spring-security

Commit Graph

Author	SHA1	Message	Date
Rob Winch	c4bcce1ac3	Next development version	13 years ago
Rob Winch	23bdc7d766	Release 2.0.8.RELEASE	13 years ago
Rob Winch	f5fc94e1be	SEC-2056: DaoAuthenticationProvider performs isPasswordValid when user not found Previously authenticating a user could take significantly longer than determining that a user does not exist. This was due to the fact that only users that were found would use the password encoder and comparing a password can take a significant amount of time. The difference in the time required could allow a side channel attack that reveals if a user exists. The code has been updated to do comparison against a dummy password even when the the user was not found.	13 years ago
Luke Taylor	55e501711d	Set version to 2.0.8.CI-SNAPSHOT	15 years ago
Luke Taylor	d5e6f0b575	Set release version to 2.0.7.RELEASE	15 years ago
Luke Taylor	76dc21469e	SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread.	15 years ago
Luke Taylor	22b7c9b905	SEC-1742: Make extraInformation in AuthenticationException transient.	15 years ago
Luke Taylor	0cdf202b10	SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider.	15 years ago
Luke Taylor	a507e3612a	SEC-1741: Modify ContextPropagatingRemoteInvocation to pass a simple combination of principal/credentials as Strings, rather than serializing the whole SecurityContext object from the client.	15 years ago
Luke Taylor	f5fbda42e5	SEC-1790: Reject redirect locations containing CR or LF.	15 years ago
Rob Winch	d5b72275e5	SEC-1639: FirewalledRequest is now called on the specific FirewalledRequest instance rather that looping through ServletRequestWrappers. VirtualFilterChain now accepts the FirewalledRequest in the constructor. The reset method is called directly on the instance passed in instead of looping through the ServletRequestWrappers.	15 years ago
Luke Taylor	08a933f930	SEC-1608: Ensure request wrapper is reset for empty filter chains.	15 years ago
Rob Winch	54ffc98bb4	SEC-1606: Added a FirewalledRequestAwareRequestDispatcher that will call FirewalledRequest.reset() before a forward	15 years ago
Luke Taylor	1c3d530b60	Switch versions to 2.0.7.CI-SNAPSHOT	15 years ago
Luke Taylor	beb0ec4ba9	Version 2.0.6.RELEASE	15 years ago
Luke Taylor	dec2e59fba	SEC-1584: Backport of namespace support for injecting custom HttpFirewall instance into FilterChainProxy.	15 years ago
Luke Taylor	8f6ddb0f17	SEC-1584: Backport to 2.0.x branch of request firewalling (normalization checks and path-parameter stripping from servletPath and pathInfo).	15 years ago
Luke Taylor	9c6a5135a3	SEC-1532: Patch applied to 2.0.x branch	16 years ago
Luke Taylor	0acf262546	SEC-1462: Added suggested patch (effectively the same as changes in 3.0.x and master branches).	16 years ago
Luke Taylor	6ad652ae97	Update 2.0 branch pom versions.	16 years ago
Luke Taylor	d6f6a54455	SEC-1444: Backport of changes to 2.0.x	16 years ago
Luke Taylor	71adc26b0f	[maven-release-plugin] prepare release spring-security-2.0.5.RELEASE	17 years ago
Luke Taylor	3e393c9df6	Tidying test class	17 years ago
Luke Taylor	149fd5d8de	Add bundlor templates	17 years ago
Luke Taylor	f3f02d8aed	Update sec-2.0.x branch to use bundlor	17 years ago
Luke Taylor	781c99f257	SEC-1145: Updated LDAP code to make sure pooling flag is removed when binding as a specific user (for real this time)	17 years ago
Luke Taylor	b77f780993	SEC-1145: Updated LDAP code to make sure pooling flag is removed when binding as a specific user	17 years ago
Luke Taylor	4c3867718e	SEC-1031: Ported change from trunk.	17 years ago
Luke Taylor	97381fb448	SEC-974: Made getExceptionMappings() protected.	17 years ago
Luke Taylor	4542f00b14	SEC-975: Namespace security syntax does not interpret properties http://jira.springframework.org/browse/SEC-975. Changed creation of AccessDeniedHandler to use a BeanDefinition to make sure placeholders work OK.	18 years ago
Luke Taylor	5e4634d216	Minor Javadoc improvement.	18 years ago
Luke Taylor	d291def963	Removed invalid comment.	18 years ago
Luke Taylor	df59cb9dcd	Import cleaning.	18 years ago
Luke Taylor	ef0389ae79	SEC-976: Removed checks for presence of core-tiger classes.	18 years ago
Luke Taylor	5b9bb8ba54	[maven-release-plugin] prepare for next development iteration	18 years ago
Luke Taylor	73eed2656d	[maven-release-plugin] prepare release spring-security-parent-2.0.4	18 years ago
Luke Taylor	8661e17df9	OPEN - issue SEC-960: DN Encoding in LDAPUserDetailsManager.changePassword() causes bind errors http://jira.springframework.org/browse/SEC-960. Replaced call to toUrl() with toString() to prevent URL encoding when setting up principal name for reconnect() in changePassword() method.	18 years ago
Luke Taylor	5102be3a59	SEC-971: getter for cookieName in AbstractRememberMeServices http://jira.springframework.org/browse/SEC-971. Added getCookieName() method.	18 years ago
Luke Taylor	4e2d6f8b2e	SEC-967: TextUtils.java does not escape ampersand character http://jira.springframework.org/browse/SEC-967. Added escaping of '&' character	18 years ago
Luke Taylor	d781deffe7	OPEN - issue SEC-966: Consider adding escapeXml attribute to security:authentication http://jira.springframework.org/browse/SEC-966. Added escaping of rendered text as default.	18 years ago
Luke Taylor	a4e4120443	SEC-963: LDAP Group Search Root http://jira.springframework.org/browse/SEC-963. Changed namespace instances of DefaultAuthoritiesPopulator to use the root as the default search location.	18 years ago
Luke Taylor	83868a7334	SEC-955: ability to externalize port mapping for secured channel to a property file http://jira.springframework.org/browse/SEC-955. Changed schema to make port-mapping type xsd:string to allow placeholders.	18 years ago
Luke Taylor	150f3d97d0	SEC-832: NamingEnumeration.hasMore fails on MS AD with PartialResultException http://jira.springframework.org/browse/SEC-832. Changed searchForSingleEntry method to ignore PartialResultException, similar to Spring LDAP's approach.	18 years ago
Luke Taylor	7f28a8bc5d	Refactored DefaultLdapAuthoritiesPopulator to remove contextSource field and setter method.	18 years ago
Luke Taylor	1cfd886517	SEC-922: Spring Security should respect Spring XML boolean operators for AJ pointcut http://jira.springframework.org/browse/SEC-922. Added method to substitute boolean operators "and, not, or" with aspectj versions "&&, !, \|\|".	18 years ago
Luke Taylor	bb457e1d07	SEC-957: logger.debug without guard causing massive performance hit http://jira.springframework.org/browse/SEC-957. Added debug logging guard as requested.	18 years ago
Luke Taylor	09cf90258f	SEC-758: Both AspectJSecurityInterceptor and AspectJAnnotationSecurityInterceptor not usable with @AspectJ notation http://jira.springframework.org/browse/SEC-758. Added "throws Throwable" to AspectJAnnotationCallback signature.	18 years ago
Luke Taylor	e15d7a78cd	SEC-956: Remove MapBasedMethodDefinitionSource.lookupAttributes http://jira.springframework.org/browse/SEC-956. Done.	18 years ago
Luke Taylor	3bf5e406b7	SEC-936: NPE in AbstractFallbackMethodDefinitionSource http://jira.springframework.org/browse/SEC-936. Changed to check if the value of MethodInvocation.getThis() is null to prevent NPE. MapBasedMethodDefinitionSource now ignores calls to findAttributes() with a null target class (all its entries require a class) and the fallback option in AbstractFallbackMethodDefinitionSource is used if the targetClass is null (i.e. Method.getDeclaringClass() will be used as the Class)	18 years ago
Luke Taylor	55d357f42d	OPEN - issue SEC-905: <protect-pointcut /> pointcuts do not respect method arguments http://jira.springframework.org/browse/SEC-905. Added extra registration method to MapBasedMethodDefinitionSource which takes a Method instance rather than the method name.	18 years ago

1 2 3 4 5 ...

1721 Commits (2.0.x)