Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2615: accesscontrollist tag hasPermission performs OR not AND

Browse Source 
In 3.1 the accesscontrollist tag began performing an and on the
permissions. This may have been accidental, but I think that it is more
intuitive & secure for it to behave this way. When compared to hasAnyRole
and hasRoles the hasPermission tag implies it is an and. If users end up
needing OR support, then the authorize tag can be used along with the
hasPermission expression. For example:

  <sec:authorize access="hasPermission(#domain, 'read') or hasPermission(#domain, 'write') ">

In general, the authorize tag should be preferred as it is the more
powerful way of performing authorization checks.
This commit is contained in:
Rob Winch
2014-11-18 16:59:46 -06:00
parent f20219d541
commit 55d6d5a86a
3 changed files with 42 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
taglibs/src/main/java/org/springframework/security/taglibs/authz/AccessControlListTag.java
View File

@@ -32,7 +32,7 @@ import java.util.*;
/**
* An implementation of {@link Tag} that allows its body through if some authorizations are granted to the request's
* An implementation of {@link Tag} that allows its body through if all authorizations are granted to the request's
* principal.
* <p>
* One or more comma separate numeric are specified via the {@code hasPermission} attribute. The tag delegates