Spring InitBinder

Question

I'm having some trouble setting up an initBinder in Spring MVC. I have a ModelAttribute which has a field which will sometimes display.

public class Model {
  private String strVal;
  private int intVal;
  private boolean boolVal; // Only shows in certain situations
}

How can I setup this initBinder properly? Here is what I have, but whenever I modify the post data I'm able to modify this boolVal regardless of me saying it's not allowed. I'm assuming my trouble is that I can't take the shortcut I'd like to.

@InitBinder
public void initBinder(WebDataBinder binder) {
  binder.setIgnoreUnknownFields(true);
  if (binder.objectName() == MODEL) {
    binder.setAllowedFields("*");
    if (!somePermissionChecks()) {
      binder.setDisallowedFields("boolVal");
    }
  }
}

The permission check is returning false, thus the call to setDisallowedFields is made. The problem is that I'm still able to fake this value on the UI by adding an input or changing the name of another field or appending it to the POST data.

Is there a quick way to do this, without having to list all the properties by hand?

Answer 1

Is the permission check failing during the initialization of the binder? Have you tried without the binder.setAllowedFields("*"); statement?