This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts-site.git
The following commit(s) were added to refs/heads/main by this push:
new cf39ab70f WW-5713 docs: the Tiles OGNL prefix is disabled by default
(#339)
cf39ab70f is described below
commit cf39ab70f1692f5b4b8332dd503e35ecc50274d4
Author: Lukasz Lenart <[email protected]>
AuthorDate: Thu Sep 17 07:16:54 2026 +0200
WW-5713 docs: the Tiles OGNL prefix is disabled by default (#339)
Documents the fail-closed OGNL: expression language, the S2: migration
path and the per-application struts.tiles.ognl.legacy.enabled escape
hatch shipped in apache/struts#1890.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
source/plugins/tiles/index.md | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/source/plugins/tiles/index.md b/source/plugins/tiles/index.md
index 71b10a6c2..79fdc8551 100644
--- a/source/plugins/tiles/index.md
+++ b/source/plugins/tiles/index.md
@@ -131,6 +131,29 @@ you can use `I18N` prefix to evaluate provided expression
as a key in Struts res
</definition>
```
+### Legacy OGNL expressions
+
+The plugin also registers the `OGNL` prefix, which comes from Tiles itself.
Unlike `S2`, it evaluates the expression
+against the Tiles request rather than the `ValueStack`, and it does not pass
through the Struts OGNL controls — the
+member access policy, the allowlist and the expression guard that every other
OGNL evaluation in Struts goes through.
+
+As from Struts 7.4.0 the `OGNL` prefix is disabled by default. Evaluating an
`OGNL:` expression fails with an
+`EvaluationException` explaining that the evaluator is disabled, so a
definition that still relies on it is reported
+instead of rendering incorrectly. Migrate such expressions to `S2:`, which is
evaluated by Struts with the full set of OGNL
+controls, or to ordinary Tiles attributes.
+
+If a migration cannot be completed immediately, the previous behaviour can be
restored for the affected web
+application only:
+
+```xml
+<constant name="struts.tiles.ognl.legacy.enabled" value="true"/>
+```
+
+The constant is read from the Struts configuration of the web application that
owns the Tiles container, on the
+first `OGNL:` evaluation, and a warning is logged once when the legacy
evaluator is activated. Both the constant and
+the legacy evaluator are deprecated and will be removed in a future major
release, so treat the constant as a
+migration aid rather than a configuration option.
+
## Example
This example shows a Tiles layout page using Struts tags:
@@ -157,6 +180,10 @@ Please check
[tiles](https://github.com/apache/struts-examples/tree/main/tiles)
This plugin does inherit settings from [Tiles
configuration](https://tiles.apache.org/framework/config-reference.html).
+| Setting | Description | Default | Possible Values |
+|---------|-------------|---------|-----------------|
+| struts.tiles.ognl.legacy.enabled | Restores the legacy `OGNL` expression
prefix, which evaluates without the Struts OGNL controls. Deprecated, see
[Legacy OGNL expressions](#legacy-ognl-expressions). | false | true, false |
+
## Installation
This plugin can be installed by copying the plugin jar into your application's
`/WEB-INF/lib` directory.
