This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 688b394555 Fixed: security.login.externalLoginKey.enabled never
checked by checkExternalLoginKey() and cannot be changed live (OFBIZ-13519)
688b394555 is described below
commit 688b394555d9c5cb384f806132e9a8acc17c33c5
Author: Mridul Pathak <[email protected]>
AuthorDate: Thu Sep 3 18:06:54 2026 +0530
Fixed: security.login.externalLoginKey.enabled never checked by
checkExternalLoginKey() and cannot be changed live (OFBIZ-13519)
isExternalLoginKeyEnabled() cached the property in a static field on first
read and never re-read it, so any later change made no difference until a
process restart. Separately, checkExternalLoginKey() -- the consumption path
wired into the default preprocessor chain used by most controller.xml files --
never called isExternalLoginKeyEnabled() at all; the flag was only ever checked
at the two key-generation call sites. Together this meant an admin disabling
the property got no change [...]
---
.../webapp/control/ExternalLoginKeysManager.java | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ExternalLoginKeysManager.java
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ExternalLoginKeysManager.java
index 010f8ad227..a51eb46524 100644
---
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ExternalLoginKeysManager.java
+++
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ExternalLoginKeysManager.java
@@ -28,7 +28,6 @@ import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.ofbiz.base.util.Debug;
-import org.apache.ofbiz.base.util.UtilValidate;
import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.DelegatorFactory;
import org.apache.ofbiz.entity.GenericValue;
@@ -54,9 +53,6 @@ public class ExternalLoginKeysManager {
// rejecting a second redemption against the same webapp.
private static final Map<String, ExternalLoginTicket> EXTERNAL_LOGIN_KEYS
= new ConcurrentHashMap<>();
- // This variable is set to empty so we know need to read from the
properties file.
- private static String isExternalLoginKeyEnabled = "";
-
/**
* A minted external login key, bound to the UserLogin it authenticates
and to a deadline.
* Optionally bound to a target context path too, for mint sites that know
which webapp the
@@ -164,6 +160,12 @@ public class ExternalLoginKeysManager {
String externalKey = request.getParameter(EXTERNAL_LOGIN_KEY_ATTR);
if (externalKey == null) return "success";
+ if (!isExternalLoginKeyEnabled(request)) {
+ // Feature disabled: don't even look up the ticket, so nothing
about it is consumed.
+ LoginWorker.autoLoginSet(request, response);
+ return "success";
+ }
+
// Look up without removing: the same key is shared across every
cross-webapp link one
// render emits, so it must stay valid for whichever *other*
destination webapps the
// user still hasn't visited yet. redeemFor(), below, is what actually
stops replay --
@@ -239,12 +241,9 @@ public class ExternalLoginKeysManager {
* @return
*/
public static boolean isExternalLoginKeyEnabled(HttpServletRequest
request) {
- if (UtilValidate.isEmpty(isExternalLoginKeyEnabled)) {
- isExternalLoginKeyEnabled =
EntityUtilProperties.getPropertyValue("security",
- "security.login.externalLoginKey.enabled", "true",
- (Delegator) request.getAttribute("delegator"));
- }
- return "true".equals(isExternalLoginKeyEnabled);
+ return "true".equals(EntityUtilProperties.getPropertyValue("security",
+ "security.login.externalLoginKey.enabled", "true",
+ (Delegator) request.getAttribute("delegator")));
}
}
