[
https://issues.apache.org/jira/browse/WICKET-3240?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109807#comment-18109807
]
ASF subversion and git services commented on WICKET-3240:
---------------------------------------------------------
Commit c8fa4527ab912662ff0578fb7c5c69ec370990bd in wicket's branch
refs/heads/WICKET-7200 from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=c8fa4527ab ]
WICKET-7200 align class-vs-package resolution in the role annotations
The five annotations in wicket-auth-roles implemented three different
rules for combining a class level annotation with a package level one,
and none of them were documented.
Standardise on the rule that was affirmed in WICKET-3240: the rules on a
class replace the rules on its package, and rules at the same level are
combined with AND.
- @AuthorizeAction and @AuthorizeActions now honour package level
annotations, resolved per action name, so a class level rule for
ENABLE leaves the package rule for RENDER in place. @AuthorizeActions
gains ElementType.PACKAGE, without which a package cannot express more
than one action rule.
- @AuthorizeResource now replaces the annotation of its package instead
of being AND-ed with it, which also removes an unguarded
getPackage() dereference.
- @AuthorizeInstantiations now participates in the override, and gains
ElementType.PACKAGE.
Document the resolution rules on AnnotationsRoleAuthorizationStrategy,
on each of the annotations and in the user guide. The pitfall that
prompted this is called out explicitly: because the annotations are
@Inherited, an annotation on a superclass in another package counts as
an annotation on the class and therefore suppresses the annotation of
the subclass' own package.
Add AnnotationsRolePackageTest, which pins each of these rules with real
classes in real annotated packages. Mocks cannot be used for this, since
a generated mock does not live in the package of the class it mocks.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> AnnotationsRoleAuthorizationStrategy isInstantiationAuthorized
> package==false, class==true returns true
> -------------------------------------------------------------------------------------------------------
>
> Key: WICKET-3240
> URL: https://issues.apache.org/jira/browse/WICKET-3240
> Project: Wicket
> Issue Type: Improvement
> Components: wicket-auth-roles
> Affects Versions: 1.5-M3
> Environment: all
> Reporter: Richard Emberson
> Assignee: Martin Tzvetanov Grigorov
> Priority: Trivial
> Fix For: 1.5-RC1
>
>
> In the class AnnotationsRoleAuthorizationStrategy's
> isInstantiationAuthorized method if
> the package authorization is false but the class authorization is true, then
> the user
> will be authorized.
> Maybe, check the class authorization only if the authorized variable is true.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
