Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Ben Alex
Ben Alex wrote: I will get started on an 0.8.1.1 release to accommodate the 0.8.1 users. I am having difficulty deploying 0.8.1.1 to SourceForge at present. I'll have another go tomorrow. In the meantime, signed 0.8.1.1 JARs can be downloaded from http://acegisecurity.sourceforge.net/maven/a

Re: [Acegisecurity-developer] Spring 1.2 Support for JDK 1.3

2005-07-12 Thread Scott McCrory
On Wed, 13 Jul 2005 12:49:24 +1000, Ben Alex wrote > Scott McCrory wrote: > > >In short, I'd be just a tiny voice asking for Spring 1.2+ to maintain JDK > >1.3 compatability, but is it too late to decouple Acegi from Spring 1.2+? > > > > > I'll move this to the Spring Developers mailing list, a

[Acegisecurity-developer] Spring 1.2 Support for JDK 1.3

2005-07-12 Thread Ben Alex
Scott McCrory wrote: In short, I'd be just a tiny voice asking for Spring 1.2+ to maintain JDK 1.3 compatability, but is it too late to decouple Acegi from Spring 1.2+? I'll move this to the Spring Developers mailing list, as it's more related to Spring than Acegi Security. Juergen posted an

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Scott McCrory
On Wed, 13 Jul 2005 08:28:18 +1000, Ben Alex wrote > Just for the record, 0.8.2 was motivated as many people were happily > on 0.8.1 but then Spring 1.2 came out and this broke Acegi Security > 0.8.1. The majority of the community wanted 0.8.2 to be released > ASAP which supports Spring 1.2. Th

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Ben Alex
Scott McCrory wrote: On Tue, 12 Jul 2005 09:18:33 -0500, Ray Krueger wrote Yes, unfortunately it does. Acegi 0.8.2 requires Spring 1.2. -Ray Ahh, thought so. No joy for those of us still running in JDK 1.3 containers like Websphere 5. Just a general statement, but there are a LOT

Re: [Acegisecurity-developer] minor concurrency issue in FilterToBeanProxy

2005-07-12 Thread Ben Alex
Sam Perman wrote: I think the following change should fix the problem... assuming my analysis is correct. 1) change FilterToBeanProxy.doInit to a synchronized method 2) inside doInit, test if "initialized" is true before continuing. Hi Sam There was discussion on this list in early June ("B

Re: [Acegisecurity-developer] Contexts left in ThreadLocal, leading to user switching?

2005-07-12 Thread Ben Alex
March, Andres wrote: If this is not in the latest release, I also think it deserves a patch immediately. The new releases 0.7.1 and 0.8.3 correct this bug. Cheers Ben --- This SF.Net email is sponsored by the 'Do More With Dual!' webinar

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Scott McCrory
On Tue, 12 Jul 2005 08:13:09 -1000, Seth Ladd wrote > Luckily the security fix is available for Acegi 0.7.x. That's still > compatible with Spring 1.1.x. True, but that's a stiff downgrade from 0.8.1, especially considering the filter changes. Scott --

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Seth Ladd
Scott McCrory wrote: On Tue, 12 Jul 2005 09:18:33 -0500, Ray Krueger wrote Yes, unfortunately it does. Acegi 0.8.2 requires Spring 1.2. -Ray Ahh, thought so. No joy for those of us still running in JDK 1.3 containers like Websphere 5. Just a general statement, but there are a LOT of comp

RE: [Acegisecurity-developer] Contexts left in ThreadLocal, leading to user switching?

2005-07-12 Thread March, Andres
If this is not in the latest release, I also think it deserves a patch immediately. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Mark St Godard > Sent: Monday, July 11, 2005 7:05 PM > To: acegisecurity-developer@lists.sourceforge.net > Subject:

[Acegisecurity-developer] Optimize ACL on collections

2005-07-12 Thread Paulo Neves
Hi all, I'm testing again ACL, and I have another sugestion for perfomance. When we do AfterInvocationCollectionFiltering, they process a collection and for every object on that colecttion they do 2 querys ( one for object properties and another for obtain acl entry ). If we have 30 objects, ACL

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Scott McCrory
On Tue, 12 Jul 2005 09:18:33 -0500, Ray Krueger wrote > Yes, unfortunately it does. Acegi 0.8.2 requires Spring 1.2. > -Ray Ahh, thought so. No joy for those of us still running in JDK 1.3 containers like Websphere 5. Just a general statement, but there are a LOT of companies running lots of W

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Ray Krueger
Yes, unfortunately it does. Acegi 0.8.2 requires Spring 1.2. -Ray On 7/12/05, Scott McCrory <[EMAIL PROTECTED]> wrote: > Ben, >Thanks for the quick attention to a security fix release, but I'm getting > an error with the upgrade from 0.8.1: > > org.springframework.beans.factory.BeanCreationEx

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Mark St Godard
Wasnt the AntPathMatcher refactored and added to the Spring 1.2 RC2 ? If so, what version of Spring are you using? Mark "Scott McCrory" <[EMA

Re: [Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Scott McCrory
Ben, Thanks for the quick attention to a security fix release, but I'm getting an error with the upgrade from 0.8.1: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'filterChainProxy' defined in class path resource [passport/resources/security/securityA

[Acegisecurity-developer] minor concurrency issue in FilterToBeanProxy

2005-07-12 Thread Sam Perman
I've deployed my FilterToBeanProxy to be initialized lazily (I'm using struts). The index page for my webapp loads two frames. Since the index page is cached by the browser, it is not served by the webapp (and therefore doesn't trigger the initialization of FilterToBeanProxy). The two frames

Re: [Acegisecurity-developer] Any support for multiple login page s ?

2005-07-12 Thread Ben Alex
Joseph Dane wrote: a somewhat related issue that I'm going to need to address soon is multiple "default targets". that is, say you've got three classes of users, and you want to provide a different "home" URL for each. each might hit the same login page (or not) but after the successful login

Re: [Acegisecurity-developer] Contexts left in ThreadLocal, leading to user switching?

2005-07-12 Thread Ben Alex
Mark St Godard wrote: Ben, what is the roadmap / timelines for 0.9 ?August -ish? Within the next fortnight. I hope to get into the JIRA issues in the next couple of days and then allow some time for stabilization before the official cut. Cheers Ben

[Acegisecurity-developer] Security advisory for all Acegi Security users

2005-07-12 Thread Ben Alex
Dear Spring Community A potentially serious bug has been identified in existing releases of Acegi Security (http://opensource.atlassian.com/projects/spring/browse/SEC-20). New and supported releases (0.7.1 and 0.8.3) are now available that correct this issue. We urge all users to upgrade as s