This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch WW-5626-cleanup in repository https://gitbox.apache.org/repos/asf/struts.git
commit f0f6840f7e4951fd34d854d1dcf84e9b6bd60c72 Author: Lukasz Lenart <[email protected]> AuthorDate: Mon May 4 12:48:07 2026 +0200 WW-5626 delegate ModelDriven target resolution to ParameterAuthorizer Replace the inline ValueStack peek in ParametersInterceptor#isParameterAnnotatedAndAllowlist with a call to ParameterAuthorizer#resolveTarget. The ModelDriven import is no longer needed in this class. --- .../struts2/interceptor/parameter/ParametersInterceptor.java | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java b/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java index 6173a85c6..5491b585f 100644 --- a/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java +++ b/core/src/main/java/org/apache/struts2/interceptor/parameter/ParametersInterceptor.java @@ -23,7 +23,6 @@ import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import org.apache.struts2.ActionContext; import org.apache.struts2.ActionInvocation; -import org.apache.struts2.ModelDriven; import org.apache.struts2.StrutsConstants; import org.apache.struts2.action.NoParameters; import org.apache.struts2.action.ParameterNameAware; @@ -369,14 +368,7 @@ public class ParametersInterceptor extends MethodFilterInterceptor { return true; } - // Resolve target for ModelDriven: if the ValueStack peek is different from the action, it's the model - Object target = action; - if (action instanceof ModelDriven<?>) { - Object stackTop = ActionContext.getContext().getValueStack().peek(); - if (!stackTop.equals(action)) { - target = stackTop; - } - } + Object target = parameterAuthorizer.resolveTarget(action); // Delegate authorization check to shared ParameterAuthorizer (no OGNL side effects) if (!parameterAuthorizer.isAuthorized(name, target, action)) {
