coheigea opened a new pull request, #3658: URL: https://github.com/apache/cxf/pull/3658
setConfidentialClientMethods replaced the set that setSecuredObject fills from @ConfidentialClient annotations, so calling it after the secured object was set let non-confidential clients invoke annotated methods. Calling it before stored the caller's set, into which setSecuredObject then added: an immutable set made startup fail, and a mutable one was changed under the caller. setScopesMap and setScopesMatchAllMap likewise replaced the existing maps, so setScopesMap discarded the scopes added by setScopesStringMap and a method left without scopes could be invoked with any token. Keep the annotated and configured confidential client methods apart, copy the configured set, and make setScopesMap and setScopesMatchAllMap add to the existing entries. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
