[WW-2052] Don't set result jsp file in request parameter on redirect after POST

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.8
• Fix Version/s: 2.0.10, 2.1.0
• Component/s: Plugin - Portlet

Environment

JBoss Portal 2.6.0-CR3

• Assignee: Nils-Helge Garli
• Reporter: Hubert Grininger
• Created: 23/Jul/07 12:17
• Updated: 28/Oct/12 22:08
• Resolved: 24/Aug/07 09:22

Description

I have a form with method=POST.

After sending the form, Struts2 does a redirect after POST (which is fine), but the URL used for redirecting now contains the paramater location whose value is the full path of the JSP file, eg:

http://localhost:8080/portal/portal/default/MyPortletTutorial/MyPortletWindow?action=2&objectId=&struts.portlet.mode=view&location=%2FWEB-INF%2Fpages%2Fview%2FhelloWorld.jsp&struts.portlet.eventAction=true&struts.portlet.action=renderDirect

It's not a bug but the jsp file's name is a kind of "secret" information which I don't want to disclose to everybody.
Additionally this could be a security problem because now you can use the location property for selecting a JSP (I'm not quiete sure if this is a problem, but it doesn't sound comfortable ).