在Struts 2中限制對URL的訪問

Question

是否可以限制對Struts 2中某些URL的訪問？我已經有了它，所以你不能直接訪問jsp，但是你可以間接訪問它們。例如，如果我有一個jsp「blah.jsp」，則可以通過鍵入「/ blah」來訪問它，如果我沒有一個名爲Blah.java的Action，它將自動轉到結果blah.jsp。大多數情況下，這是我想要的，但會有一些jsps，我不想以這種方式訪問​​，如「blah-success.jsp」。有沒有辦法說，我不能導航到任何看起來像「/ -success」的網址？

編輯： 我幾乎都有它的工作...

<constant name="struts.enable.SlashesInActionNames" value="true"/> 

<package name="my-secure-url" extends="my-secure" namespace="/secure**"> 
    <action name="*"> 
     <interceptor-ref name="secureStack"/> 
     <result>{1}</result> 
    </action> 
</package> 

這工作，如果我嘗試訪問「/安全/什麼/什麼/ etc」而我沒有登錄，我得到指示到登錄頁面。但是，如果我只是登錄和我在「http://localhost:8080/Struts2NewChapter8/secure/admin-portfolio」和我點擊一個鏈接到「http://localhost:8080/Struts2NewChapter8/secure/update/update-account-form」我得到的是這樣的錯誤：

WARNING: Error setting expression '0' with value '/secure/update' 
    ognl.InappropriateExpressionException: Inappropriate OGNL expression: 0 
at ognl.SimpleNode.setValueBody(SimpleNode.java:312) 
at ognl.SimpleNode.evaluateSetValueBody(SimpleNode.java:220) 
at ognl.SimpleNode.setValue(SimpleNode.java:301) 
at ognl.Ognl.setValue(Ognl.java:737) 
at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:198) 
at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:161) 
at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:149) 
at com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:155) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:75) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:94) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:235) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:89) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:130) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at org.apache.struts2.interceptor.debugging.DebuggingInterceptor.intercept(DebuggingInterceptor.java:267) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:126) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:138) 
at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:87) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at com.opensymphony.xwork2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:165) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:164) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:179) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:176) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at interceptors.AuthenticationInterceptor.intercept(AuthenticationInterceptor.java:92) 
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237) 
at org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:52) 
at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:488) 
at org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:77) 
at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:91) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) 
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) 
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) 
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) 
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) 
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) 
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) 
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849) 
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) 
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454) 
at java.lang.Thread.run(Unknown Source) 

Answer 1

當然不過。 Struts按照它們在您的配置文件中出現的順序匹配wildcard mappings，因此與請求匹配的最後一個將是使用的那個（即，較少特定的匹配必須在更具體的匹配之前）。

像這樣的東西應該做的伎倆：

<action name="*"> 
    <result>/WEB-INF/jsp/{1}.ftl</result> 
</action> 

<action name="*-success"> 
    <result>/WEB-INF/jsp/access-denied.jsp</result> 
</action> 

以上將保持當前的行爲，並導致與-success後綴的任何文件的名稱在訪問denied.jsp結束了。

編輯：您需要啓用此屬性將有斜槓在您的操作名稱：

<constant name="struts.enable.SlashesInActionNames" value="true"/> 

爲了讓有條件的，我會使用檢查，如果用戶正在登錄的攔截器棧轉發到.JSP前：

<action name="secure/*"> 
    <interceptor-ref name="authenticationStack"/> 
    <result>/WEB-INF/jsp/{1}.jsp</result> 
</action> 

在你authenticationStack你需要確定用戶是否登錄的攔截器。如果不是你們想從interc內將其轉發給接入denied.jsp類型的頁面。 eptor。 Struts docs on Interceptors應該幫助你。