From 6409f140e0e2b5a23952a63032c303f6a600c89d Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Fri, 8 Aug 2008 16:44:13 +0000 Subject: [PATCH] SEC-902: Changed Ntlm entry point to send 403 if no failure URL set --- .../ntlm/NtlmProcessingFilterEntryPoint.java | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/ntlm/src/main/java/org/springframework/security/ui/ntlm/NtlmProcessingFilterEntryPoint.java b/ntlm/src/main/java/org/springframework/security/ui/ntlm/NtlmProcessingFilterEntryPoint.java index fad6e2cabc..1361053d6f 100755 --- a/ntlm/src/main/java/org/springframework/security/ui/ntlm/NtlmProcessingFilterEntryPoint.java +++ b/ntlm/src/main/java/org/springframework/security/ui/ntlm/NtlmProcessingFilterEntryPoint.java @@ -40,7 +40,7 @@ import javax.servlet.http.HttpServletResponse; * @author Edward Smith * @version $Id$ */ -public class NtlmProcessingFilterEntryPoint implements AuthenticationEntryPoint, InitializingBean { +public class NtlmProcessingFilterEntryPoint implements AuthenticationEntryPoint { //~ Static fields/initializers ===================================================================================== private static final Log logger = LogFactory.getLog(NtlmProcessingFilterEntryPoint.class); @@ -52,20 +52,13 @@ public class NtlmProcessingFilterEntryPoint implements AuthenticationEntryPoint, //~ Methods ======================================================================================================== - /** - * Ensures an authentication failure URL has been provided in the bean - * configuration file. - */ - public void afterPropertiesSet() throws Exception { - Assert.hasLength(authenticationFailureUrl, "authenticationFailureUrl must be specified"); - } - /** * Sets the authentication failure URL. * * @param authenticationFailureUrl the authentication failure URL. */ public void setAuthenticationFailureUrl(String authenticationFailureUrl) { + Assert.hasLength(authenticationFailureUrl, "authenticationFailureUrl must be specified"); this.authenticationFailureUrl = authenticationFailureUrl; } @@ -102,6 +95,14 @@ public class NtlmProcessingFilterEntryPoint implements AuthenticationEntryPoint, resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED); resp.setContentLength(0); resp.flushBuffer(); + + return; + } + + if (authenticationFailureUrl == null) { + if (!response.isCommitted()) { + ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN, authException.getMessage()); + } } else { String url = authenticationFailureUrl; if (!url.startsWith("http://") && !url.startsWith("https://")) {