1 Mar 2005 01:21
Re: 3.1: Declarative Security Issue
Erik Hatcher <erik <at> ehatchersolutions.com>
2005-03-01 00:21:54 GMT
2005-03-01 00:21:54 GMT
This actually brings up a good reason why maybe Tapestry should be driven by a filter instead of a servlet. Filters, as of Servlet 2.4, be specified to apply to FORWARD, REQUEST, or INCLUDE. You could then organize the main Tapestry entry point to only respond to FORWARD and the URL mapping filter to apply to REQUEST. Any reasons why this wouldn't work? Erik On Feb 28, 2005, at 5:34 PM, Paul Ferraro wrote: > This is exactly why I did not base my friendly url implementation on > servlet filters... > The web.xml files for my friendly url applications do not include a > servlet mapping for /app - only extension (i.e. *.something) mappings > for each type of service. > > Paul > > Howard Lewis Ship wrote: > >> I just had a thought. >> >> Say you require admin role to access the "/admin" folder of your app. >> >> You create a admin/DeleteUser page and think "only admins can access >> this". >> >> Along comes a hacker with knowledge of Tapestry, and types in the URL: >>(Continue reading)
RSS Feed