mraible commented on code in PR #166:
URL: https://github.com/apache/roller/pull/166#discussion_r3891395611
##########
app/src/main/java/org/apache/roller/weblogger/webservices/atomprotocol/RollerAtomHandler.java:
##########
@@ -118,15 +116,15 @@ public RollerAtomHandler(HttpServletRequest request,
HttpServletResponse respons
roller = WebloggerFactory.getWeblogger();
String userName;
- if
("oauth".equals(WebloggerRuntimeConfig.getProperty("webservices.atomPubAuth")))
{
+ String authenticationMethod =
+ WebloggerRuntimeConfig.getProperty("webservices.atomPubAuth");
+ if ("oauth".equals(authenticationMethod)) {
userName = authenticationOAUTH(request, response);
-
- } else if
("wsse".equals(WebloggerRuntimeConfig.getProperty("webservices.atomPubAuth"))) {
- userName = authenticateWSSE(request);
-
- } else {
- // default to basic
+ } else if ("basic".equals(authenticationMethod)) {
userName = authenticateBASIC(request);
+ } else {
Review Comment:
This is now the only password-based AtomPub path, and it doesn't work:
`authenticateBASIC` (around line 432) checks the password against the instance
field `user`, which is still `null` while the constructor is running, instead
of the `inUser` it just looked up. The NPE is caught and logged at debug, valid
stays false, and every correctly authenticated Basic request gets a 401.
Pre-existing on master, but this PR points former WSSE users at it. The fix is
`inUser.getPassword()` in place of `user.getPassword()`; apache/roller commit
dd2b28397 on feature/jakarta-ee-10-migration has exactly that change plus a
smoke test if you want to cherry-pick.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
