Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2468: JdbcUserDetailsManager#createNewAuthentication uses null credentials

This commit is contained in:
Rob Winch 2014-02-14 16:51:54 -06:00
parent bf2df220ca
commit 65367e6547
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/src/main/java/org/springframework/security/provisioning/JdbcUserDetailsManager.java
View File

@ -221,7 +221,7 @@ public class JdbcUserDetailsManager extends JdbcDaoImpl implements UserDetailsMa
UserDetails user = loadUserByUsername(currentAuth.getName()); UserDetails user = loadUserByUsername(currentAuth.getName());
UsernamePasswordAuthenticationToken newAuthentication = UsernamePasswordAuthenticationToken newAuthentication =
new UsernamePasswordAuthenticationToken(user, user.getPassword(), user.getAuthorities()); new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
newAuthentication.setDetails(currentAuth.getDetails()); newAuthentication.setDetails(currentAuth.getDetails());
return newAuthentication; return newAuthentication;

10
core/src/test/java/org/springframework/security/provisioning/JdbcUserDetailsManagerTests.java
View File

@ -2,6 +2,7 @@ package org.springframework.security.provisioning;
import static org.junit.Assert.*; import static org.junit.Assert.*;
import static org.mockito.Mockito.*; import static org.mockito.Mockito.*;
import static org.fest.assertions.Assertions.assertThat;
import java.util.Collections; import java.util.Collections;
import java.util.HashMap; import java.util.HashMap;
@ -302,6 +303,15 @@ public class JdbcUserDetailsManagerTests {
assertEquals(0, template.queryForList(SELECT_JOE_AUTHORITIES_SQL).size()); assertEquals(0, template.queryForList(SELECT_JOE_AUTHORITIES_SQL).size());
} }
// SEC-2166
@Test
public void createNewAuthenticationUsesNullPasswordToKeepPassordsSave() {
insertJoe();
UsernamePasswordAuthenticationToken currentAuth = new UsernamePasswordAuthenticationToken("joe",null, AuthorityUtils.createAuthorityList("ROLE_USER"));
Authentication updatedAuth = manager.createNewAuthentication(currentAuth, "new");
assertThat(updatedAuth.getCredentials()).isNull();
}
private Authentication authenticateJoe() { private Authentication authenticateJoe() {
UsernamePasswordAuthenticationToken auth = UsernamePasswordAuthenticationToken auth =
new UsernamePasswordAuthenticationToken("joe","password", joe.getAuthorities()); new UsernamePasswordAuthenticationToken("joe","password", joe.getAuthorities());