samples/xml/contacts/src/main/java/sample/contact/IndexController.java
@RequestMapping(value = "/secure/index.htm", method = RequestMethod.GET)
	public ModelAndView displayUserContacts() {
		List<Contact> myContactsList = contactManager.getAll();
		Map<Contact, Boolean> hasDelete = new HashMap<>(
				myContactsList.size());
		Map<Contact, Boolean> hasAdmin = new HashMap<>(
				myContactsList.size());

		Authentication user = SecurityContextHolder.getContext().getAuthentication();

		for (Contact contact : myContactsList) {
			hasDelete.put(contact, Boolean.valueOf(permissionEvaluator.hasPermission(
					user, contact, HAS_DELETE)));
			hasAdmin.put(contact, Boolean.valueOf(permissionEvaluator.hasPermission(user,
					contact, HAS_ADMIN)));
		}

		Map<String, Object> model = new HashMap<>();
		model.put("contacts", myContactsList);
		model.put("hasDeletePermission", hasDelete);
		model.put("hasAdminPermission", hasAdmin);

		return new ModelAndView("index", "model", model);
	}
@RequestMapping(value = "/secure/index.htm", method = RequestMethod.GET)
	public ModelAndView displayUserContacts() {
		List<Contact> myContactsList = contactManager.getAll();
		Map<Contact, Boolean> hasDelete = new HashMap<>(
				myContactsList.size());
		Map<Contact, Boolean> hasAdmin = new HashMap<>(
				myContactsList.size());

		Authentication user = SecurityContextHolder.getContext().getAuthentication();

		for (Contact contact : myContactsList) {
			hasDelete.put(contact, Boolean.valueOf(permissionEvaluator.hasPermission(
					user, contact, HAS_DELETE)));
			hasAdmin.put(contact, Boolean.valueOf(permissionEvaluator.hasPermission(user,
					contact, HAS_ADMIN)));
		}

		Map<String, Object> model = new HashMap<>();
		model.put("contacts", myContactsList);
		model.put("hasDeletePermission", hasDelete);
		model.put("hasAdminPermission", hasAdmin);

		return new ModelAndView("index", "model", model);
	}
The index page for an authenticated user.
<p>
This controller displays a list of all the contacts for which the current user has
read or admin permissions. It makes a call to {@link ContactManager#getAll()} which
automatically filters the returned list using Spring Security's ACL mechanism (see
the expression annotations on this interface for the details).
<p>
In addition to rendering the list of contacts, the view will also include a "Del"
or "Admin" link beside the contact, depending on whether the user has the
corresponding permissions (admin permission is assumed to imply delete here). This
information is stored in the model using the injected {@link PermissionEvaluator}
instance. The implementation should be an instance of
{@link AclPermissionEvaluator} or one which is compatible with Spring Security's
ACL module.