inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-14 17:58:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged BRANCHES/DEV/V4.0-BUG-FIX to HEAD:

Browse Source 
35482: ALF-13773 authorityService.isGuestAuthority may only be called if there is a SecureContext, so skip this check if no authentication is present


git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@35484 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Nick Burch
2012-04-20 14:20:38 +00:00
parent d67b66bebf
commit 617e6486cc
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
source/java/org/alfresco/repo/web/scripts/RepositoryContainer.java
View File

@@ -305,11 +305,18 @@ public class RepositoryContainer extends AbstractRuntimeContainer implements Ten
// Check that the user they authenticated as has appropriate access to the script // Check that the user they authenticated as has appropriate access to the script
// Check to see if they supplied HTTP Auth or Ticket as guest, on a script that needs more // Check to see if they supplied HTTP Auth or Ticket as guest, on a script that needs more
if (required == RequiredAuthentication.user || required == RequiredAuthentication.admin)
{
if (auth != null)
{
isGuest = authorityService.isGuestAuthority(AuthenticationUtil.getFullyAuthenticatedUser()); isGuest = authorityService.isGuestAuthority(AuthenticationUtil.getFullyAuthenticatedUser());
if (isGuest && (required == RequiredAuthentication.user || required == RequiredAuthentication.admin)) }
if (auth == null || isGuest)
{ {
throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Web Script " + desc.getId() + " requires user authentication; however, a guest has attempted access."); throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Web Script " + desc.getId() + " requires user authentication; however, a guest has attempted access.");
} }
}
// Check to see if they're admin or system on an Admin only script // Check to see if they're admin or system on an Admin only script
if (required == RequiredAuthentication.admin && !(authorityService.hasAdminAuthority() || AuthenticationUtil.getFullyAuthenticatedUser().equals(AuthenticationUtil.getSystemUserName()))) if (required == RequiredAuthentication.admin && !(authorityService.hasAdminAuthority() || AuthenticationUtil.getFullyAuthenticatedUser().equals(AuthenticationUtil.getSystemUserName())))