From 617e6486cc16d2e9782caddd8033c426ac906afa Mon Sep 17 00:00:00 2001 From: Nick Burch Date: Fri, 20 Apr 2012 14:20:38 +0000 Subject: [PATCH] Merged BRANCHES/DEV/V4.0-BUG-FIX to HEAD: 35482: ALF-13773 authorityService.isGuestAuthority may only be called if there is a SecureContext, so skip this check if no authentication is present git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@35484 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261 --- .../repo/web/scripts/RepositoryContainer.java | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/source/java/org/alfresco/repo/web/scripts/RepositoryContainer.java b/source/java/org/alfresco/repo/web/scripts/RepositoryContainer.java index d8229e0f8a..cbe28b9254 100644 --- a/source/java/org/alfresco/repo/web/scripts/RepositoryContainer.java +++ b/source/java/org/alfresco/repo/web/scripts/RepositoryContainer.java @@ -305,10 +305,17 @@ public class RepositoryContainer extends AbstractRuntimeContainer implements Ten // Check that the user they authenticated as has appropriate access to the script // Check to see if they supplied HTTP Auth or Ticket as guest, on a script that needs more - isGuest = authorityService.isGuestAuthority(AuthenticationUtil.getFullyAuthenticatedUser()); - if (isGuest && (required == RequiredAuthentication.user || required == RequiredAuthentication.admin)) + if (required == RequiredAuthentication.user || required == RequiredAuthentication.admin) { - throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Web Script " + desc.getId() + " requires user authentication; however, a guest has attempted access."); + if (auth != null) + { + isGuest = authorityService.isGuestAuthority(AuthenticationUtil.getFullyAuthenticatedUser()); + } + + if (auth == null || isGuest) + { + throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Web Script " + desc.getId() + " requires user authentication; however, a guest has attempted access."); + } } // Check to see if they're admin or system on an Admin only script