[
https://issues.apache.org/jira/browse/WW-4117?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13689399#comment-13689399
]
Cam Morris edited comment on WW-4117 at 6/20/13 4:57 PM:
---------------------------------------------------------
I disagree, I don't think it complicates the logic much to allow for both. But
we can agree to disagree agreeably. Although I agree with the Role-soup
concern, as a best practice we should stick to one or the other. So I see the
merit with forcing that.
When overriding isAllowed, I didn't have access to the allowed or disallowed
roles (private members) without also extending the setters for both and
capturing them, any suggestions? I suppose that isn't a big deal, but storing
the dissallowed and allowed roles twice seemed a bit overkill.
was (Author: cmorris_partnet):
I disagree, I don't think it complicates the logic much to allow for both.
But we can agree to disagree agreeably.
When overriding isAllowed, I didn't have access to the allowed or disallowed
roles (private members) without also extending the setters for both and
capturing them, any suggestions? I suppose that isn't a big deal, but storing
the dissallowed and allowed roles twice seemed a bit overkill.
> RolesInterceptor ignores disallowedRoles when allowedRoles are configured
> -------------------------------------------------------------------------
>
> Key: WW-4117
> URL: https://issues.apache.org/jira/browse/WW-4117
> Project: Struts 2
> Issue Type: Bug
> Components: Core Interceptors
> Reporter: Cam Morris
> Fix For: 2.3.16
>
> Attachments: patch.txt
>
>
> The isAllowed method of RolesInterceptor does not enforce the disallowedRoles
> when allowedRoles are configured. ex:
> {code}
> <interceptor-ref name="roles">
> <param name="allowedRoles">authenticated</param>
> <param name="disallowedRoles">restrictedUser</param>
> </interceptor-ref>
> {code}
> With the above configuration a user with the roles "authenticated", and
> "restrictedUser" would be granted access.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
