This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/struts-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new f10d04c9fd Updates stage by Jenkins
f10d04c9fd is described below
commit f10d04c9fd09a5ed37e35171b936c2976bb599eb
Author: jenkins <[email protected]>
AuthorDate: Sun Nov 8 17:45:26 2026 +0000
Updates stage by Jenkins
---
content/core-developers/action-configuration.html | 23 +++++++++++++--
content/plugins/bean-validation/index.html | 5 ++++
content/plugins/rest/index.html | 36 ++++++++++++++++++++++-
content/release-guidelines.html | 8 ++++-
4 files changed, 68 insertions(+), 4 deletions(-)
diff --git a/content/core-developers/action-configuration.html
b/content/core-developers/action-configuration.html
index 353d2d4f4e..eec3be0027 100644
--- a/content/core-developers/action-configuration.html
+++ b/content/core-developers/action-configuration.html
@@ -529,13 +529,32 @@ to <code class="language-plaintext
highlighter-rouge"><allowed-methods></c
Actions matched by a wildcard or regex pattern keep the restriction declared
on the pattern.</p>
<p>The restriction is enforced by the <code class="language-plaintext
highlighter-rouge">httpMethod</code> interceptor, which is part of <code
class="language-plaintext highlighter-rouge">basicStack</code>, <code
class="language-plaintext highlighter-rouge">defaultStack</code>,
-<code class="language-plaintext
highlighter-rouge">paramsPrepareParamsStack</code> and the stacks built on
them. If an action declares <code class="language-plaintext
highlighter-rouge">http-method</code> but its interceptors do
-not include <code class="language-plaintext
highlighter-rouge">httpMethod</code>, a warning is logged at startup and the
restriction is not enforced.</p>
+<code class="language-plaintext
highlighter-rouge">paramsPrepareParamsStack</code> and the stacks built on
them, as well as the <a href="../plugins/rest">REST Plugin</a>’s
+<code class="language-plaintext highlighter-rouge">restDefaultStack</code> and
the <a href="../plugins/bean-validation">Bean Validation Plugin</a>’s <code
class="language-plaintext highlighter-rouge">beanValidationDefaultStack</code>.
+If an action declares <code class="language-plaintext
highlighter-rouge">http-method</code> but its interceptors do not include <code
class="language-plaintext highlighter-rouge">httpMethod</code>, a warning is
logged at startup
+and the restriction is not enforced.</p>
<p>The same interceptor enforces the <code class="language-plaintext
highlighter-rouge">@AllowedHttpMethod</code>, <code class="language-plaintext
highlighter-rouge">@HttpGet</code>, <code class="language-plaintext
highlighter-rouge">@HttpPost</code>, <code class="language-plaintext
highlighter-rouge">@HttpPut</code>, <code class="language-plaintext
highlighter-rouge">@HttpDelete</code> and
<code class="language-plaintext highlighter-rouge">@HttpGetOrPost</code>
annotations on the action class or method. When both the attribute and an
annotation apply,
the request method must be allowed by both.</p>
+<p>Annotations are resolved as follows:</p>
+
+<ul>
+ <li>A method-level annotation applies to the action method the request
invokes, including the implicit <code class="language-plaintext
highlighter-rouge">execute()</code>
+when the mapping names no method.</li>
+ <li>An annotation on the invoked method itself takes precedence. Otherwise
the interceptor looks for the same method
+declared on a superclass or on an implemented interface, including interfaces
those extend, and uses the first
+annotated declaration it finds. Only public instance methods count, so a
private, static or package-private
+method of the same name on a parent class carries no restriction.</li>
+ <li>Class-level annotations are consulted only when no method-level
annotation applies. They are looked up on the
+action class, its superclasses and their interfaces in the same way.</li>
+</ul>
+
+<p>The interceptor compares the HTTP method of the request as the container
reports it. The <code class="language-plaintext
highlighter-rouge">_method</code> parameter the
+REST plugin uses to route a POST form to <code class="language-plaintext
highlighter-rouge">update</code> or <code class="language-plaintext
highlighter-rouge">destroy</code> does not change it, see
+<a href="../plugins/rest#http-method-restrictions-in-restdefaultstack">HTTP
method restrictions in restDefaultStack</a>.</p>
+
<h3 id="rejected-requests">Rejected requests</h3>
<p>When the request method is not allowed, the interceptor returns the <code
class="language-plaintext highlighter-rouge">bad-request</code> result if it
can be resolved:
diff --git a/content/plugins/bean-validation/index.html
b/content/plugins/bean-validation/index.html
index d116c0f17e..21aba5b7ce 100644
--- a/content/plugins/bean-validation/index.html
+++ b/content/plugins/bean-validation/index.html
@@ -217,6 +217,11 @@ use a method other than GET and are not navigations are
now rejected: the action
returns the result code <code class="language-plaintext
highlighter-rouge">403</code>, which needs a matching (global) result to render
a response. Set
<code class="language-plaintext
highlighter-rouge">fetchMetadata.disabled</code> to <code
class="language-plaintext highlighter-rouge">true</code> on the stack for
actions that must accept such requests.</p>
+<p>Since Struts 7.5.0 <code class="language-plaintext
highlighter-rouge">beanValidationDefaultStack</code> also contains the <code
class="language-plaintext highlighter-rouge">httpMethod</code> interceptor,
placed after
+<code class="language-plaintext highlighter-rouge">servletConfig</code> as in
core’s <code class="language-plaintext highlighter-rouge">defaultStack</code>
(<a href="https://issues.apache.org/jira/browse/WW-5844";>WW-5844</a>). The
+<code class="language-plaintext highlighter-rouge">http-method</code>
attribute and the <code class="language-plaintext
highlighter-rouge">@HttpGet</code>, <code class="language-plaintext
highlighter-rouge">@HttpPost</code> and related annotations are enforced for
every package
+extending <code class="language-plaintext
highlighter-rouge">struts-bean-validation</code>, see <a
href="/core-developers/action-configuration#http-methods">HTTP Methods</a>.</p>
+
<p>Here is another example that shows how you can combine bean-validation with
other plugins by configuring your own
Interceptor-Stack (note: this is just a very short example. In a real app you
should take more care about your stack).
You can combine bean validation with classic struts validation (or disable
either) by putting the according interceptors
diff --git a/content/plugins/rest/index.html b/content/plugins/rest/index.html
index ac31915aa2..7420d240ad 100644
--- a/content/plugins/rest/index.html
+++ b/content/plugins/rest/index.html
@@ -179,6 +179,7 @@
<li><a href="#settings" id="markdown-toc-settings">Settings</a></li>
<li><a href="#request-body-size-limit"
id="markdown-toc-request-body-size-limit">Request body size limit</a></li>
<li><a href="#resource-isolation-in-restdefaultstack"
id="markdown-toc-resource-isolation-in-restdefaultstack">Resource isolation in
restDefaultStack</a></li>
+ <li><a href="#http-method-restrictions-in-restdefaultstack"
id="markdown-toc-http-method-restrictions-in-restdefaultstack">HTTP method
restrictions in restDefaultStack</a></li>
</ul>
</li>
<li><a href="#resources" id="markdown-toc-resources">Resources</a></li>
@@ -258,7 +259,9 @@ to truncate the identifier from the url and store it as a
parameter.</li>
<li><code class="language-plaintext highlighter-rouge">DELETE:
/movies/Thrillers</code> => method=<strong>destroy</strong>,
id=<strong>Thrillers</strong></li>
</ul>
-<p>To simulate the HTTP methods PUT and DELETE, since they aren’t supported by
HTML, the HTTP parameter <code class="language-plaintext
highlighter-rouge">_method</code> will be used.</p>
+<p>To simulate the HTTP methods PUT and DELETE, since they aren’t supported by
HTML, the HTTP parameter <code class="language-plaintext
highlighter-rouge">_method</code> will be used.
+It changes only which method the mapper selects; the request is still a POST
for the <code class="language-plaintext highlighter-rouge">httpMethod</code>
interceptor, see
+<a href="#http-method-restrictions-in-restdefaultstack">HTTP method
restrictions in restDefaultStack</a>.</p>
<p>Or, expressed as a table:</p>
@@ -660,6 +663,37 @@ check for the stack serving it:</p>
<p>Requests sent by non-browser clients carry no <code
class="language-plaintext highlighter-rouge">Sec-Fetch-Site</code> header and
are not affected.</p>
+<h3 id="http-method-restrictions-in-restdefaultstack">HTTP method restrictions
in restDefaultStack</h3>
+
+<p>Since Struts 7.5.0 <code class="language-plaintext
highlighter-rouge">restDefaultStack</code> contains the <code
class="language-plaintext highlighter-rouge">httpMethod</code> interceptor,
placed after <code class="language-plaintext
highlighter-rouge">servletConfig</code> as in core’s
+<code class="language-plaintext highlighter-rouge">defaultStack</code> (<a
href="https://issues.apache.org/jira/browse/WW-5844";>WW-5844</a>). The <code
class="language-plaintext highlighter-rouge">http-method</code> attribute and
the
+<code class="language-plaintext highlighter-rouge">@AllowedHttpMethod</code>,
<code class="language-plaintext highlighter-rouge">@HttpGet</code>, <code
class="language-plaintext highlighter-rouge">@HttpPost</code>, <code
class="language-plaintext highlighter-rouge">@HttpPut</code>, <code
class="language-plaintext highlighter-rouge">@HttpDelete</code> and <code
class="language-plaintext highlighter-rouge">@HttpGetOrPost</code> annotations
are enforced
+for every package extending <code class="language-plaintext
highlighter-rouge">rest-default</code>, see <a
href="/core-developers/action-configuration#http-methods">HTTP Methods</a>.</p>
+
+<p class="alert alert-warning">The interceptor checks the HTTP method of the
request itself, not the <code class="language-plaintext
highlighter-rouge">_method</code> parameter. A POST form carrying
+<code class="language-plaintext highlighter-rouge">_method=put</code> or <code
class="language-plaintext highlighter-rouge">_method=delete</code> is routed to
<code class="language-plaintext highlighter-rouge">update</code> or <code
class="language-plaintext highlighter-rouge">destroy</code>, but the request
stays a POST, so those methods
+must allow POST. <code class="language-plaintext
highlighter-rouge">@HttpPut</code> and <code class="language-plaintext
highlighter-rouge">@HttpDelete</code> alone accept only real PUT and DELETE
requests, as sent by <code class="language-plaintext
highlighter-rouge">fetch()</code>/XHR
+or non-browser clients; combine them with <code class="language-plaintext
highlighter-rouge">@HttpPost</code> when the same method also serves HTML
forms:</p>
+
+<div class="language-java highlighter-rouge"><div class="highlight"><pre
class="highlight"><code><span class="kd">public</span> <span
class="kd">class</span> <span class="nc">OrdersController</span> <span
class="kd">implements</span> <span class="nc">ModelDriven</span><span
class="o"><</span><span class="nc">Order</span><span class="o">></span>
<span class="o">{</span>
+
+ <span class="nd">@HttpPost</span>
+ <span class="nd">@HttpPut</span>
+ <span class="kd">public</span> <span class="nc">HttpHeaders</span> <span
class="nf">update</span><span class="o">()</span> <span class="o">{</span>
+ <span class="o">...</span>
+ <span class="o">}</span>
+
+ <span class="nd">@HttpPost</span>
+ <span class="nd">@HttpDelete</span>
+ <span class="kd">public</span> <span class="nc">HttpHeaders</span> <span
class="nf">destroy</span><span class="o">()</span> <span class="o">{</span>
+ <span class="o">...</span>
+ <span class="o">}</span>
+<span class="o">}</span>
+</code></pre></div></div>
+
+<p>An XML <code class="language-plaintext
highlighter-rouge">http-method</code> restriction on such an action must
likewise include <code class="language-plaintext
highlighter-rouge">post</code>. A request whose method is not
+allowed receives <code class="language-plaintext highlighter-rouge">405 Method
Not Allowed</code> with an <code class="language-plaintext
highlighter-rouge">Allow</code> header, or the <code class="language-plaintext
highlighter-rouge">bad-request</code> result when one is mapped.</p>
+
<h2 id="resources">Resources</h2>
<ul>
diff --git a/content/release-guidelines.html b/content/release-guidelines.html
index 14d463906a..84a7aaee5f 100644
--- a/content/release-guidelines.html
+++ b/content/release-guidelines.html
@@ -527,9 +527,15 @@ the series, the JIRA issues fixed, and the staging
repository, and link it from
build is available, and give people time to test the actual bits.</li>
</ul>
+<p>The test period is the release manager’s call. A week is the recommended
length: it gives users
+time to run the staged bits against their own applications and report problems
while they can
+still be fixed with a re-cut rather than a follow-up release. A shorter period
is a legitimate
+choice when circumstances call for it, not a violation.</p>
+
<h2 id="phase-4--vote">Phase 4 — Vote</h2>
-<p>Post a release/quality vote to the dev list and only the dev list.</p>
+<p>Open the vote once the test period is over. Post a release/quality vote to
the dev list and only
+the dev list.</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre
class="highlight"><code>To: [email protected]
Bcc: [email protected]
