When using Struts2 convention plugin, the plugin automatically forwards a hello-world.action request to /WEB-INF/content/hello-world.jsp even if no HelloWorld.java is defined.
Please see http://struts.apache.org/release/2.1.x/docs/convention-plugin.html for that.
On the other hand, we put JSP files under WEB-INF to avoid any direct access to JSP files.
I think this behavior of convention plugin ruins JSP access policy. Any one can make a direct access to a JSP by simply calling a, build on the fly, action.
Am I correct?! If yes, can we disable this feature?