mraible commented on code in PR #224:
URL: https://github.com/apache/roller/pull/224#discussion_r4402294689
##########
CHANGES.md:
##########
@@ -58,6 +58,9 @@
- **Startup fails if the XML-RPC parser cannot be configured.** Roller used to
log an error and continue. It now stops at startup, so check the log if a
custom XML parser is on the classpath.
+- **Disabled accounts cannot sign in with OpenID.** Signing in with an OpenID
Review Comment:
This also closes a gap on the user name and password form. Before this
change, a disabled user could sign in there by entering their OpenID URL as the
user name with their Roller password, because the OpenID lookup ignores the
enabled flag. With the default security.xml, the OpenID provider is commented
out, so that's the case most sites were exposed to. It might be worth
mentioning here.
##########
app/src/main/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetailsService.java:
##########
@@ -53,6 +54,9 @@ public UserDetails loadUserByUsername(String userName) {
} catch (WebloggerException ex) {
throw new DataRetrievalFailureException("ERROR in user
lookup", ex);
}
+ if (userData != null &&
!Boolean.TRUE.equals(userData.getEnabled())) {
+ throw new DisabledException("User account is disabled: " +
userData.getUserName());
Review Comment:
Non-blocking: on the password form, `DaoAuthenticationProvider.retrieveUser`
wraps this `DisabledException` in an `InternalAuthenticationServiceException`.
`AbstractAuthenticationProcessingFilter` then logs that at ERROR with a stack
trace on every attempt. The user still gets the normal login error, so it's
only log noise.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
