Use of spring security jstl tag <sec:authority access="hasPermission(#domain, 'permission')> inside a jstl core loop - spring

I'm using facelets (JSF2.1) and I'm trying to do something like:
<c:forEach var="domainObject" items="#{MB.listOfDomainObjects}">
<sec:authorize access="hasPermission(#domainObject,'PERMISSION_X')">
hello world
</sec:authorize>
</c:forEach>
I've tried changing #domainObject by #domainObject, #{domainObject}, $domainObject and a lot of other combinations with the same result: domainObject is not processed correctly. Sometimes I get an error saying the page cannot be constructed, others domainObject is null.
It's like the scope where the tag c:forEach puts the variable domainObject is not scanned by sec:authorize to find it.
I've tried also to force the use of a scope using the tag <c:set ... scope="view"/>. I've also tried to use <ui:repeat> with the same results, but considering the tag sec:authorize is a jstl one, I suppose is executed in build time (like c:forEach) and not in render time (like ui:repeat), so I think I must use c:foreach and not ui:repeat.
Any chance to solve my problem?

Related

In MVC passing a list from JSP to the Controller

I'm trying to get an example of passing a list from JSP to the Controller to work:
http://viralpatel.net/blogs/spring-mvc-multi-row-submit-java-list/
the problem I have with this example is that I do not get the JSP /WebContent/WEB-INF/jsp/add_contact.jsp to work. He has the line:
<c:foreach items="${contactForm.contacts}" var="contact" varstatus="status">
and i'm getting errors with the varstatus variable. From where is he getting the values for this variable? He is using it as a list row index, but from where should the values come? I get the warning in eclipse that it is a not defined variable varstatus and if i still deploy it to tomcat, then i get the error that jstl foreach tag does not support more than one variable (as i already have the contact there).
The forEach tag and attributes are case sensitive.
<c:forEach items="${contactForm.contacts}" var="contact" varStatus="status">
<c:out value="${status.index}" />: <c:out value="${contact}" />
</c:forEach>
It's possible the error messages generated by Eclipse are misleading. It's also possible the error is originating from somewhere else on the page. If this does not resolve the problem, post the full JSP and stacktrace for better understanding.

Cannot access variable inside the included JSP

I am using Spring 2.5 in my application. In the view I have main jsp in which I have included another jsp. I have declared a variable using c:set tag in main jsp which I can not access inside the jsp. Below is code
main.jsp
<c:set var="hPediquestStudy"><spring:message code="study.hpediquest.mapping" /></c:set>
<c:set var="currentStudy" value='<%=(String)session.getAttribute("currentStudy")%>'/>
<html>
<head>
</head>
<body>
<c:if test="${currentStudy eq hPediquestStudy}">
Variables are equal
</c:if>
<c:if test="${currentStudy ne hPediquestStudy}">
Variables are not equal
</c:if>
<jsp:include page="/WEB-INF/jsp/included.jsp"></jsp:include>
</body
</html>
included.jsp
<c:if test="${currentStudy eq hPediquestStudy}">
hPediquestStudy Variable is accessible
</c:if>
<br/>currentStudy : ${currentStudy}
<br/>hPediquestStudy : ${hPediquestStudy}
I am getting output
Variables are equal
currentStudy : hPediquest
hPediquestStudy :
Why on main jsp both values are equal while in included jsp I dont see its value?
Why currentStudy displays its value inside the included jsp?
is there any solution which helps me to access the variable set in the parent jsp ans can be accessed in the included jsps?
I can see the value of hPediquestStudy value if I set that variable in included jsp like in main jsp. But I dont want to set it every time when I include the jsp. Please help
Why on main jsp both values are equal while in included jsp I dont see its value?
Because <c:set> by default stores them in the page scope.
Why currentStudy displays its value inside the included jsp?
Because it's available as session attribute as well.
is there any solution which helps me to access the variable set in the parent jsp ans can be accessed in the included jsps?
You need to set the scope attribute of <c:set> to request or above. The (default) page scope is exposed to current JSP only, not any included JSPs.
Note that the line
<c:set var="currentStudy" value='<%=(String)session.getAttribute("currentStudy")%>'/>
is unnecessary. The ${currentStudy} will already scan for variables in page, request, session and application scopes. As you've apparently already set it in the session scope, you don't need to copy it into the page scope. So, just remove that line. All with all, your top 2 <c:set> lines should be replaced with this single line:
<c:set var="hPediquestStudy" scope="request"><spring:message code="study.hpediquest.mapping" /></c:set>
and then it'll work the way you intended.
See also:
Our EL wiki page

What might be causing this IllegalStateException discrepancy in JSP/Spring?

I had a JSP file with a c:redirect tag that would forward along a user to another page.
<!-- Yes, I know this loop is probably unnecessary, but I'm not fluent in jsp and have determined it is not the problem. :) -->
<c:if test="${cmd.numberOfResults == 1}">
<c:forEach items="${cmd.matches}" var="someVar">
<c:redirect url="/loadThatResultInfo.html"/>
</c:forEach>
</c:if>
The old implementation of the command object is needs updating (where I come in). The way I'm doing so is by creating a generic "search result" object which contains an instance of that old object (for now). I get that instance through a property in that generic class, so my code is now this:
<c:if test="${cmd.genericSearchObject.numberOfResults == 1}">
<c:forEach items="${cmd.genericSearchObject.matches}" var="acct">
<jsp:forward page="/loadThatResultInfo.html"/> <!-- new try! -->
<c:redirect url="/loadThatResultInfo.html"/> <!-- old try... -->
<% response.sendRedirect("/loadThatResultInfo.html"); %> <! new try! -->
</c:forEach>
</c:if>
Each of those three tries all result in IllegalStateExceptions of some sort. Why does this change cause the exception, especially considering that the lines involved -- the redirect, not the changed/bound class instances -- are causing the problem?
Back-end changes were made accordingly, referencing the property within my new encompassing "generic" class to satisfy the old functionality. I know this works because all related functionality, beside what I'm writing about, works.
Research online indicates:
- I can't redirect/forward after a submission has already been submitted. Then how was I able to do it before?
- Attempt to flush an already-cleared buffer causes this. What changed that makes it cleared now as opposed to the older (first) implementation?
- The size of the page's buffer needs to be bigger. THIS is one I don't understand and would really love for the stackoverflow community to address; I can see my new class causing size changes that would need changes to be dealt with.
------- ANOTHER ANSWER! -------
First and foremost, ALWAYS SET UP THE SITUATION IN THE CODE as described by the marked answer. However... if you're stuck and don't want to do that, here's a quick fix: javascript!
<script type="text/javascript">
location='./yourPageToGoTo.html'
</script>
JSP is part of the response. You're attempting to change the response destination in a JSP instead of in a controller. If you do this halfway in a JSP, then it's too late, because the HTTP response headers may already have been sent (the response is then in committed state). This is a point of no return and an illegal state for changing the response. It's too late then. Any attempt will result in the servletcontainer to throw IllegalStateException: response already committed.
To fix this, you need to put this piece code in the very top of JSP file and pray that the response hasn't already been committed at that point (which will usually happen after writing about 2KB of data to the response, depending on the servletcontainer config). However, JSP is still the wrong place for the job, you should rather do this in the controller, before forwarding the response to the JSP (or to instruct from within the model the controller somehow to do the job, when you're using a MVC framework).

Struts2 ognl execute request method

I'm trying to use OGNL to evaluate if the session is valid, in order to show some information. For that I've the following JSP
[...]
<s:if test="request.isRequestedSessionValid()">
[...] (show user name, etc)
</s:if>
But it doesn't work. I've also tried "#request.isRequestedSessionValid()","%{request.isRequestedSessionValid()}" and "{request.isRequestedSessionValid()}", but I always get an error message target java.lang.NullPointerException: target is null for method isRequestedSessionValid or [OgnlValueStack] Could not find method [#request.isRequestedSessionValid()]. What am I doing wrong?
Thanks!
Okay, now that I've had a chance to look deeper into this I am tossing out my old answer. #request won't work because that is basically the equivalent of the JSP EL expression ${requestScope.requestedSessionIdValid}, but that property isn't a request scope property, its an actual property of the HttpServletRequest.
You can do this easily with JSP EL using:
<c:if test="${pageContext.request.requestedSessionIdValid}">
...
</c:if>
I don't know that there is an equally concise way to get at this with OGNL.

how spring mvc tag works?

I am trying to write some kind of raw html to mimic what spring mvc tag produces after page rendering(and I do make them look exactly the same if you open them with a html element inspector). as I want to create dynamic input form using javascript. but it didn't work. it seems I had to use only what it offers: e.g. <form:input path="firstName" />.
to get the data binding working.
I thought the tag lib only help you to produce a html block that spring knows how to handle them in backend (action). from a web http perspective. what else it can send beyond a bunch of form data, and they should send the same thing. so I am really curious to learn what magic thing the tag lib dose beyond producing a html block.
the other thing I would like to know is where the model object is being hold when the form is being submit to a matched action. you know, you can get the model attribute by using #modelAttribute as the input parameter. is it in the original request object? or in the ActionRequest to which the dispatcherServlet build and put it. or even somewhere else?
thanks in advance.
I got it figured out. the raw html just works as spring tag does. as long as you are in the form tag block. you are okay to use raw html such as
<input type="text" id="abc" name="abc"/> just make sure name reflect your bean attribute path.
id is not mandatory and is just helping you to identify the very element. I guess I missed something when I work with the raw html by the time I ask the question. hope this helps for guys working with raw html approach, especially in case of dynamic input creation.

Resources