This is an automated email from the ASF dual-hosted git repository.
Aias00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shenyu.git
The following commit(s) were added to refs/heads/master by this push:
new 9e7d5ffcf8 fix: Enforce account enabled check on every authenticated
request in ShiroRealm [#6399] (#6415)
9e7d5ffcf8 is described below
commit 9e7d5ffcf8357d1dce94f302e21cc007615c756e
Author: hengyuss <[email protected]>
AuthorDate: Sun Jul 5 20:03:17 2026 +0800
fix: Enforce account enabled check on every authenticated request in
ShiroRealm [#6399] (#6415)
Co-authored-by: aias00 <[email protected]>
---
.../org/apache/shenyu/admin/shiro/config/ShiroRealm.java | 4 +++-
.../apache/shenyu/admin/shiro/config/ShiroRealmTest.java | 14 +++++++++++++-
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java
index 2cd6ac1428..ba0af65e51 100644
---
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java
+++
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java
@@ -102,7 +102,9 @@ public class ShiroRealm extends AuthorizingRealm {
if (Objects.isNull(dashboardUserVO)) {
throw new AuthenticationException(String.format("userName(%s) can
not be found.", userName));
}
-
+ if (!Boolean.TRUE.equals(dashboardUserVO.getEnabled())) {
+ throw new AuthenticationException(String.format("user(%s) is
disabled.", userName));
+ }
String clientIdFromToken = JwtUtils.getClientId(token);
if (StringUtils.isNotEmpty(clientIdFromToken)
&& StringUtils.isNotEmpty(dashboardUserVO.getClientId())
diff --git
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/shiro/config/ShiroRealmTest.java
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/shiro/config/ShiroRealmTest.java
index 845bfe2aab..d67fddd57a 100644
---
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/shiro/config/ShiroRealmTest.java
+++
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/shiro/config/ShiroRealmTest.java
@@ -115,7 +115,7 @@ public final class ShiroRealmTest {
AuthenticationException exception3 =
assertThrows(AuthenticationException.class, () -> {
when(dashboardUserService.findByUserName(any())).thenReturn(dashboardUserVO);
- when(dashboardUserVO.getPassword()).thenReturn(PASSWORD);
+ when(dashboardUserVO.getEnabled()).thenReturn(false);
when(token.getCredentials()).thenReturn("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+
".eyJzdWIiOiIxMjM0NTY3ODkwIiwidXNlck5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMn0"
+ ".vZiLpzbncmNC5KL1idgfapCOTsRC0h_5XnqxaGfcLlM");
@@ -123,7 +123,19 @@ public final class ShiroRealmTest {
});
assertNotNull(exception3);
+ AuthenticationException exception4 =
assertThrows(AuthenticationException.class, () -> {
+
when(dashboardUserService.findByUserName(any())).thenReturn(dashboardUserVO);
+ when(dashboardUserVO.getEnabled()).thenReturn(true);
+ when(dashboardUserVO.getPassword()).thenReturn(PASSWORD);
+
when(token.getCredentials()).thenReturn("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+ +
".eyJzdWIiOiIxMjM0NTY3ODkwIiwidXNlck5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMn0"
+ + ".vZiLpzbncmNC5KL1idgfapCOTsRC0h_5XnqxaGfcLlM");
+ shiroRealm.doGetAuthenticationInfo(token);
+ });
+ assertNotNull(exception4);
+
when(dashboardUserService.findByUserName(any())).thenReturn(dashboardUserVO);
+ when(dashboardUserVO.getEnabled()).thenReturn(true);
when(dashboardUserVO.getPassword()).thenReturn(PASSWORD);
when(token.getCredentials()).thenReturn("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+
".eyJzdWIiOiIxMjM0NTY3ODkwIiwidXNlck5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMn0"
