Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do not setAuthenticated(false) in the event of a public (unsecured) invocation. Thanks to Joseph Dane for reporting this issue on acegisecurity-developer on 3 September 2005.

This commit is contained in:
Ben Alex 2005-09-08 09:32:24 +00:00
parent 1bd4d0beca
commit c7dcceb05c
1 changed files with 0 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
core/src/main/java/org/acegisecurity/intercept/AbstractSecurityInterceptor.java
View File

@ -466,19 +466,6 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean,
this.context.publishEvent(new PublicInvocationEvent(object));
// Set Authentication object (if it exists) to be unauthenticated
if (SecurityContextHolder.getContext().getAuthentication() != null) {
if (logger.isDebugEnabled()) {
logger.debug(
"Authentication object detected and tagged as unauthenticated");
}
Authentication authenticated = SecurityContextHolder.getContext()
.getAuthentication();
authenticated.setAuthenticated(false);
SecurityContextHolder.getContext().setAuthentication(authenticated);
}
return null; // no further work post-invocation
}
}