On Fri, 30 Mar 2001, Bill Claypool wrote: > On Fri, Mar 30, 2001 at 01:47:45PM -0800, Craig R. McClanahan wrote: > " On Fri, 30 Mar 2001, Bill Claypool wrote: > " > " > On Mon, Mar 26, 2001 at 08:02:18PM -0000, [EMAIL PROTECTED] wrote: > " > " craigmcc 01/03/26 12:02:17 > " > " > " > " Modified: catalina/src/share/org/apache/catalina/connector > " > " HttpRequestBase.java > " > " Log: > " > " Correct the implementation of HttpServletRequest.isUserInRole() so that it > " > " properly respects role name aliases defined with <security-role-ref>. > " > > " > Shouldn't this check for a mapped role first and only check for the > " > unmapped role if there is no mapping. > " > > " > " It is not clear to me that the order of checking would make any difference > " in the result (except for a possible minor performance difference). Is > " there a use case where the order matters? > > webapp role foo mapped to bar. > security realm has roles foo and bar both defined. Yep, that will certainly do it ... plus a closer reading of the spec language (12.3) also makes it clear that the checking order needs to be reversed. See next CVS commit. > > -- > Bill Claypool | Seeing is believing in the things you see. > [EMAIL PROTECTED] | Loving is believing in the ones you love. > 1 916 928 6259 | RKBA! -Margie Adam > Craig
