Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-30 15:52:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-996: AccessDeniedhandlerimpl doesn't write response code if used with errorPage

Browse Source 
Applied supplied patch which checks the committed flag before forwarding to the error page.
This commit is contained in:
Luke Taylor 2008-12-10 12:36:59 +00:00
parent 7fe6a0fc0d
commit acfcac4594
1 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
core/src/main/java/org/springframework/security/ui/AccessDeniedHandlerImpl.java
View File

@ -55,19 +55,22 @@ public class AccessDeniedHandlerImpl implements AccessDeniedHandler {
public void handle(ServletRequest request, ServletResponse response, AccessDeniedException accessDeniedException) public void handle(ServletRequest request, ServletResponse response, AccessDeniedException accessDeniedException)
throws IOException, ServletException { throws IOException, ServletException {
if (!response.isCommitted()) {
if (errorPage != null) { if (errorPage != null) {
// Put exception into request scope (perhaps of use to a view) // Put exception into request scope (perhaps of use to a view)
((HttpServletRequest) request).setAttribute(SPRING_SECURITY_ACCESS_DENIED_EXCEPTION_KEY, request.setAttribute(SPRING_SECURITY_ACCESS_DENIED_EXCEPTION_KEY, accessDeniedException);
accessDeniedException);
// Perform RequestDispatcher "forward" // Set the 403 status code.
RequestDispatcher rd = request.getRequestDispatcher(errorPage); HttpServletResponse resp = (HttpServletResponse) response;
rd.forward(request, response); resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
// forward to error page.
RequestDispatcher dispatcher = request.getRequestDispatcher(errorPage);
dispatcher.forward(request, response);
} else {
HttpServletResponse resp = (HttpServletResponse) response;
resp.sendError(HttpServletResponse.SC_FORBIDDEN, accessDeniedException.getMessage());
} }
if (!response.isCommitted()) {
// Send 403 (we do this after response has been written)
((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN, accessDeniedException.getMessage());
} }
} }