inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-14 17:58:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged BRANCHES/DEV/V4.0-BUG-FIX to HEAD:

Browse Source 
35482: ALF-13773 authorityService.isGuestAuthority may only be called if there is a SecureContext, so skip this check if no authentication is present


git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@35484 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Nick Burch
2012-04-20 14:20:38 +00:00
parent d67b66bebf
commit 617e6486cc
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
source/java/org/alfresco/repo/web/scripts/RepositoryContainer.java
View File

@@ -305,10 +305,17 @@ public class RepositoryContainer extends AbstractRuntimeContainer implements Ten
// Check that the user they authenticated as has appropriate access to the script // Check that the user they authenticated as has appropriate access to the script
// Check to see if they supplied HTTP Auth or Ticket as guest, on a script that needs more // Check to see if they supplied HTTP Auth or Ticket as guest, on a script that needs more
isGuest = authorityService.isGuestAuthority(AuthenticationUtil.getFullyAuthenticatedUser()); if (required == RequiredAuthentication.user || required == RequiredAuthentication.admin)
if (isGuest && (required == RequiredAuthentication.user || required == RequiredAuthentication.admin))
{ {
throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Web Script " + desc.getId() + " requires user authentication; however, a guest has attempted access."); if (auth != null)
{
isGuest = authorityService.isGuestAuthority(AuthenticationUtil.getFullyAuthenticatedUser());
}
if (auth == null || isGuest)
{
throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Web Script " + desc.getId() + " requires user authentication; however, a guest has attempted access.");
}
} }
// Check to see if they're admin or system on an Admin only script // Check to see if they're admin or system on an Admin only script