This is an automated email from the ASF dual-hosted git repository.
bmarwell pushed a commit to branch jbake
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/jbake by this push:
new e302fb9 fix some anchors.
e302fb9 is described below
commit e302fb9f99757f210573bf90f4795ecea22b300b
Author: Benjamin Marwell <[email protected]>
AuthorDate: Fri Jan 14 09:28:33 2022 +0100
fix some anchors.
---
jbake/content/authentication.adoc | 2 +-
jbake/content/authorization.adoc | 38 +++++++++++++++++-----------------
jbake/content/caching.adoc | 4 ++--
jbake/content/command-line-hasher.adoc | 2 +-
jbake/content/permissions.adoc | 5 +++--
jbake/content/realm.adoc | 8 +++----
jbake/content/security-reports.adoc | 2 +-
jbake/content/spring-boot.adoc | 3 ++-
jbake/content/spring-framework.adoc | 1 +
9 files changed, 34 insertions(+), 31 deletions(-)
diff --git a/jbake/content/authentication.adoc
b/jbake/content/authentication.adoc
index e3d7349..6e4aa56 100644
--- a/jbake/content/authentication.adoc
+++ b/jbake/content/authentication.adoc
@@ -386,4 +386,4 @@ This is different than implicit realm ordering where all
available realms will b
This chapter covers Shiro's main workflow explaining how an authentication
attempt occurs.
The internal workflow of what happens in a single realm as it is consulted
during authentication (i.e. 'Step 5' above) is covered in the
link:/realm.html[Realm]
-chapter's link:/realm.html#Realm-authentication[Realm Authentication] section.
+chapter's link:/realm.html#Realm-RealmAuthentication[Realm Authentication]
section.
diff --git a/jbake/content/authorization.adoc b/jbake/content/authorization.adoc
index 98fdfb7..fc6c367 100644
--- a/jbake/content/authorization.adoc
+++ b/jbake/content/authorization.adoc
@@ -125,7 +125,7 @@ If you want to control access based on simpler/traditional
implicit role names,
If you want to simply check to see if the current `Subject` has a role or not,
you can call the variant `hasRole*` methods on the `Subject` instance.
-For example, to see if a `Subject` has a particular (single) role, you can
call the `subject.`
link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole-java.lang.String-[`hasRole(roleName)`]
method, and react accordingly:
+For example, to see if a `Subject` has a particular (single) role, you can
call the `subject.`
link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)[`hasRole(roleName)`]
method, and react accordingly:
[source,java]
----
@@ -144,9 +144,9 @@ There are few role-oriented `Subject` methods you can call,
depending on your ne
|===
|Subject Method |Description
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRolejava.lang.String-[`hasRole(String
roleName)`] |Returns `true` if the `Subject` is assigned the specified role,
`false` otherwise.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRoles-java.util.List-[`hasRoles(List<String>
roleNames)`] |Returns a array of `hasRole` results corresponding to the
indices in the method argument. Useful as a performance enhancement if many
role checks need to be performed (e.g. when customizing a complex view)
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasAllRoles-java.util.Collection-[`hasAllRoles(Collection<String>
roleNames)`] |Returns `true` if the `Subject` is assigned _all_ of the
specified roles, `false` otherwise.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)[`hasRole(String
roleName)`] |Returns `true` if the `Subject` is assigned the specified role,
`false` otherwise.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRoles(java.util.List)[`hasRoles(List<String>
roleNames)`] |Returns a array of `hasRole` results corresponding to the
indices in the method argument. Useful as a performance enhancement if many
role checks need to be performed (e.g. when customizing a complex view)
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#hasAllRoles(java.util.Collection)[`hasAllRoles(Collection<String>
roleNames)`] |Returns `true` if the `Subject` is assigned _all_ of the
specified roles, `false` otherwise.
|===
[#Authentication-AuthorizingSubjects-ProgrammaticAuthorization-RoleBasedAuthorization-Assertions]
@@ -173,9 +173,9 @@ There are few role-oriented `Subject` assertion methods you
can call, depending
|===
|Subject Method |Description
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRole-java.lang.String-[`checkRole(String
roleName)`] |Returns quietly if the `Subject` is assigned the specified role
or throws an `AuthorizationException` if not.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRoles-java.util.Collection-[`checkRoles(Collection<String>
roleNames)`] |Returns quietly if the `Subject` is assigned _all_ of the
specified role or throws an `AuthorizationException` if not.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRoles-java.lang.String...-[`checkRoles(String...
roleNames)`] |Same effect as the `checkRoles` method above, but allows Java 5
var-args style arguments.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRole(java.lang.String)[`checkRole(String
roleName)`] |Returns quietly if the `Subject` is assigned the specified role
or throws an `AuthorizationException` if not.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRoles(java.util.Collection)[`checkRoles(Collection<String>
roleNames)`] |Returns quietly if the `Subject` is assigned _all_ of the
specified role or throws an `AuthorizationException` if not.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRoles(java.lang.String...)[`checkRoles(String...
roleIdentifiers)`] |Same effect as the `checkRoles` method above, but allows
Java 5 var-args style arguments.
|===
[#Authentication-AuthorizingSubjects-ProgrammaticAuthorization-PermissionBasedAuthorization]
@@ -214,7 +214,7 @@ Object-based `Permissions` are useful if:
* You want compile-time type-safety
* You want to guarantee permissions are represented and used correctly
-* You want explicit control of how permission resolution logic (called
permission implication logic, based on the Permission interface's
link:static/current/apidocs/org/apache/shiro/authz/Permission.html#implies-org.apache.shiro.authz.Permission-[`implies`]
method) executes.
+* You want explicit control of how permission resolution logic (called
permission implication logic, based on the Permission interface's
link:static/current/apidocs/org/apache/shiro/authz/Permission.html#implies(org.apache.shiro.authz.Permission)[`implies`]
method) executes.
* You want to guarantee Permissions reflect application resources accurately
(for example, maybe Permission classes can be auto-generated during a project's
build based on a project's domain model).
There are few Object permission-oriented `Subject` methods you can call,
depending on your needs:
@@ -222,9 +222,9 @@ There are few Object permission-oriented `Subject` methods
you can call, dependi
|===
|Subject Method |Description
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted-org.apache.shiro.authz.Permission-[`isPermitted(Permission
p)`] |Returns `true` if the `Subject` is permitted to perform an action or
access a resource summarized by the specified `Permission` instance, `false`
otherwise.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted-java.util.List-[`isPermitted(List<Permission>
perms)`] |Returns an array of `isPermitted` results corresponding to the
indices in the method argument. Useful as a performance enhancement if many
permission checks need to be performed (e.g. when customizing a complex view)
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermittedAll-java.util.Collection-[`isPermittedAll(Collection<Permission>
perms)`] |Returns `true` if the `Subject` is permitted _all_ of the specified
permissions, `false` otherwise.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(org.apache.shiro.authz.Permission)[`isPermitted(Permission
p)`] |Returns `true` if the `Subject` is permitted to perform an action or
access a resource summarized by the specified `Permission` instance, `false`
otherwise.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(java.util.List)[`isPermitted(List<Permission>
perms)`] |Returns an array of `isPermitted` results corresponding to the
indices in the method argument. Useful as a performance enhancement if many
permission checks need to be performed (e.g. when customizing a complex view)
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermittedAll(java.util.Collection)[`isPermittedAll(Collection<Permission>
perms)`] |Returns `true` if the `Subject` is permitted _all_ of the specified
permissions, `false` otherwise.
|===
[#Authentication-AuthorizingSubjects-ProgrammaticAuthorization-PermissionBasedAuthorization-StringBasedPermissionChecks]
@@ -275,9 +275,9 @@ Like the Object-based permission check methods, there are
String variants to sup
|===
|Subject Method |Description
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted-java.lang.String-[`isPermitted(String
perm)`] |Returns `true` if the `Subject` is permitted to perform an action or
access a resource summarized by the specified `String` permission, `false`
otherwise.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted-java.util.List-[`isPermitted(String...
perms)`] |Returns an array of `isPermitted` results corresponding to the
indices in the method argument. Useful as a performance enhancement if many
`String` permission checks need to be performed (e.g. when customizing a
complex view)
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermittedAll-java.lang.String...-[`isPermittedAll(String...
perms)`] |Returns `true` if the `Subject` is permitted _all_ of the specified
`String` permissions, `false` otherwise.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(java.lang.String)[`isPermitted(String
perm)`] |Returns `true` if the `Subject` is permitted to perform an action or
access a resource summarized by the specified `String` permission, `false`
otherwise.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(java.util.List)[`isPermitted(String...
perms)`] |Returns an array of `isPermitted` results corresponding to the
indices in the method argument. Useful as a performance enhancement if many
`String` permission checks need to be performed (e.g. when customizing a
complex view)
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermittedAll(java.lang.String...)[`isPermittedAll(String...
perms)`] |Returns `true` if the `Subject` is permitted _all_ of the specified
`String` permissions, `false` otherwise.
|===
[#Authentication-AuthorizingSubjects-ProgrammaticAuthorization-PermissionBasedAuthorization-PermissionAssertions]
@@ -317,10 +317,10 @@ There are few permission-oriented `Subject` assertion
methods you can call, depe
|===
|Subject Method |Description
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermission-org.apache.shiro.authz.Permission-[`checkPermission(Permission
p)`] |Returns quietly if the `Subject` is permitted to perform an action or
access a resource summarized by the specified `Permission` instance, or throws
an `AuthorizationException` if not.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermission-java.lang.String-[`checkPermission(String
perm)`] |Returns quietly if the `Subject` is is permitted to perform an action
or access a resource summarized by the specified `String` permission, or throws
an `AuthorizationException` if not.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermissions-java.util.Collection-[`checkPermissions(Collection<Permission>
perms)`] |Returns quietly if the `Subject` is permitted _all_ the specified
permissions, or throws an `AuthorizationException` if not.
-|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermissions-java.lang.String...-[`checkPermissions(String...
perms)`] |Same effect as the `checkPermissions` method above, but using
`String`-based permissions.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermission(org.apache.shiro.authz.Permission)[`checkPermission(Permission
p)`] |Returns quietly if the `Subject` is permitted to perform an action or
access a resource summarized by the specified `Permission` instance, or throws
an `AuthorizationException` if not.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermission(java.lang.String)[`checkPermission(String
perm)`] |Returns quietly if the `Subject` is is permitted to perform an action
or access a resource summarized by the specified `String` permission, or throws
an `AuthorizationException` if not.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermissions(java.util.Collection)[`checkPermissions(Collection<Permission>
perms)`] |Returns quietly if the `Subject` is permitted _all_ the specified
permissions, or throws an `AuthorizationException` if not.
+|link:static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermissions(java.lang.String...)[`checkPermissions(String...
perms)`] |Same effect as the `checkPermissions` method above, but using
`String`-based permissions.
|===
[#Authentication-AuthorizingSubjects-NotationBasedAuthorization]
@@ -646,4 +646,4 @@ For example, in `shiro.ini`:
authorizer = com.foo.bar.authz.CustomAuthorizer
securityManager.authorizer = $authorizer
-----
\ No newline at end of file
+----
diff --git a/jbake/content/caching.adoc b/jbake/content/caching.adoc
index 28d0f3e..4817c60 100644
--- a/jbake/content/caching.adoc
+++ b/jbake/content/caching.adoc
@@ -103,8 +103,8 @@ TBD
Finally note that
link:static/current/apidocs/org/apache/shiro/realm/AuthorizingRealm.html[`+AuthorizingRealm+`]
has a
-link:static/current/apidocs/org/apache/shiro/realm/AuthorizingRealm.html#clearCachedAuthorizationInfo-org.apache.shiro.subject.PrincipalCollection-[clearCachedAuthorizationInfo
+link:static/current/apidocs/org/apache/shiro/realm/AuthorizingRealm.html#clearCachedAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection)[clearCachedAuthorizationInfo
method] that can be called by subclasses to evict the cached authzInfo
for a particular account. It is usually called by custom logic if the
corresponding account’s authz data has changed (to ensure the next authz
-check will pick up the new data).
\ No newline at end of file
+check will pick up the new data).
diff --git a/jbake/content/command-line-hasher.adoc
b/jbake/content/command-line-hasher.adoc
index 2ac28f4..f688e88 100644
--- a/jbake/content/command-line-hasher.adoc
+++ b/jbake/content/command-line-hasher.adoc
@@ -68,7 +68,7 @@ When this command executes, it will print out the
securely-salted-iterated-and-h
$shiro1$SHA-256$500000$eWpVX2tGX7WCP2J+jMCNqw==$it/NRclMOHrfOvhAEFZ0mxIZRdbcfqIBdwdwdDXW2dM=
----
-Take this value and place it as the password in the user definition line
(followed by any optional roles) as defined in the
link:/configuration.html#Configuration-%5Cusers%5C[INI Users Configuration]
documentation. For example:
+Take this value and place it as the password in the user definition line
(followed by any optional roles) as defined in the
link:/configuration.html#Configuration-INIConfiguration-Sections-users[INI
Users Configuration] documentation. For example:
[source,ini]
----
diff --git a/jbake/content/permissions.adoc b/jbake/content/permissions.adoc
index 092b008..8159397 100644
--- a/jbake/content/permissions.adoc
+++ b/jbake/content/permissions.adoc
@@ -22,9 +22,10 @@ For example, permissions can be grouped in a Role and that
Role could be associa
There are many variations for how permissions could be granted to users - the
application determines how to model this based on the application requirements.
+[#wildcard_permissions]
== Wildcard Permissions
-The above examples of permissions, "Open a file", "View the 'user/list' web
page", etc are all valid permission statements. However, it would be very
difficult computationally to interpret those natural language strings and
determine if a user is allowed to perform that behavior or not.
+The above examples of permissions, "Open a file", "View the 'user/list' web
page", etc are all valid permission statements.However, it would be very
difficult computationally to interpret those natural language strings and
determine if a user is allowed to perform that behavior or not.
So to enable easy-to-process yet still readable permission statements, Shiro
provides powerful and intuitive permission syntax we refer to as the
WildcardPermission.
@@ -32,7 +33,7 @@ So to enable easy-to-process yet still readable permission
statements, Shiro pro
Let's say you want to protect access to your company's printers such that some
people can print to particular printers, while others can query what jobs are
currently in the queue.
-An extremely simple approach would be to grant the user a "queryPrinter"
permission. Then you could check to see if the user has the queryPrinter
permission by calling:
+An extremely simple approach would be to grant the user a "queryPrinter"
permission.Then you could check to see if the user has the queryPrinter
permission by calling:
[source,java]
----
diff --git a/jbake/content/realm.adoc b/jbake/content/realm.adoc
index 7ca142a..5b0e0fc 100644
--- a/jbake/content/realm.adoc
+++ b/jbake/content/realm.adoc
@@ -43,7 +43,7 @@ securityManager.realms = $fooRealm, $barRealm, $bazRealm
----
Explicit assignment is deterministic - you control exactly which realms are
used as well as _the order_ that they will be used for authentication and
authorization.
-Realm ordering effects are described in detail in the Authentication chapter's
link:authentication.html#[[#]]#Authentication-sequence[Authentication Sequence]
section.
+Realm ordering effects are described in detail in the Authentication chapter's
link:authentication.html#Authentication-AuthenticationSequence[Authentication
Sequence] section.
[#Realm-ImplicitAssignment]
=== Implicit Assignment
@@ -91,13 +91,13 @@ Once you understand Shiro's main
link:/authentication.html#Authentication-sequen
[#Realm-Supporting%7B%7BAuthenticationTokens%7D%7D]
=== Supporting `AuthenticationTokens`
-As mentioned in the
link:/authentication.html#[[#]]#Authentication-sequence[authentication
sequence], just before a `Realm` is consulted to perform an authentication
attempt, its
link:static/current/apidocs/org/apache/shiro/realm/Realm.html#[[#]]#supports-org.apache.shiro.authc.AuthenticationToken-[`supports`]
method is called.
+As mentioned in the
link:/authentication.html#Authentication-AuthenticationSequence[authentication
sequence], just before a `Realm` is consulted to perform an authentication
attempt, its
link:static/current/apidocs/org/apache/shiro/realm/Realm.html#supports(org.apache.shiro.authc.AuthenticationToken)[`supports`]
method is called.
If the return value is `true`, only then will its
`getAuthenticationInfo(token)` method be invoked.
Typically a realm will check the type (interface or class) of the submitted
token to see if it can process it.
For example, a Realm that processes biometric data may not understand
`UsernamePasswordTokens` at all, in which case it would return `false` from the
`supports` method.
-[#Realm-Handlingsupported%7B%7BAuthenticationTokens%7D%7D]
+[#Realm-Handling-supported-AuthenticationTokens]
=== Handling supported `AuthenticationTokens`
If a `Realm` `supports` a submitted `AuthenticationToken`, the `Authenticator`
will call the Realm's
link:static/current/apidocs/org/apache/shiro/realm/Realm.html#getAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)[getAuthenticationInfo(token)]
method.
@@ -299,5 +299,5 @@ a. First it gets identify all Permissions assigned to
Subject directly by callin
b. If a
link:/static/current/apidocs/org/apache/shiro/authz/permission/RolePermissionResolver.html[RolePermissionResolver]
is registered, it is used to retrieve Permissions based on all of the roles
assigned to Subject by calling the
`RolePermissionResolver.resolvePermissionsInRole()`
c. For aggregated Permissions from a. and b. the implies() method is called to
check if any of these permission are implied the checked permission.
-See link:/permissions.html#Permissions-WildcardPermissions[WildcardPermission]
+See link:/permissions.html#wildcard_permissions[WildcardPermission]
diff --git a/jbake/content/security-reports.adoc
b/jbake/content/security-reports.adoc
index 4b54934..82e0457 100644
--- a/jbake/content/security-reports.adoc
+++ b/jbake/content/security-reports.adoc
@@ -40,7 +40,7 @@ Apache Shiro before 1.7.1, when using Apache Shiro with
Spring, a specially craf
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially
crafted HTTP request may cause an authentication bypass.
-If you are NOT using Shiro's Spring Boot Starter
(`shiro-spring-boot-web-starter`), you must configure add the
link:/spring-framework.html#SpringFramework-WebConfig[`ShiroRequestMappingConfig`
auto configuration to your application] or configure the
https://github.com/apache/shiro/blob/shiro-root-1.7.0/support/spring/src/main/java/org/apache/shiro/spring/web/config/ShiroRequestMappingConfig.java#L28-L30[equivalent
manually].
+If you are NOT using Shiro's Spring Boot Starter
(`shiro-spring-boot-web-starter`), you must configure add the
link:/spring-framework.html#web_applications[`ShiroRequestMappingConfig` auto
configuration to your application] or configure the
https://github.com/apache/shiro/blob/shiro-root-1.7.0/support/spring/src/main/java/org/apache/shiro/spring/web/config/ShiroRequestMappingConfig.java#L28-L30[equivalent
manually].
===
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13933[CVE-2020-13933]
diff --git a/jbake/content/spring-boot.adoc b/jbake/content/spring-boot.adoc
index e10e88a..a63ebc2 100644
--- a/jbake/content/spring-boot.adoc
+++ b/jbake/content/spring-boot.adoc
@@ -7,6 +7,7 @@
Shiro's Spring-Boot integration is the easiest way to integrate Shiro into a
Spring-base application, for more general Spring Framework integration, take a
the link:spring-framework.html[annotation] or link:spring-xml.html[XML] guides.
+[#web_applications]
== Web Applications
Shiro has first-class support for Spring web applications. In a web
application, all Shiro-accessible web requests must go through a main Shiro
Filter. This filter itself is extremely powerful, allowing for ad-hoc custom
filter chains to be executed based on any URL path expression.
@@ -177,7 +178,7 @@ public Realm realm() {
}
----
-The easiest way to setup Shiro, so that all SecurityUtils.* methods work in
all cases, is to make the `SecurityManager` bean a static singleton. DO NOT do
this in web applications - see the link:#Spring-WebApplications[Web
Applications] section below instead.
+The easiest way to setup Shiro, so that all SecurityUtils.* methods work in
all cases, is to make the `SecurityManager` bean a static singleton. DO NOT do
this in web applications - see the link:#web_applications[Web Applications]
section below instead.
[source,java]
----
diff --git a/jbake/content/spring-framework.adoc
b/jbake/content/spring-framework.adoc
index e39cf8c..83aecc7 100644
--- a/jbake/content/spring-framework.adoc
+++ b/jbake/content/spring-framework.adoc
@@ -76,6 +76,7 @@ SecurityUtils.getSubject();
You can see a full example in our
link:https://github.com/apache/shiro/tree/main/samples/spring[samples on
Github].
+[#web_applications]
== Web Applications
Shiro has first-class support for Spring web applications. In a web
application, all Shiro-accessible web requests must go through a main Shiro
Filter. This filter itself is extremely powerful, allowing for ad-hoc custom
filter chains to be executed based on any URL path expression.
