mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-07-16 15:23:31 +00:00
55d6d5a86a
In 3.1 the accesscontrollist tag began performing an and on the permissions. This may have been accidental, but I think that it is more intuitive & secure for it to behave this way. When compared to hasAnyRole and hasRoles the hasPermission tag implies it is an and. If users end up needing OR support, then the authorize tag can be used along with the hasPermission expression. For example: <sec:authorize access="hasPermission(#domain, 'read') or hasPermission(#domain, 'write') "> In general, the authorize tag should be preferred as it is the more powerful way of performing authorization checks.
===============================================================================
SPRING SECURITY - README FILE
===============================================================================
-------------------------------------------------------------------------------
OVERVIEW
-------------------------------------------------------------------------------
Spring Security provides security services for the Spring Framework
(http://www.springframework.org). Spring Security 3.1 requires Spring 3.0.3 as
a minimum and also requires Java 5.
For a detailed list of features and access to the latest release, please visit
http://www.springframework.org/projects/.
Spring Security is released under an Apache 2.0 license. See the accompanying
license.txt file.
-------------------------------------------------------------------------------
BUILDING
-------------------------------------------------------------------------------
Please read the "Building from Source" page at
http://static.springframework.org/spring-security/site/.
-------------------------------------------------------------------------------
DOCUMENTATION
-------------------------------------------------------------------------------
Be sure to read the Reference Guide (docs/reference/html/springsecurity.html).
Extensive JavaDoc for the Spring Security code is also available (in docs/apidocs).
Both can also be found on the website.
-------------------------------------------------------------------------------
QUICK START
-------------------------------------------------------------------------------
We recommend you visit http://static.springframework.org/spring-security/site and
read the "Getting Started" page.
-------------------------------------------------------------------------------
MAVEN REPOSITORY DOWNLOADS
-------------------------------------------------------------------------------
Release jars for the project are available from the central maven repository
https://repo1.maven.org/maven2/org/springframework/security/
Note that milestone releases and snapshots are not uploaded to the central
repository, but can be obtained from the Spring milestone repository, using the
maven repository http://maven.springframework.org/snapshot/. You can't browse this
URL directly, but there is a separate browser interface. Check the downloads page
for more information
http://static.springsource.org/spring-security/site/downloads.html
-------------------------------------------------------------------------------
OBTAINING SUPPORT
-------------------------------------------------------------------------------
There are two types of support available, commercial and community. For
commercial support, please contact SpringSource. SpringSource employ the
people who wrote Spring Security, and lead the development of the project:
http://www.springsource.com
For peer help and assistance, please use the Spring Security forum
located at the Spring Community's forum site:
http://forum.springframework.org
Links to the forums, and other useful resources are
available from the web site.
-------------------------------------------------------------------------------
CONTRIBUTING
-------------------------------------------------------------------------------
Contributions are welcome. Please refer to the Contributor Guidelines for details
https://github.com/SpringSource/spring-security/wiki/Contributor-Guidelines