arturobernalg opened a new pull request, #552:
URL: https://github.com/apache/jspwiki/pull/552
Permissions were checked with AccessController.checkPermission inside a
Subject.doAsPrivileged, which consults the security policy of the JVM, and the
`<groupmember>` grant found the user in the access control context of the
thread. Both belong to the Java security manager, which is deprecated for
removal. The test of `<groupmember>` already has to be skipped on JDK 25
("skipping on 25 due to security manager changes"), where this mechanism stops
working. The maintainers say in JSPWIKI-129 that the code tied to the security
manager is going to be removed.
The permission of a session is now checked against the policy of the wiki
only, for the roles and the principals of the session
(AuthorizationManager.checkStaticPermission). A GroupPermission that is not
granted as such is checked again as the `<groupmember>` of its group, through
the new GroupPermission.toMemberPermission (since 3.0.1), when the Subject of
the session is a member of that group. For a wiki policy the result is the same
as before.
The security policy of the JVM, set with java.security.policy, is not
consulted anymore. This is a change of behaviour: what such a policy granted to
a role, group or user of the wiki counted before, so those grants have to be
moved to the policy file of the wiki (WEB-INF/jspwiki.policy or the file set
with jspwiki.policy.file). UPGRADING says so. It also closes a hole: a JVM
policy that granted too much made every user pass the check. I reproduced that
with a test: with a JVM policy that implies everything, an anonymous user was
allowed to delete before this change.
Also removed: the warning that the servlet filter logged when a security
manager was present, the check against the JVM policy in SecurityVerifier,
GroupPermission.impliesMember, and jspwiki-container.policy, which was for
running the wiki under a security manager. The comments of the four
jspwiki.policy files no longer talk about a global policy. Session.doPrivileged
is deprecated, not removed, as it is public API. Not part of this change: the
policy engine itself (the freshcookies LocalPolicy) is not replaced.
Tests: 5 new cases in AuthorizationManagerTest for `<groupmember>` through
the manager (a member can edit the group and view it, a non-member cannot edit,
being a member of one group does not count for the others, a member cannot
delete, an asserted user does not get it) and one for the JVM policy; 8 in
GroupPermissionTest for toMemberPermission, replacing the ones of
impliesMember. The five `<groupmember>` cases pass with the old code too, so
the behaviour is the same; the JVM policy case fails with the old code. The
jspwiki-util, jspwiki-event, jspwiki-api and jspwiki-main suites pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
