Indeed this check looks wrong. Please file a ticket in our Jira to fix it. On Wed, Aug 17, 2011 at 4:11 PM, [email protected] <[email protected]> wrote: > Hi wicket developers and users, > > I am developing a web application that uses the wicket-auth framework 1.4.17, > more specifically the following class : > > org.apache.wicket.authorization.strategies.role.annotations.AnnotationsRoleAuthorizationStrategy > > and I am experiencing an issue that I think might be a bug (but I'm not sure, > it might be > that I'm doing something wrong). I am using an annotation like below : > > @AuthorizeAction(action = ..., roles = ...) > > However I have found that I am always denied access to the page. I have > traced the reason > of the access to the following code, in method "check" of the above class : > > if (hasAny(new Roles(authorizeActionAnnotation.deny()))) > { > return false; > } > > The deny list returned by "authorizeActionAnnotation.deny()" is empty, > therefore "hasAny" > always returns true, which means that when the deny list is empty you are > always denied > access to the page! > > Maybe it's a feature but it sounds like counter-intuitive to me :) Using the > following > annotation did fix the issue : > > @AuthorizeAction(action = ..., deny="dummyRoleToDeny", roles = ...) > > Am I doing something wrong, or is it really intended that if you don't > specify a deny list > then you are always denied access? > > Thanks > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
-- Martin Grigorov jWeekend Training, Consulting, Development http://jWeekend.com --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
