| This interceptor ensures that the action
will only be executed if the user has the correct role.
Interceptor parameters:
- allowedRoles - a comma-separated list of roles to allow
- disallowedRoles - a comma-separated list of roles to disallow
There are two extensions to the
existing interceptor:
- isAllowed(HttpServletRequest,Object) - whether or not to allow
the passed action execution with this request
- handleRejection(ActionInvocation) - handles an unauthorized
request.
<!-- START SNIPPET: example -->
<!-- only allows the admin and member roles -->
<action name="someAction" class="com.examples.SomeAction">
<interceptor-ref name="completeStack"/>
<interceptor-ref name="roles">
<param name="allowedRoles">admin,member</param>
</interceptor-ref>
<result name="success">good_result.ftl</result>
</action>
<!-- END SNIPPET: example -->
|