From 12bb52e9cea1cb2b534933ad5745ac58792b4c1a Mon Sep 17 00:00:00 2001 From: Rossen Stoyanchev Date: Wed, 12 Sep 2018 12:14:45 -0400 Subject: [PATCH] Update paragraph on use of explicit model bindings Issue: SWF-1723 --- src/reference/views.xml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/reference/views.xml b/src/reference/views.xml index e00e59f6..008777dd 100644 --- a/src/reference/views.xml +++ b/src/reference/views.xml @@ -382,8 +382,12 @@ public class ApplicationConversionServiceFactoryBean extends FormattingConversio Specifying bindings explicitly - Use the binder element to configure the exact set of model bindings usable by the view. - This is particularly useful in a Spring MVC environment for restricting the set of "allowed fields" per view. + Use the binder element to configure the exact set of model properties to + apply data binding to. This is useful to restrict the set of "allowed fields" per view. + Not using this could lead to a security issue, depending on the application domain and actual users, + since by default if the binder element is not specified all public properties of the model are + eligible for data binding by the view. By contrast when the binder element is specified, + only the explicitly configured bindings are allowed. Below is an example: @@ -398,10 +402,6 @@ public class ApplicationConversionServiceFactoryBean extends FormattingConversio ]]> - - If the binder element is not specified, all public properties of the model are eligible for binding by the view. - With the binder element specified, only the explicitly configured bindings are allowed. - Each binding may also apply a converter to format the model property value for display in a custom manner. If no converter is specified, the default converter for the model property's type will be used.