Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-524: Added "var" attribute to authorize and accesscontrollist JSP tags.

Browse Source 
Allows the result of the boolean condition granting/denying access to be stored in the page context for later use, without having to duplicate the tag.
This commit is contained in:
Luke Taylor
2010-03-24 18:35:17 +00:00
parent 2e2625873c
commit bf91f2ca67
11 changed files with 153 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
itest/web/src/main/resources/log4j.properties
View File

@@ -7,4 +7,5 @@ log4j.appender.stdout.layout.ConversionPattern=%d %p %c - %m%n
log4j.category.org.apache.jasper=INFO
log4j.category.org.apache.directory=ERROR
log4j.category.org.mortbay.log=INFO
log4j.category.httpclient.wire=INFO
log4j.category.org.springframework.security=TRACE

6
itest/web/src/main/webapp/WEB-INF/http-security.xml
View File

@@ -11,10 +11,10 @@
Needs to be supplemented with authentication provider(s)
-->
<http>
<http use-expressions="true">
<intercept-url pattern="/login.jsp*" filters="none" />
<intercept-url pattern="/secure/**" access="ROLE_DEVELOPER,ROLE_USER" />
<intercept-url pattern="/**" access="ROLE_DEVELOPER,ROLE_USER" />
<intercept-url pattern="/secure/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
<intercept-url pattern="/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=true"/>
<http-basic/>

1
itest/web/src/main/webapp/WEB-INF/in-memory-provider.xml
View File

@@ -12,6 +12,7 @@
<user name="miles" password="milespassword" authorities="ROLE_USER,ROLE_JAZZ,ROLE_TRUMPETER"/>
<user name="johnc" password="johncspassword" authorities="ROLE_USER,ROLE_JAZZ,ROLE_SAXOPHONIST"/>
<user name="jimi" password="jimispassword" authorities="ROLE_USER,ROLE_ROCK,ROLE_GUITARIST"/>
<user name="bessie" password="bessiespassword" authorities="ROLE_USER,ROLE_JAZZ,ROLE_SINGER"/>
<user name="theescapist&lt;&gt;&amp;." password="theescapistspassword" authorities="ROLE_USER"/>
</user-service>
</authentication-provider>

19
itest/web/src/main/webapp/WEB-INF/security.tld
View File

@@ -9,7 +9,6 @@
<uri>http://www.springframework.org/security/tags</uri>
<description>
Spring Security Authorization Tag Library
$Id$
</description>
<tag>
@@ -51,6 +50,15 @@
</description>
</attribute>
<attribute>
<name>var</name>
<required>false</required>
<rtexprvalue>false</rtexprvalue>
<description>
A page scoped variable into which the boolean result of the tag evaluation will be written, allowing the
same condition to be reused subsequently in the page without re-evaluation.
</description>
</attribute>
<attribute>
<name>ifNotGranted</name>
@@ -153,6 +161,15 @@
are being evaluated.
</description>
</attribute>
<attribute>
<name>var</name>
<required>false</required>
<rtexprvalue>false</rtexprvalue>
<description>
A page scoped variable into which the boolean result of the tag evaluation will be written, allowing the
same condition to be reused subsequently in the page without re-evaluation.
</description>
</attribute>
</tag>
</taglib>

21
itest/web/src/main/webapp/secure/authorizationTagTestPage.jsp Normal file
View File

@@ -0,0 +1,21 @@
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<html>
<body>
<h1>Authorization Tag Test Page</h1>
<sec:authorize access="hasRole('ROLE_USER')" var="allowed">
Users can see this and 'allowed' variable is ${allowed}.
</sec:authorize>
<sec:authorize access="hasRole('ROLE_X')" var="allowed">
Role X users (nobody) can see this.
</sec:authorize>
Role X expression evaluates to ${allowed}.
</body>
</html>

13
itest/web/src/test/java/org/springframework/security/integration/InMemoryProviderWebAppTests.java
View File

@@ -94,17 +94,4 @@ public class InMemoryProviderWebAppTests extends AbstractWebServerIntegrationTes
tester.gotoPage("secure/index.html");
tester.assertTextPresent("This session has been expired");
}
@Test
public void authenticationTagEscapingWorksCorrectly() {
beginAt("secure/authenticationTagTestPage.jsp");
login("theescapist<>&.", "theescapistspassword");
String response = tester.getServerResponse();
assertTrue(response.contains("This is the unescaped authentication name: theescapist<>&."));
assertTrue(response.contains("This is the unescaped principal.username: theescapist<>&."));
assertTrue(response.contains("This is the authentication name: theescapist&lt;&gt;&amp;&#46;"));
assertTrue(response.contains("This is the principal.username: theescapist&lt;&gt;&amp;&#46;"));
}
}

39
itest/web/src/test/java/org/springframework/security/integration/JspTaglibTests.java Normal file
View File

@@ -0,0 +1,39 @@
package org.springframework.security.integration;
import static org.testng.Assert.*;
import org.testng.annotations.Test;
/**
*
* @author Luke Taylor
*/
public final class JspTaglibTests extends AbstractWebServerIntegrationTests {
@Override
protected String getContextConfigLocations() {
return "/WEB-INF/http-security.xml /WEB-INF/in-memory-provider.xml";
}
@Test
public void authenticationTagEscapingWorksCorrectly() {
beginAt("secure/authenticationTagTestPage.jsp");
login("theescapist<>&.", "theescapistspassword");
String response = tester.getServerResponse();
assertTrue(response.contains("This is the unescaped authentication name: theescapist<>&."));
assertTrue(response.contains("This is the unescaped principal.username: theescapist<>&."));
assertTrue(response.contains("This is the authentication name: theescapist&lt;&gt;&amp;&#46;"));
assertTrue(response.contains("This is the principal.username: theescapist&lt;&gt;&amp;&#46;"));
}
@Test
public void authorizationTagEvaluatesExpressionCorrectlyAndWritesValueToVariable() {
beginAt("secure/authorizationTagTestPage.jsp");
login("bessie", "bessiespassword");
String response = tester.getServerResponse();
assertTrue(response.contains("Users can see this and 'allowed' variable is true."));
assertFalse(response.contains("Role X users (nobody) can see this."));
assertTrue(response.contains("Role X expression evaluates to false"));
}
}