Rob Winch
10e6a6f943
Remove compile warnings in AspectJMethodSecurityInterceptorTests
14 years ago
Rob Winch
9a9aafaeec
SEC-1967: Restore original SecurityContext in finally when RunAsManager is used
...
Previously subclasses of AbstractSecurityInterceptor did not restore the original
Authentication when RunAsManager was used and an Exception was thrown in the
original method.
AbstractSecurityInterceptor has added a new method finallyInvocation which
should be invoked in a finally block immediately after the original invocation
which will restore the original Authentication. All existing sub classes have
been updated to use this new method.
14 years ago
Rob Winch
1d701a2d8f
SEC-2012: Remove additional incorrect javadoc from UserDetails#getPassword()
14 years ago
Rob Winch
b4fbabdbfd
SEC-2012: Remove incorrect javadoc from UserDetails#getPassword()
...
Previously the javadoc stated that password could not be null. However,
since the introduction of CredentialsContainer introduced in SEC-1493 the
password can be null.
The changes remove the statement that passwords cannot be null. While this
is a non-passive change to the interface, the current state leaves no choice
for a non-passive change. Removing the javadoc was determined the better
option since erasing the credentials was an explicit feature request. Note
that replacing the password with an obscure String can be risky as it
introduces the risk that the value is used to authenticate.
14 years ago
Rob Winch
638e92a3f7
SEC-1992: Updated Spring version to 3.0.7
14 years ago
Rob Winch
f2345fcb21
SEC-1981: Remove dependency on Locale for the build
14 years ago
Rob Winch
a2452ab514
SEC-1906: Update to Gradle 1.0
14 years ago
Rob Winch
8b05d23832
SEC-1971: Allow injection of ExpressionParser in AbstractSecurityExpressionHandler
14 years ago
Luke Taylor
5d71d2a4fa
SEC-1887: Add MethodSecurityOperations interface.
...
This should cater for implementations which want to use
the full filtering capabilities while creating a custom
expression root object.
Also cleaning whitespace.
14 years ago
Andrei Stefan
0f9ee81df1
SEC-1887: Improve extensibility of expression-based security classes
...
Introduces a new SecurityExpressionOperations interface which is
implemented by SecurityExpressionRoot
14 years ago
Luke Taylor
f97463cdb5
Minor comment fixes
14 years ago
Rob Winch
1f835fec43
SEC-1867: Perform null check on Authentication.getCredentials() prior to calling toString()
14 years ago
Rob Winch
8ca2927761
Renamed **/Test.java to **/Tests.java to better follow conventions
14 years ago
Rob Winch
3dca70403d
Suppress compiler warnings and minor javadoc fix for ProviderManager
14 years ago
Luke Taylor
8fd2963e6b
Deprecate storage of Authentication object in AuthenticationException.
14 years ago
Luke Taylor
bce4d81142
Mark overriding "extraInformation" methods in account status exceptions as deprecated.
14 years ago
Luke Taylor
2953f56b2b
Remove ancient code formatter artifacts.
14 years ago
Luke Taylor
44364d0101
SEC-1826: Empty attribute list should be treated the same as null in DelegatingMethodSecurityMetadataSource.
14 years ago
Luke Taylor
be8ee61f82
PreInvocationAuthorizationAdviceVoter was checking the wrong type in its "supports" method.
...
This isn't actually used, but is still incorrect.
14 years ago
Luke Taylor
359bd7c468
SEC-1804: Updated Javadoc wrt immutability of User class.
15 years ago
Luke Taylor
8ce6c73802
Add check for empty attributes list as well as null, in DelegatingMethodSecurityMetadataSource
15 years ago
Luke Taylor
d6b7b52a79
Update to Spring 3.0.6.
15 years ago
Luke Taylor
a4c05239e5
SEC-1719: Lithuanian messages translation.
15 years ago
Luke Taylor
59a07175a6
SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider.
15 years ago
Luke Taylor
5fce0a58bd
SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread.
15 years ago
Luke Taylor
249610c7ed
SEC-1742: Remove deprecated "includeDetailsObject" field from DaoAuthenticationProvider.
15 years ago
Luke Taylor
1976cb1bf7
SEC-1742: Deprecate use of extraInformation field in AuthenticationException, making it transient and removing any sensitive data in UserDetails objects which are stored in it.
15 years ago
Luke Taylor
74daa68691
SEC-1796: Check for annotated annotations at class/interface level. Previously only the specific security annotation was checked for. By delegating to Spring's AnnotationUtils, custom annotations carrying the security annotation are also detected.
15 years ago
Rob Winch
7399c9a7a5
SEC-1792: Fixed NullPointerException in RunAsUserToken#toString()
15 years ago
Rob Winch
dfd467f26e
cleaned imports in RunAsUserToken
15 years ago
Luke Taylor
56e86dd36f
Adding assertions on constructor arg values.
15 years ago
Luke Taylor
2d271666a4
Add constructors to facilitate constructor-based injection for required/shared bean properties.
15 years ago
Rob Winch
c3a3a5bfbf
Updated core.gradle to include crypto as referenced project in eclipse
15 years ago
Luke Taylor
d253f5e109
SEC-1768: Use AopProxyUtils.ultimateTargetClass() to cater for the situation where the security interceptor is being applied to a proxy.
15 years ago
Luke Taylor
571bfc4869
Refactoring to use Utf8 encoder instead of String.getBytes("UTF-8").
15 years ago
Luke Taylor
361b77685d
Add crypto as an exported dependency of core in IDEA configuration.
15 years ago
Luke Taylor
2b8d4684a1
SEC-1764: Ensure password encoders use UTF-8 charset when creating strings from byte arrays.
15 years ago
Luke Taylor
e27f655e9d
SEC-1689: Re-instate crypto as separate library (for use in non-Spring Security apps), as well as packaging with core.
15 years ago
Luke Taylor
6d04670f87
SEC-1695: Allow customization of the session key under which the SecurityContext is stored.
15 years ago
Luke Taylor
42e0e158b4
Simplify Digester utility class.
15 years ago
Luke Taylor
21295a58e5
SEC-1751: Applied patch to use zero-IV for queryable text encryption.
15 years ago
Luke Taylor
5a4aed238c
SEC-1752: Fixed Utf8 codec to take account of the limit of the ByteBuffer returned by CharsetEncoder.encode().
15 years ago
Luke Taylor
63f160dc72
SEC-1749: Add support for PageContext lookup of objects and use of PermissionEvaluator when using web access expressions.
15 years ago
Luke Taylor
c758f36629
Forgot to add version information test previously
15 years ago
Luke Taylor
295ea27526
SEC-1743: Separate remoting from core into separate module.
15 years ago
Luke Taylor
396eced291
Add test to check version information.
15 years ago
Luke Taylor
6a2a636fd7
Update Javadoc for UserDetailsManager to reflect that the new password doesn't need to be stored in the security context (and probably shouldn't be).
15 years ago
Luke Taylor
a2858240f1
SEC-1728: Remove references to SUN provider and incorrect seeding of SecureRandom in SecureRandomBytesKeyGenerator.
15 years ago
Luke Taylor
73fb1764b8
SEC-1730: Fix broken KeyGenerators method.
15 years ago
Luke Taylor
614d8c0321
SEC-1723: Use standard SpEL syntax for accessing beans in the app context by name.
15 years ago