Re: [ANN] Apache Struts 7.2.1

--------------0apTtQKrSK9s3Ozv0Kqhnlg8
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Thanks, the download works now.

Just as a small observation. I had quite a hard time to update the logic 
to the breaking change in https://issues.apache.org/jira/browse/WW-5626. 
Maybe it is just me, maybe it helps someone else:


If you have an Action extends ActionSupport that returns Json (using 
Gson here), it is not sufficient to annotate the setter

@StrutsParameter(depth = 2) publicvoidsetContents(finalList<MyObject> 
contents) { this.contents= contents; }


2026-06-30 17:47:40 WARN org.apache.struts2.json.JSONInterceptor - JSON 
body parameter [contents[0].title] rejected by @StrutsParameter 
authorization on [org
.your.NameOfTheAction]

You need also to annotate the getter

@StrutsParameter(depth = 2) publicList<MyObject> getContents() { 
returncontents; }

Because the new security mechanism first seems to use getContents to 
check, if there is permission to setContents. Also note that depth = 1 
is not sufficent, despite that MyObject is a flat POJO. Not sure why 
that is, probably because it is a List<MyObject>.

Maybe the documentation should be updated to make this clear. It does 
not seem obvious at least to me, which admittedly doesn't mean much. ;-)

Best regards
Markus


Am 30.06.26 um 10:55 schrieb Łukasz Lenart:
> wt., 30 cze 2026 o 10:52 info.flyingfischer.ch via dev
> <[email protected]> napisał(a):
>> Hi Łukasz
>>
>> the download link under
>>
>> https://struts.apache.org/download.cgi#struts721
>>
>> is
>>
>> https://dlcdn.apache.org/struts/7.2.1/struts-7.2.1-all.zip
>>
>> this gives a 404, independent of any browser mode. You may also check with
>>
>> wgethttps://dlcdn.apache.org/struts/7.2.1/struts-7.2.1-all.zip
>>
>> … 404 Not Found
> Ah right! Forgot to push the packages into CDN, already done and it
> should be available soon, sorry for that :)
>
>
> Cheers
> Łukasz
--------------0apTtQKrSK9s3Ozv0Kqhnlg8--