[WW-3129] struts.enable.DynamicMethodInvocation=false still allows to call methods dynamically

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.6
• Component/s: Core Actions

Environment

WinXP, Struts 2.1.6, JDK 1.6.0_12

• Assignee: Wes Wannemacher
• Reporter: fako
• Created: 15/May/09 23:46
• Updated: 31/May/09 01:42
• Resolved: 29/May/09 20:16

Description

In Struts2 documentation:

struts.enable.DynamicMethodInvocation:

1. 1. 1. Set this to false if you wish to disable implicit dynamic method invocation
      2. via the URL request. This includes URLs like foo!bar.action, as well as params
      3. like method:bar (but not action:foo).

If i set to false, i still can invoke methods dynamically with method: prefix
http://localhost:8080/struts/Calculator?method:toString
Result: No result defined for action testapp.struts.action.CalculatorAction and result testapp.struts.action.CalculatorAction@1dafbaf

Invoking http://localhost:8080/struts/Calculator!toString.action works as intended:
Result: There is no Action mapped for namespace / and action name Calculator!toString

Issue Links

• relates to: WW-3042 Backward incompatible changes in 2.1.7