Title: DataObjectUtils
DataObjectUtils class provides an important and easy to use facility to obtain a primary key value from a DataObject and to locate a DataObject in the database for a known primary key. Both operations work in a generic fashion and do not require primary key to be an object property.
Security Warning DataObjectUtils make it very easy to use a primary key value as a universal "code" for an object in web forms and URLs. This opens a potential security hole in the interface. If application code is not careful enough, a malicious user can gain access to the information she is not allowed to see (e.g. other people's accounts) simply by trying a series of sequential numbers. So for example it is probably ok to use product PK to build a bookmarkable link to a catalog product, but it may not be appropriate to do that for a private user profile record. |
DataObjectUtils API is really straightforward and self-explanatory. It supports the most common case of a single column integer primary key, but also a more generic case of an arbitrary PK (that can also be compound, i.e. consist of more than one column). Here is an example:
// obtain PK to build a bookmarkable artist page URL Artist artist = ...; int artistID = DataObjectUtils.intPKForObject(artist); String artistURL = "http://www.example.org/catalogapp/artists?a=" + artistID;
// find an artist from URL parameters HttpServletRequest request = ...; DataContext context = ...; String idString = request.getParameter("a"); if(idString != null) { Artist artist = DataObjectUtils.objectForPK(context, Artist.class, Integer.parseInt(idString)); }