Index: struts-1.2.9-src/build-tests.xml
===================================================================
--- struts-1.2.9-src.orig/build-tests.xml
+++ struts-1.2.9-src/build-tests.xml
@@ -795,11 +795,14 @@
         <!-- Tests for org.apache.struts.action -->
         <test       name="org.apache.struts.action.TestDynaActionForm"/>
         <test       name="org.apache.struts.action.TestDynaActionFormClass"/>
-        <test       name="org.apache.struts.config.TestModuleConfig"/>
+        <test       name="org.apache.struts.config.TestActionConfig"/>
         <test       name="org.apache.struts.config.TestActionConfigMatcher"/>
+        <test       name="org.apache.struts.config.TestModuleConfig"/>
         <test       name="org.apache.struts.tiles.TestTilesPlugin"/>
 
         <!-- Tests for org.apache.struts.validator -->
+        <test       name="org.apache.struts.validator.TestDynaValidatorForm"/>
+        <test       name="org.apache.struts.validator.TestValidatorForm"/>
         <test       name="org.apache.struts.validator.TestValidWhen"/>
 
         <!-- Tests for org.apache.struts.util -->
Index: struts-1.2.9-src/src/share/org/apache/struts/config/ActionConfig.java
===================================================================
--- struts-1.2.9-src.orig/src/share/org/apache/struts/config/ActionConfig.java
+++ struts-1.2.9-src/src/share/org/apache/struts/config/ActionConfig.java
@@ -557,7 +557,36 @@ public class ActionConfig implements Ser
         }
         this.cancellable = cancellable;
     }
-    
+
+    // 2014/07/02 - security problem patch.
+    // Author: NTT DATA Corporation
+    /**
+     * Accepted page value for multi-page validation.<br>
+     * If two or more page values are accepted, then acceptPage is set minimum of them.<br>
+     * If multi-page validation is not use, acceptPage is not set. Then multi-page validation is disabled.
+     * @since Struts 1.2.9-sp2
+     */
+    protected Integer acceptPage = null;
+
+    /**
+     * Returns accepted page value for multi-page validation.
+     *
+     * @return Accepted page value for multi-page validation
+     * @since  Struts 1.2.9-sp2
+     */
+    public Integer getAcceptPage() {
+        return acceptPage;
+    }
+
+    /**
+     * Set accepted page value for multi-page validation.
+     *
+     * @param acceptPage Accepted page value for multi-page validation
+     * @since  Struts 1.2.9-sp2
+     */
+    public void setAcceptPage(Integer acceptPage) {
+        this.acceptPage = acceptPage;
+    }    
 
     // --------------------------------------------------------- Public Methods
 
Index: struts-1.2.9-src/src/share/org/apache/struts/validator/DynaValidatorForm.java
===================================================================
--- struts-1.2.9-src.orig/src/share/org/apache/struts/validator/DynaValidatorForm.java
+++ struts-1.2.9-src/src/share/org/apache/struts/validator/DynaValidatorForm.java
@@ -101,10 +101,13 @@ public class DynaValidatorForm extends D
 
         String validationKey = getValidationKey(mapping, request);
 
+        // 2014/07/02 - security problem patch.
+        // Author: NTT DATA Corporation
+        int validationPage = determinePage(mapping, request);
         Validator validator = Resources.initValidator(validationKey,
                              this,
                              application, request,
-                             errors, page);
+                             errors, validationPage);
 
         try {
             validatorResults = validator.validate();
@@ -115,6 +118,24 @@ public class DynaValidatorForm extends D
         return errors;
     }
 
+    // 2014/07/02 - security problem patch.
+    // Author: NTT DATA Corporation
+    /**
+     * Determine validation page.<br>
+     * If acceptPage of ActionMapping is null, then returns Integer.MAX_VALUE.
+     * (multi-page validation is disabled. All validation fields are enabled.)<br>
+     * If page property is less than acceptPage of ActionMapping, returns acceptPage value.<br>
+     * If page property is greater than or equal to acceptPage of ActionMapping, returns page property value.
+     * @param mapping The mapping used to select this instance.
+     * @param request The servlet request we are processing.
+     * @return validation page.
+     * @since Struts 1.2.9-sp2
+     */
+    protected int determinePage(ActionMapping mapping, HttpServletRequest request) {
+        Integer acceptPage = mapping.getAcceptPage();
+        return acceptPage != null ? Math.max(acceptPage.intValue(), page) : Integer.MAX_VALUE;
+    }
+
     /**
      * Returns the Validation key.
      *
Index: struts-1.2.9-src/src/share/org/apache/struts/validator/ValidatorForm.java
===================================================================
--- struts-1.2.9-src.orig/src/share/org/apache/struts/validator/ValidatorForm.java
+++ struts-1.2.9-src/src/share/org/apache/struts/validator/ValidatorForm.java
@@ -99,12 +99,15 @@ public class ValidatorForm extends Actio
         ServletContext application = getServlet().getServletContext();
         ActionErrors errors = new ActionErrors();
 
+        // 2014/07/02 - security problem patch.
+        // Author: NTT DATA Corporation
+        int validationPage = determinePage(mapping, request);
         String validationKey = getValidationKey(mapping, request);
 
         Validator validator = Resources.initValidator(validationKey,
                              this,
                              application, request,
-                             errors, page);
+                             errors, validationPage);
 
         try {
             validatorResults = validator.validate();
@@ -115,6 +118,24 @@ public class ValidatorForm extends Actio
         return errors;
     }
 
+    // 2014/07/02 - security problem patch.
+    // Author: NTT DATA Corporation
+    /**
+     * Determine validation page.<br>
+     * If acceptPage of ActionMapping is null, then returns Integer.MAX_VALUE.
+     * (multi-page validation is disabled. All validation fields are enabled.)<br>
+     * If page property is less than acceptPage of ActionMapping, returns acceptPage value.<br>
+     * If page property is greater than or equal to acceptPage of ActionMapping, returns page property value.
+     * @param mapping The mapping used to select this instance.
+     * @param request The servlet request we are processing.
+     * @return validation page.
+     * @since Struts 1.2.9-sp2
+     */
+    protected int determinePage(ActionMapping mapping, HttpServletRequest request) {
+        Integer acceptPage = mapping.getAcceptPage();
+        return acceptPage != null ? Math.max(acceptPage.intValue(), page) : Integer.MAX_VALUE;
+    }
+
     /**
      * Returns the Validation key.
      *
Index: struts-1.2.9-src/src/test/org/apache/struts/config/TestActionConfig.java
===================================================================
--- /dev/null
+++ struts-1.2.9-src/src/test/org/apache/struts/config/TestActionConfig.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright 2004 The Apache Software Foundation.
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.struts.config;
+
+import junit.framework.Test;
+import junit.framework.TestSuite;
+
+import org.apache.struts.mock.TestMockBase;
+
+public class TestActionConfig extends TestMockBase {
+
+    /**
+     * Defines the testcase name for JUnit.
+     *
+     * @param theName the testcase's name.
+     */
+    public TestActionConfig(String theName) {
+        super(theName);
+    }
+
+    /**
+     * Start the tests.
+     *
+     * @param theArgs the arguments. Not used
+     */
+    public static void main(String[] theArgs) {
+        junit.awtui.TestRunner.main(
+            new String[] {TestActionConfig.class.getName()});
+    }
+
+    /**
+     * @return a test suite (<code>TestSuite</code>) that includes all methods
+     *         starting with "test"
+     */
+    public static Test suite() {
+        // All methods starting with "test" will be executed in the test suite.
+        return new TestSuite(TestActionConfig.class);
+    }
+
+    public void setUp() {
+        super.setUp();
+    }
+
+    public void tearDown() {
+       super.tearDown();
+    }
+
+    /**
+     * Test getter of acceptPage property.
+     */
+    public void testGetAcceptPage() {
+        ActionConfig config = new ActionConfig();
+        config.setAcceptPage(new Integer(0));
+        Integer acceptPage = config.getAcceptPage();
+        assertEquals(new Integer(0), acceptPage);
+    }
+
+    /**
+     * Test setter of acceptPage property.
+     */
+    public void testSetAcceptPage() {
+        ActionConfig config = new ActionConfig();
+        config.setAcceptPage(new Integer(0));
+        Integer acceptPage = config.getAcceptPage();
+        assertEquals(new Integer(0), acceptPage);
+    }
+
+    /**
+     * Test a String object representing the value of the ActionConfig object.
+     */
+    public void testToString() {
+        ActionConfig config = new ActionConfig();
+        Integer acceptPage = new Integer(0);
+        config.setAcceptPage(acceptPage);
+        String suffix = "acceptPage=0";
+        assertTrue(config.toString().endsWith(suffix));
+    }
+
+}
Index: struts-1.2.9-src/src/test/org/apache/struts/validator/TestDynaValidatorForm.java
===================================================================
--- /dev/null
+++ struts-1.2.9-src/src/test/org/apache/struts/validator/TestDynaValidatorForm.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2004 The Apache Software Foundation.
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.struts.validator;
+
+import junit.framework.Test;
+import junit.framework.TestSuite;
+
+import org.apache.struts.action.ActionMapping;
+import org.apache.struts.mock.TestMockBase;
+
+public class TestDynaValidatorForm extends TestMockBase {
+
+    /**
+     * Defines the testcase name for JUnit.
+     *
+     * @param theName the testcase's name.
+     */
+    public TestDynaValidatorForm(String theName) {
+        super(theName);
+    }
+
+    /**
+     * Start the tests.
+     *
+     * @param theArgs the arguments. Not used
+     */
+    public static void main(String[] theArgs) {
+        junit.awtui.TestRunner.main(
+            new String[] {TestDynaValidatorForm.class.getName()});
+    }
+
+    /**
+     * @return a test suite (<code>TestSuite</code>) that includes all methods
+     *         starting with "test"
+     */
+    public static Test suite() {
+        return new TestSuite(TestDynaValidatorForm.class);
+    }
+
+    public void setUp() {
+        super.setUp();
+    }
+
+    public void tearDown() {
+       super.tearDown();
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage01() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(null);
+        validatorForm.setPage(-1);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(Integer.MAX_VALUE, page);
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage02() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(new Integer(-1));
+        validatorForm.setPage(-1);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(-1, page);
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage03() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(new Integer(-1));
+        validatorForm.setPage(0);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(0, page);
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage04() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(new Integer(-1));
+        validatorForm.setPage(1);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(1, page);
+    }
+
+}
Index: struts-1.2.9-src/src/test/org/apache/struts/validator/TestValidatorForm.java
===================================================================
--- /dev/null
+++ struts-1.2.9-src/src/test/org/apache/struts/validator/TestValidatorForm.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2004 The Apache Software Foundation.
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.struts.validator;
+
+import junit.framework.Test;
+import junit.framework.TestSuite;
+
+import org.apache.struts.action.ActionMapping;
+import org.apache.struts.mock.TestMockBase;
+
+public class TestValidatorForm extends TestMockBase {
+
+    /**
+     * Defines the testcase name for JUnit.
+     *
+     * @param theName the testcase's name.
+     */
+    public TestValidatorForm(String theName) {
+        super(theName);
+    }
+
+    /**
+     * Start the tests.
+     *
+     * @param theArgs the arguments. Not used
+     */
+    public static void main(String[] theArgs) {
+        junit.awtui.TestRunner.main(
+            new String[] {TestValidatorForm.class.getName()});
+    }
+
+    /**
+     * @return a test suite (<code>TestSuite</code>) that includes all methods
+     *         starting with "test"
+     */
+    public static Test suite() {
+        return new TestSuite(TestValidatorForm.class);
+    }
+
+    public void setUp() {
+        super.setUp();
+    }
+
+    public void tearDown() {
+       super.tearDown();
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage01() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(null);
+        validatorForm.setPage(-1);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(Integer.MAX_VALUE, page);
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage02() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(new Integer(-1));
+        validatorForm.setPage(-1);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(-1, page);
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage03() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(new Integer(-1));
+        validatorForm.setPage(0);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(0, page);
+    }
+
+    /**
+     * Test value of determine page.
+     */
+    public void testDeterminePage04() {
+        DynaValidatorForm validatorForm = new DynaValidatorForm();
+        ActionMapping mapping = new ActionMapping();
+
+        mapping.setAcceptPage(new Integer(-1));
+        validatorForm.setPage(1);
+        int page = validatorForm.determinePage(mapping, null);
+
+        assertEquals(1, page);
+    }
+
+}
