snoopdave commented on code in PR #224:
URL: https://github.com/apache/roller/pull/224#discussion_r4406625675
##########
CHANGES.md:
##########
@@ -58,6 +58,9 @@
- **Startup fails if the XML-RPC parser cannot be configured.** Roller used to
log an error and continue. It now stops at startup, so check the log if a
custom XML parser is on the classpath.
+- **Disabled accounts cannot sign in with OpenID.** Signing in with an OpenID
Review Comment:
🤖Claude: fixed by rewording the CHANGES.md entry: a disabled account is now
refused whenever its OpenID URL is used to sign in, on every sign-in form. The
check sits in `RollerUserDetailsService.loadUserByUsername`, which both the
user name and password provider and the OpenID provider call, so
`disabledOpenIdUserIsRefused` covers both paths. Docs-only change. (Local
change, in the next push.)
##########
app/src/main/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetailsService.java:
##########
@@ -53,6 +54,9 @@ public UserDetails loadUserByUsername(String userName) {
} catch (WebloggerException ex) {
throw new DataRetrievalFailureException("ERROR in user
lookup", ex);
}
+ if (userData != null &&
!Boolean.TRUE.equals(userData.getEnabled())) {
+ throw new DisabledException("User account is disabled: " +
userData.getUserName());
Review Comment:
🤖Claude: not fixed — the quieter options each change behaviour, so this
needs a decision. `OpenIDAuthenticationProvider` (5.8) never checks
`isEnabled()`, so returning a disabled `UserDetails` would let the OpenID form
through. `UsernameNotFoundException` is the one exception
`DaoAuthenticationProvider` passes through without logging, but
`myAuthenticationFailureHandler` sends it to the OpenID registration page. A
quiet fix would need its own `UserDetailsChecker` on the OpenID side, or a
custom failure path. The sign-in is refused correctly today, and the ERROR line
only appears when a disabled account tries to sign in, so I left it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
