From 70857faa46ab979d723ca2ab3278f7767408c83c Mon Sep 17 00:00:00 2001 From: Scott Andrews Date: Mon, 7 Apr 2008 19:39:29 +0000 Subject: [PATCH] Do not set accessDecisionManager property with default value. Otherwise the first matching type (any or all) will be applied to all subsequent access decisions. --- .../webflow/security/SecurityFlowExecutionListener.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java index 699a914c..59e2c93d 100644 --- a/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java +++ b/spring-webflow/src/main/java/org/springframework/webflow/security/SecurityFlowExecutionListener.java @@ -69,7 +69,9 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter public void decide(SecurityRule rule, Object object) { Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); ConfigAttributeDefinition config = new ConfigAttributeDefinition(getConfigAttributes(rule)); - if (accessDecisionManager == null) { + if (accessDecisionManager != null) { + accessDecisionManager.decide(authentication, object, config); + } else { AbstractAccessDecisionManager abstractAccessDecisionManager; List voters = new ArrayList(); voters.add(new RoleVoter()); @@ -81,9 +83,8 @@ public class SecurityFlowExecutionListener extends FlowExecutionListenerAdapter throw new IllegalStateException("Unknown SecurityRule match type: " + rule.getComparisonType()); } abstractAccessDecisionManager.setDecisionVoters(voters); - accessDecisionManager = abstractAccessDecisionManager; + abstractAccessDecisionManager.decide(authentication, object, config); } - accessDecisionManager.decide(authentication, object, config); } /**