This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git
from 12d194b66 [#2931] - Rebuild expired Faces views during form replay
without a preliminary GET (#2930)
new 180d480b0 bugfix: html-encode text in PrincipalTag
new ecd3abad2 bugfix: ensure passwordsMatch method returns false for null
or empty saved credentials
new 960ff2d58 bugfix: adjust session timeout calculation to round up
positive millisecond values
new 337b4f194 bugfix: improve resourcePath validation and clear loaded
state on restart
new 4bfa8ad12 bugfix: prevent usage of ThreadState with ScopedValues in
JDK 25 or later
new e6c68162b feat: add options to control forwarded-proto and port filter
new 2e3ffaf6c javadoc: add documentation for CORS preflight requests in
HttpAuthenticationFilter
new 8a92a7100 enh: implement strict handling for empty authorization
configurations in filters and annotation handlers
The 8 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../authc/credential/DefaultPasswordService.java | 6 +-
.../authc/credential/SimpleCredentialsMatcher.java | 5 +
.../authz/aop/AuthorizingAnnotationHandler.java | 80 ++++++++-
.../authz/aop/PermissionAnnotationHandler.java | 5 +-
.../shiro/authz/aop/RoleAnnotationHandler.java | 5 +-
.../shiro/authz/permission/WildcardPermission.java | 81 +++++++--
.../apache/shiro/realm/text/PropertiesRealm.java | 34 +++-
.../shiro/subject/support/SubjectCallable.java | 4 +
.../shiro/subject/support/SubjectRunnable.java | 4 +
.../shiro/subject/support/SubjectThreadState.java | 10 +-
.../credential/DefaultPasswordServiceTest.groovy | 8 +-
.../shiro/authz/aop/EmptyAnnotationValueTest.java | 137 +++++++++++++++
.../authz/permission/WildcardPermissionTest.java | 77 +++++++++
.../shiro/mgt/AbstractSecurityManagerTest.java | 7 +-
.../shiro/realm/text/PropertiesRealmTest.java | 190 +++++++++++++++++++++
.../org/apache/shiro/test/AbstractShiroTest.java | 17 +-
.../apache/shiro/cdi/ShiroSecurityExtension.java | 5 +-
.../org/apache/shiro/guice/aop/ShiroAopModule.java | 7 +-
.../apache/shiro/ee/faces/tags/PrincipalTag.java | 2 +-
.../org/apache/shiro/ee/filters/ShiroFilter.java | 8 +-
.../ee/listeners/EnvironmentLoaderListener.java | 10 ++
.../web/jaxrs/AnnotationAuthorizationFilter.java | 2 +
.../AuthorizationAttributeSourceAdvisor.java | 3 +
.../AbstractAuthorizationAnnotationTest.java | 12 +-
.../web/filter/authc/HttpAuthenticationFilter.java | 16 ++
.../authz/PermissionsAuthorizationFilter.java | 12 +-
.../apache/shiro/web/filter/authz/PortFilter.java | 30 +++-
.../web/filter/authz/RolesAuthorizationFilter.java | 13 +-
.../shiro/web/session/HttpServletSession.java | 6 +-
.../org/apache/shiro/web/tags/PrincipalTag.java | 5 +-
.../authz/EmptyAuthorizationConfigFilterTest.java | 104 +++++++++++
.../shiro/web/filter/authz/PortFilterTest.java | 27 +++
32 files changed, 862 insertions(+), 70 deletions(-)
create mode 100644
core/src/test/java/org/apache/shiro/authz/aop/EmptyAnnotationValueTest.java
create mode 100644
core/src/test/java/org/apache/shiro/realm/text/PropertiesRealmTest.java
create mode 100644
web/src/test/java/org/apache/shiro/web/filter/authz/EmptyAuthorizationConfigFilterTest.java
