mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-06-28 14:52:24 +00:00
SEC-266: Handle -1 allowing unlimited logins, as per JavaDocs.
This commit is contained in:
parent
501eaadd09
commit
d795836bf1
@ -121,7 +121,11 @@ public class ConcurrentSessionControllerImpl
|
|||||||
"getMaximumSessionsForThisUser() must return either -1 to allow unlimited logins, or a positive integer to specify a maximum");
|
"getMaximumSessionsForThisUser() must return either -1 to allow unlimited logins, or a positive integer to specify a maximum");
|
||||||
|
|
||||||
if (sessionCount < allowableSessions) {
|
if (sessionCount < allowableSessions) {
|
||||||
|
// They haven't got too many login sessions running at present
|
||||||
return;
|
return;
|
||||||
|
} else if (allowableSessions == -1) {
|
||||||
|
// We permit unlimited logins
|
||||||
|
return;
|
||||||
} else if (sessionCount == allowableSessions) {
|
} else if (sessionCount == allowableSessions) {
|
||||||
// Only permit it though if this request is associated with one of the sessions
|
// Only permit it though if this request is associated with one of the sessions
|
||||||
for (int i = 0; i < sessionCount; i++) {
|
for (int i = 0; i < sessionCount; i++) {
|
||||||
|
Loading…
x
Reference in New Issue
Block a user