public class RolesInterceptor extends AbstractInterceptor
This interceptor ensures that the action will only be executed if the user has the correct role.
Interceptor parameters:
When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...
There are three extensions to the existing interceptor:
<!-- START SNIPPET: example --> <!-- only allows the admin and member roles --> <action name="someAction" class="com.examples.SomeAction"> <interceptor-ref name="completeStack"/> <interceptor-ref name="roles"> <param name="allowedRoles">admin,member</param> </interceptor-ref> <result name="success">good_result.ftl</result> </action> <!-- END SNIPPET: example -->
ConditionalInterceptor.LegacyAdapter
Modifier and Type | Field and Description |
---|---|
protected List<String> |
allowedRoles |
protected List<String> |
disallowedRoles |
Constructor and Description |
---|
RolesInterceptor() |
Modifier and Type | Method and Description |
---|---|
protected boolean |
areRolesValid(List<String> roles)
Extension point for sub-classes to test if configured roles are known valid roles.
|
protected String |
handleRejection(ActionInvocation invocation,
javax.servlet.http.HttpServletResponse response)
Handles a rejection by sending a 403 HTTP error
|
String |
intercept(ActionInvocation invocation)
Override to handle interception
|
protected boolean |
isAllowed(javax.servlet.http.HttpServletRequest request,
Object action)
Determines if the request should be allowed for the action
|
void |
setAllowedRoles(String roles) |
void |
setDisallowedRoles(String roles) |
protected List<String> |
stringToList(String val)
Splits a string into a List
|
intercept, shouldIntercept, shouldIntercept
destroy, init, setDisabled
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
adapt
adapt
destroy, init
public void setAllowedRoles(String roles)
public void setDisallowedRoles(String roles)
public String intercept(ActionInvocation invocation) throws Exception
AbstractInterceptor
intercept
in class AbstractInterceptor
Exception
protected List<String> stringToList(String val)
val
- the string to splitprotected boolean isAllowed(javax.servlet.http.HttpServletRequest request, Object action)
request
- The requestaction
- The action objectprotected String handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response) throws Exception
invocation
- The invocationresponse
- the servlet response objectException
- in case of any errorprotected boolean areRolesValid(List<String> roles)
roles
- allowed and disallowed rolesCopyright © 2000–2024 Apache Software Foundation. All rights reserved.