Hi, Found that the issue happens at the following,
at org.wso2.carbon.user.core.common.AbstractUserStoreManager.listUsers(AbstractUserStoreManager.java:2034) at org.apache.jsp.carbon.usermgt.index_jsp._jspService(index_jsp.java:167) I did the following fix in CarbonContext (where the user realm is retrieved initially), and the issue disappeared. Is this a good enough solution ? Or do we have to explicitly do permission checks in AbstractUserStoreManager ?. So far there is none in that.. Let me know. +++ b/core/org.wso2.carbon.utils/src/main/java/org/wso2/carbon/context/CarbonContext.java @@ -233,6 +233,8 @@ public class CarbonContext { * @return the user realm instance. */ public UserRealm getUserRealm() { + CarbonUtils.checkSecurity(); return getCarbonContextDataHolder().getUserRealm(); } thanks, On Tue, Aug 25, 2015 at 12:17 PM, Supun Malinga <sup...@wso2.com> wrote: > thanks Isuru. Let me see what I can find. > > thanks > > On Tue, Aug 25, 2015 at 12:12 PM, Isuru Perera <isu...@wso2.com> wrote: > >> Hi Supun, >> >> I'm sorry I missed this mail. We need to identify which method is >> accessing the local database. We should never give explicit read >> permissions for the H2 database. >> >> We need to use Java Privileged Block API in Carbon Context APIs. If you >> cannot figure out the protection domain for the access failure, please >> check Java Security Debug logs. See Troubleshooting section in my Java >> Security Manager related blog post [1]. >> >> With Privileged Block API, we can let Carbon Context APIs to use same >> permissions we give to Carbon code. >> >> Thanks! >> >> Best Regards, >> >> [1] >> http://isuru-perera.blogspot.com/2014/12/enabling-java-security-manager-for-wso2.html >> >> >> On Thu, Aug 13, 2015 at 3:37 PM, Supun Malinga <sup...@wso2.com> wrote: >> >>> Hi, >>> >>> For accessing usermgt via CarbonContext had to provide following >>> permission for webapp. >>> >>> permission java.io.FilePermission >>> "/home/supun/smoke/java_sec/530_custom/wso2as-5.3.0-SNAPSHOT/repository/database/WSO2CARBON_DB.data.db", >>> "read"; >>> >>> I tested with AS 5.2.1 and we don't need this in 5.2.1. >>> >>> Can anyone tell why this is needed and if its an issue ?. >>> >>> thanks, >>> -- >>> Supun Malinga, >>> >>> Senior Software Engineer, >>> WSO2 Inc. >>> http://wso2.com >>> email: sup...@wso2.com <sup...@wso2.com> >>> mobile: +94 (0)71 56 91 321 >>> >> >> >> >> -- >> Isuru Perera >> Associate Technical Lead | WSO2, Inc. | http://wso2.com/ >> Lean . Enterprise . Middleware >> >> about.me/chrishantha >> Contact: +IsuruPereraWSO2 <https://www.google.com/+IsuruPereraWSO2/about> >> > > > > -- > Supun Malinga, > > Senior Software Engineer, > WSO2 Inc. > http://wso2.com > email: sup...@wso2.com <sup...@wso2.com> > mobile: +94 (0)71 56 91 321 > -- Supun Malinga, Senior Software Engineer, WSO2 Inc. http://wso2.com email: sup...@wso2.com <sup...@wso2.com> mobile: +94 (0)71 56 91 321
_______________________________________________ Dev mailing list Dev@wso2.org http://wso2.org/cgi-bin/mailman/listinfo/dev