Details
-
Improvement
-
Status: Open
-
Major
-
Resolution: Unresolved
-
V1Beta, v1m1
-
None
-
None
Description
Currently, the pageFlow and sharedFlow implicit objects are data bindable from a browser with:
{pageFlow.foo}
or
{sharedFlow.foo}This can lead to manipulation of values exposed from the pageFlow / sharedFlow to JSPs in ways that weren't intended. While this can be used to expose properties on a JPF as if the JPF itself was a form bean, it's often the case that a JPF needs to expose read-only data to a JSP that isn't web-writable.
The netui-config file and the expression language need to support preventing this type of expression-based update by allowing an app developer to constrain the list of writable implict objects.