Rob Winch 55d6d5a86a SEC-2615: accesscontrollist tag hasPermission performs OR not AND ...

In 3.1 the accesscontrollist tag began performing an and on the
permissions. This may have been accidental, but I think that it is more
intuitive & secure for it to behave this way. When compared to hasAnyRole
and hasRoles the hasPermission tag implies it is an and. If users end up
needing OR support, then the authorize tag can be used along with the
hasPermission expression. For example:

  <sec:authorize access="hasPermission(#domain, 'read') or hasPermission(#domain, 'write') ">

In general, the authorize tag should be preferred as it is the more
powerful way of performing authorization checks.

2014-11-18 16:59:46 -06:00

..

src/asciidoc

SEC-2615: accesscontrollist tag hasPermission performs OR not AND

2014-11-18 16:59:46 -06:00