'locking' forms

Hi, I have a requirement have a web form editable by one group of users and locked for another group. I need advice on how to write a form that can be locked/unlocked and still conform to Struts (i.e. not code arround struts). This logic will be used on many other forms so I would like to avoid 'double' coding a locked and unlocked form.

I have looked at making the readonly attribute of the html:text a variable, but I could not get it to work (probably it is not possible). I am now looking at using the logic tag to switch between a read only html:text and an editable html:text. I could also use straight JSP to do this.

Can anyone think of better way to do this ?

Thanks for your help

Mike

Have a look at this article:
http://www.ibm.com/developerworks/web/library/wa-appsec/?ca=dgr-lnxw06ServletsTaglibsStrutsSecurity

We have done this (sort of) and implemented our RBAC-framework so that we can define on our custom secur tags what roles have edit and what roles has only read rights.

Hi Ove, thanks for your reply. However my security model is quite simple so I decided not to go down this route.

I discovered that it is not possible to do what I wanted with pure struts tags. But it is possible by mixing in straight html input tags which still get resloved into the returned Struts Form Bean. This is what I did:

<%lockForm = request.getAttribute("LockForm").toString();%>
...
<input name="SUPPLIERCODE" type="text" <%=lockForm %> value='<bean:write name="ListSupplierContactsRowBean" property="SUPPLIERCODE" />' class="dataChrBold" size="40" >

When LockForm = "readonly" the form is locked. when lockFrom ="" the form is updatable.

Mike