This is all with Hibernate 3.1rc2.

I have a mapping like this:



Then when I use this filter like this:



I get an exception and it says, "undefined flter parameter".

When I make up a simple filter that uses a string type and I apply it to a property in the class, all is well, but here I'm filtering on an object type (acme.Customer) and customer is a many-to-one mapping, not a property. How should I handle this?

Thanks

(By the way, to make something more clear: In my setup, customers have multiple categories. Customers store stuff in their accounts and can put it in categories. I'm making this note because we usually think of customers as being in categories, rather than customers having categories.)

I found out more about what's going on. From a comment in this discussion: http://www.theserverside.com/news/threa ... d_id=28041 it looks like filters cannot be applied in a many-to-one mapping, which is what I am using.

Is there a solution to this? Surely there is some way to apply a filter so that only objects owned by a given Customer can be viewed?

Problem solved!

What I need to do is this:

Within my class section of the mapping file:



And then my filter code is:



In some ways it is less elegant because I'm manually having to use the ID number of customer objects, but it is very workable and does exactly what I want. So I guess that is the solution to using filters in cases where the filtering is aon a many-to-one, instead of on a property. At least it's clear how it's working.

Now I have things set up so that a customer logs in and there is a servlet filter that secures his access to the site, and that servlet filter creates the Hibernate session and the session is also filtered so that a customer can only see his stuff.

This is awesome and the sanest most secure way to develop a web app.

Constrasting this to PHP where there are no filters (either at the DB layer or the web page layer) and there are SQL injection attacks all over the place.

Nope. Filters are not allowed to change the multiplicity of an association.

I don't understand what you mean by this. By putting a fitler, I'm not changing the multiplicity; I'm only narrowing the objects that could be reached by the association. Does my solution above make sense for this? Is it the right way to do it?

I was refering to your question about "can I filter a many-to-one".

The answer is no.

Say you have : Order *-1 Customer.
Further say we did allow a filter to be applied to this association.

Now when you load a particular Order, its customer is null. So when this goes to get saved, what do you think is going to happen?