From 44a541e5c75f3def5bab6e4ee6a8a7608fb985b6 Mon Sep 17 00:00:00 2001
From: Scott Andrews <sandrews@vmware.com>
Date: Tue, 4 Mar 2008 17:03:12 +0000
Subject: [PATCH] authorization comparison reversed in isAuthorizedAll SWF-93
 SWF-486

---
 .../java/org/springframework/webflow/security/SecurityRule.java | 2 +-
 .../org/springframework/webflow/security/SecurityRuleTests.java | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
index 0409625d..0c0d23ed 100644
--- a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
+++ b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityRule.java
@@ -118,7 +118,7 @@ public class SecurityRule {
 	 * @return true if authorized
 	 */
 	private boolean isAuthorizedAll(Collection principalAuthorities) {
-		return getRequiredAuthorities().containsAll(principalAuthorities);
+		return principalAuthorities.containsAll(getRequiredAuthorities());
 	}
 
 	/**
diff --git a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
index b1663f58..83a0c008 100644
--- a/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
+++ b/spring-webflow/src/test/java/org/springframework/webflow/security/SecurityRuleTests.java
@@ -81,6 +81,7 @@ public class SecurityRuleTests extends TestCase {
 		Collection principalAuthorities = new HashSet();
 		principalAuthorities.add("ROLE_USER");
 		principalAuthorities.add("ROLE_SUPERVISOR");
+		principalAuthorities.add("ROLE_NEVERTOBEHAD");
 		return principalAuthorities;
 	}
 }