限制对 Struts 2 中 URL 的访问

Question

Struts 2 中是否可以限制对某些 URL 的访问？我已经有了它，所以你不能直接访问jsp，但你可以间接访问它们。例如，如果我有一个 jsp“blah.jsp”，我可以通过键入“/blah”来访问它，如果我没有名为 Blah.java 的操作，它将自动转到结果 blah.jsp。大多数时候这是我想要的，但是有些jsp我不希望以这种方式访问​​，例如“blah-success.jsp”。有没有办法说，我无法导航到任何看起来像“/-success”的网址？

编辑： 我几乎可以正常工作了...

    <constant name="struts.enable.SlashesInActionNames" value="true"/>

<package name="my-secure-url" extends="my-secure" namespace="/secure**">
    <action name="*"> 
        <interceptor-ref name="secureStack"/>
        <result>{1}</result>
    </action> 
</package>

如果我尝试访问“/secure/anything/anything/etc”并且我没有登录，我就会被定向到登录页面。但是，如果我刚刚登录并且位于“http://localhost:8080/Struts2NewChapter8/ secure/admin-portfolio”，然后单击指向“http 的链接://localhost:8080/Struts2NewChapter8/secure/update/update-account-form” 我收到如下错误：

    WARNING: Error setting expression '0' with value '/secure/update'
    ognl.InappropriateExpressionException: Inappropriate OGNL expression: 0
at ognl.SimpleNode.setValueBody(SimpleNode.java:312)
at ognl.SimpleNode.evaluateSetValueBody(SimpleNode.java:220)
at ognl.SimpleNode.setValue(SimpleNode.java:301)
at ognl.Ognl.setValue(Ognl.java:737)
at com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:198)
at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:161)
at com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:149)
at com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:155)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:75)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:94)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:235)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:89)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:130)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at org.apache.struts2.interceptor.debugging.DebuggingInterceptor.intercept(DebuggingInterceptor.java:267)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:126)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:138)
at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:87)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:165)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:164)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:179)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:176)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at interceptors.AuthenticationInterceptor.intercept(AuthenticationInterceptor.java:92)
at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:237)
at org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:52)
at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:488)
at org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:77)
at org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:91)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
at java.lang.Thread.run(Unknown Source)

Answer 1

当然。 Struts 按照通配符映射在配置中出现的顺序进行匹配文件，因此与请求匹配的最后一个将是所使用的（即不太具体的匹配必须位于更具体的匹配之前）。

像这样的事情应该可以解决问题：

 <action name="*">
   <result>/WEB-INF/jsp/{1}.ftl</result>
 </action>  

 <action name="*-success">
   <result>/WEB-INF/jsp/access-denied.jsp</result>
 </action>  

上面的内容将保留您当前的行为，并导致名称中带有 -success 后缀的任何文件最终出现在 access-denied.jsp 处。

编辑：您需要启用此属性，以便在操作名称中包含斜杠：

<constant name="struts.enable.SlashesInActionNames" value="true"/>

为了使其成为有条件的，我将使用一个拦截器堆栈来检查用户是否已登录，然后再转发到 .jsp ：

 <action name="secure/*">
   <interceptor-ref name="authenticationStack"/>  
   <result>/WEB-INF/jsp/{1}.jsp</result>
 </action> 

在您的authenticationStack中，您需要一个拦截器来确定用户是否登录。如果没有，您将从拦截器内将它们转发到access-denied.jsp类型的页面。 有关拦截器的 Struts 文档 应该可以帮助您。