Add support for configuring allowSessionOverride via the environment

This commit adds support for using the environment to configure the
Freemarker and Velocity view resolvers to allow session overrides.

Closes gh-3410

spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/template/AbstractTemplateViewResolverProperties.java

@@ -70,6 +70,12 @@ public abstract class AbstractTemplateViewResolverProperties extends
 	 */
 	private boolean exposeSpringMacroHelpers = true;
 
+	/**
+	 * Set whether HttpSession attributes are allowed to override (hide) controller
+	 * generated model attributes of the same name.
+	 */
+	private boolean allowSessionOverride = false;
+
 	protected AbstractTemplateViewResolverProperties(String defaultPrefix,
 			String defaultSuffix) {
 		this.prefix = defaultPrefix;
@@ -124,6 +130,14 @@ public abstract class AbstractTemplateViewResolverProperties extends
 		this.allowRequestOverride = allowRequestOverride;
 	}
 
+	public boolean isAllowSessionOverride() {
+		return this.allowSessionOverride;
+	}
+
+	public void setAllowSessionOverride(boolean allowSessionOverride) {
+		this.allowSessionOverride = allowSessionOverride;
+	}
+
 	public boolean isExposeSpringMacroHelpers() {
 		return this.exposeSpringMacroHelpers;
 	}
@@ -152,6 +166,7 @@ public abstract class AbstractTemplateViewResolverProperties extends
 		resolver.setViewNames(getViewNames());
 		resolver.setExposeRequestAttributes(isExposeRequestAttributes());
 		resolver.setAllowRequestOverride(isAllowRequestOverride());
+		resolver.setAllowSessionOverride(isAllowSessionOverride());
 		resolver.setExposeSessionAttributes(isExposeSessionAttributes());
 		resolver.setExposeSpringMacroHelpers(isExposeSpringMacroHelpers());
 		resolver.setRequestContextAttribute(getRequestContextAttribute());

spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/freemarker/FreeMarkerAutoConfigurationTests.java

@@ -31,14 +31,17 @@ import org.springframework.context.annotation.AnnotationConfigApplicationContext
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.mock.web.MockServletContext;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
 import org.springframework.web.servlet.View;
 import org.springframework.web.servlet.support.RequestContext;
+import org.springframework.web.servlet.view.AbstractTemplateViewResolver;
 import org.springframework.web.servlet.view.freemarker.FreeMarkerConfigurer;
 import org.springframework.web.servlet.view.freemarker.FreeMarkerViewResolver;
 
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.notNullValue;
 import static org.junit.Assert.assertThat;
 
@@ -139,6 +142,15 @@ public class FreeMarkerAutoConfigurationTests {
 				equalTo(0));
 	}
 
+	@Test
+	public void allowSessionOverride() {
+		registerAndRefreshContext("spring.freemarker.allow-session-override:true");
+		AbstractTemplateViewResolver viewResolver = this.context
+				.getBean(FreeMarkerViewResolver.class);
+		assertThat((Boolean) ReflectionTestUtils.getField(viewResolver,
+				"allowSessionOverride"), is(true));
+	}
+
 	@SuppressWarnings("deprecation")
 	@Test
 	public void customFreeMarkerSettings() {

spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/velocity/VelocityAutoConfigurationTests.java

@@ -35,15 +35,18 @@ import org.springframework.context.annotation.AnnotationConfigApplicationContext
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.mock.web.MockServletContext;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
 import org.springframework.web.servlet.View;
 import org.springframework.web.servlet.support.RequestContext;
+import org.springframework.web.servlet.view.AbstractTemplateViewResolver;
 import org.springframework.web.servlet.view.velocity.VelocityConfigurer;
 import org.springframework.web.servlet.view.velocity.VelocityViewResolver;
 
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.notNullValue;
 import static org.junit.Assert.assertThat;
 
@@ -183,6 +186,15 @@ public class VelocityAutoConfigurationTests {
 		assertThat(resolver, instanceOf(EmbeddedVelocityViewResolver.class));
 	}
 
+	@Test
+	public void allowSessionOverride() {
+		registerAndRefreshContext("spring.velocity.allow-session-override:true");
+		AbstractTemplateViewResolver viewResolver = this.context
+				.getBean(VelocityViewResolver.class);
+		assertThat((Boolean) ReflectionTestUtils.getField(viewResolver,
+				"allowSessionOverride"), is(true));
+	}
+
 	private void registerAndRefreshContext(String... env) {
 		EnvironmentTestUtils.addEnvironment(this.context, env);
 		this.context.register(VelocityAutoConfiguration.class);

spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc

@@ -158,6 +158,7 @@ content into your application; rather pick only the properties that you need.
 
 	# FREEMARKER ({sc-spring-boot-autoconfigure}/freemarker/FreeMarkerAutoConfiguration.{sc-ext}[FreeMarkerAutoConfiguration])
 	spring.freemarker.allow-request-override=false
+	spring.freemarker.allow-session-override=false
 	spring.freemarker.cache=true
 	spring.freemarker.check-template-location=true
 	spring.freemarker.charset=UTF-8
@@ -183,6 +184,7 @@ content into your application; rather pick only the properties that you need.
 
 	# VELOCITY TEMPLATES ({sc-spring-boot-autoconfigure}/velocity/VelocityAutoConfiguration.{sc-ext}[VelocityAutoConfiguration])
 	spring.velocity.allow-request-override=false
+	spring.velocity.allow-session-override=false
 	spring.velocity.cache=true
 	spring.velocity.check-template-location=true
 	spring.velocity.charset=UTF-8