。这些都是约定插件的默认配置。如果您想更改默认设置，可以在 struts.xml 中使用常量标记，或在 struts.properties 。

No, you are not quite correct. The pages have not direct access if they are under WEB-INF. The convention plugin creates additional to XML based configuration from the Action classes by convention. So, you have access only to results returned by those actions. The convention plugin places its configuration under the XWork package as described in the docs and this answer. So, resolving conflicts, which is possible if you don't specify a parent package. You can also use convention annotations to customize the generated configuration. The convention plugin by default scans for classes under the base package, which could be struts or actions that is configurable and have Action suffix. These are all default configuration for convention plugin. If you'd like to change the default settings you could use a constant tag in struts.xml or corresponding properties in struts.properties.

然而，文档并不清楚它是如何处理的

However, the documentation is not clear about how it handles

由URL标识的无动作结果

此外，还不清楚用于识别它的URL。我认为您已经熟悉无操作配置，您可以在不执行操作的情况下返回结果SUCCESS，因为默认情况下使用操作类。但是，问题甚至不在这里。约定插件以及它上面提到的配置也放置了一个未知的处理程序，它应该处理配置不存在的URL（即不是由约定创建的）。这是问题的根源。该插件也不允许替换/覆盖配置。令人高兴的是，有一个未知的处理程序管理器（可以在需要时替换）通过迭代unknown-handler-stack处理未知操作，该管理器由该管理器管理。使用处理程序堆栈，您可以配置迭代未知处理程序的顺序。注意，循环在处理程序返回动作配置时结束。这意味着如果您创建自己的未知处理程序并在堆栈中设置顺序，则可以绕过约定处理程序。

。

Also, is not clear what URL is used to identify it. I think you are already familiar with actionless configuration, where you can return result SUCCESS without action execution, because the action class is used by default. But, the problem even is not here. The convention plugin along with configuration it creates mentioned above also put an unknown handler which should handle URLs for which a configuration is not exist (i.e. not created by the convention). This is the source of the problem. The plugin also doesn't allow to replace/override the configuration. Happily, there's unknown handler manager (that could be replaced if needed) who is handled unknown actions via iteration of "unknown-handler-stack", that is managed by this manager. With the handler stack you could configure the order in which unknown handlers are iterated. Note, the loop ends when an action config is returned by the handler. This means if you create your own unknown handler and set the order in the stack then convention handler could be bypassed.
.

这篇关于Struts 2 Convention插件和WEB-INF下的JSP文件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！