spring-security

Commit Graph

Author	SHA1	Message	Date
Joe Grandja	5b023d0abc	Fix Security version tests -> 5.1	8 years ago
Johnny Lim	57353d18e5	Use diamond type	8 years ago
Johnny Lim	b6895e6359	Apply Checkstyle WhitespaceAfterCheck module	8 years ago
Johnny Lim	d900f2a623	Remove unused imports This commit also adds UnusedImportsCheck Checkstyle module.	8 years ago
Rob Winch	23f56f568c	Update MockitJunitRunner import Issue: gh-4608	8 years ago
Rob Winch	445834784a	Update to Mockito 2.10.0 Issue: gh-4608	8 years ago
Rob Winch	e16b8e7976	Fix logback-test.xml	9 years ago
Rob Winch	4f265c8fbc	Update taglib version	9 years ago
Rob Winch	b4ab0483b1	Update version to 4.2.0.BUILD-SNAPSHOT	10 years ago
Eddú Meléndez	a2ead4cf7a	Polish Fixes gh-3892	10 years ago
Rob Winch	f221920a19	Clean up code to conform to basic checkstyle Issue gh-3746	10 years ago
Billy Korando	71d4ce96ad	Convert to assertj Fixes gh-3175	10 years ago
Rob Winch	bb600a473e	Start AssertJ Migration Issue gh-3175	10 years ago
Rob Winch	8b641e5f79	SEC-2190: Support WebApplicationContext in ServletContext attribute	10 years ago
Rob Winch	26ab012b57	Start 4.1.0	11 years ago
Thomas Darimont	ad1d858e2b	SEC-3056 - Fix JavaDoc errors. Fixed JavaDoc errors accross multiple modules in order to make javadoc happy with Java 8.	11 years ago
Rob Winch	ae6af5d73c	SEC-2915: Updated Java Code Formatting	11 years ago
Rob Winch	0a2e496a84	SEC-2915: groovy/gradle spaces->tabs	11 years ago
Rob Winch	6e204fff72	SEC-2781: Remove deprecations	11 years ago
Rob Winch	55d6d5a86a	SEC-2615: accesscontrollist tag hasPermission performs OR not AND In 3.1 the accesscontrollist tag began performing an and on the permissions. This may have been accidental, but I think that it is more intuitive & secure for it to behave this way. When compared to hasAnyRole and hasRoles the hasPermission tag implies it is an and. If users end up needing OR support, then the authorize tag can be used along with the hasPermission expression. For example: <sec:authorize access="hasPermission(#domain, 'read') or hasPermission(#domain, 'write') "> In general, the authorize tag should be preferred as it is the more powerful way of performing authorization checks.	11 years ago
Rob Winch	32d3e29c65	SEC-2325: Polish CSRF Tag support - Rename csrfField to csrfInput - Make AbstractCsrfTag package scope - rename FormFieldTag to CsrfInputTag - rename MetaTagsTag to CsrfMetaTagsTag - removed whitespace from tag output so output is minimized & improving browser performance - Update @since - changed test names to be more meaningful	12 years ago
beamerblvd	a3e0475998	SEC-2325 Added JSP tags for CSRF meta tags and form fields	12 years ago
Rob Winch	6dfdb10e31	Fix move to 4.0	12 years ago
Rob Winch	d33b9e2854	SEC-2324: Update Spring Security tld version	13 years ago
Rob Winch	f38df99730	SEC-2045: AbstractAuthorizeTag supports custom WebInvocationPrivilegeEvaluator	13 years ago
Rob Winch	f441c352f6	Clean up warnings in AccessControlListTagTests	14 years ago
Rob Winch	4b86d49a9a	SEC-2023: AccessControlListTag again supports bitmasks Spring Security 3.1 has a regression i the AccessControlListTag which should support using the bitmask in hasPermission. Now hasPermission supports bit masks again.	14 years ago
Rob Winch	b481a6c1ad	SEC-2022: AccessControlListTag again supports , separated list of permissions Spring Security 3.0.x allowed developers to pass in a , separated list of permissions. However, this functionality was accidentally removed in SEC-1560. The AcessControlListTag now splits the permissions using , as a delimiter which fixes this passivity issue.	14 years ago
Rob Winch	b626a63b85	Suppress warnings in AbstractAuthorizeTag and AuthorizeTagCustomGrantedAuthorityTests	14 years ago
Christian Hilmersson	d57f1d56d5	SEC-1900: AbstractAuthorizeTag now compares using getAuthority() This avoids backwards compatibility issues with other GrantedAuthority implementations.	14 years ago
Rob Winch	8ca2927761	Renamed /Test.java to /Tests.java to better follow conventions	14 years ago
Luke Taylor	178765cf83	SEC-1836: Forgot taglib comment update.	14 years ago
Luke Taylor	fc399af136	SEC-1836: use GET as the default method with authorize tag.	14 years ago
Luke Taylor	503ac9ae7c	SEC-1798: Remove internal evaluation of EL in JSP tag implementations.	15 years ago
Luke Taylor	74daa68691	SEC-1796: Check for annotated annotations at class/interface level. Previously only the specific security annotation was checked for. By delegating to Spring's AnnotationUtils, custom annotations carrying the security annotation are also detected.	15 years ago
Luke Taylor	63f160dc72	SEC-1749: Add support for PageContext lookup of objects and use of PermissionEvaluator when using web access expressions.	15 years ago
Luke Taylor	ce19b470e2	SEC-1560: Change AccessControlListTag to use PermissionEvaluator rather than explicit ACL classes.	15 years ago
Luke Taylor	94b7868039	SEC-1675: Add missing body-content elements to tag descriptor and update it to use 2.0 tag library schema.	15 years ago
Luke Taylor	00200cecbc	SEC-1494: Added system property "spring.security.disableUISecurity" which will prevent authorize tags from hiding content. By default, the property will also cause the area that would normally be hidden to be decorated with a <span class="securityHiddenUI"> tag, thus allowing the area to be rendered with some distinguishing css (e.g. a different background colour).	15 years ago
Luke Taylor	85d685f7d3	SEC-1611: Make access attribute in authorize tag a runtime expression	15 years ago
Luke Taylor	4a40d80da1	SEC-1418: Deprecate GrantedAuthorityImpl in favour of final SimpleGrantedAuthority. It should be noted that equality checks or lookups with Strings or other authority types will now fail where they would have succeeded before.	15 years ago
Luke Taylor	4ad0652787	Removed array of authorities constructor from TestingAuthenticationToken and RunAsUserToken.	15 years ago
Luke Taylor	ca679e1479	Reformatting.	15 years ago
Luke Taylor	1c8d28501c	SEC-1550: Convert signatures to use Collection<? extends GrantedAuthority> where appropriate.	15 years ago
Rossen Stoyanchev	bd84a2bfa1	SWC-1552 Update .tld in integration test to match change in taglib.	15 years ago
Rossen Stoyanchev	70600a0277	SEC-1552 Refactor AuthorizeTag and LegacyAuthorize tag to make them independent of JSP tag rendering.	15 years ago
Luke Taylor	af56f4844d	SEC-1562: Created SecurityExpressionHandler interface and AbstractSecurityExpressionHandler.	16 years ago
Luke Taylor	3c02989d67	Removal of jmock test dependency and upgrading of mockito version to 1.8.5. Minor adjustments to other build deps and configurations (e.g. prevent groovy from being used as a transitive dep, since we only use it for tests).	16 years ago
Luke Taylor	85c4c91e0e	IDEA inspection refactorings.	16 years ago
Luke Taylor	36e0fb6d91	SEC-1518: Fix element ordering in security.tld	16 years ago

1 2

87 Commits (ec46b7dbe1d48ef8cd4dc730369bb97dfdf2823c)