[jboss-jira] [JBoss JIRA] Closed: (JBAS-4691) JACC: Unchecked WebUserDataPermission(s) for excluded and transport guarantee use cases

JACC: Unchecked WebUserDataPermission(s) for excluded and transport guarantee use cases --------------------------------------------------------------------------------------- Key: JBAS-4691 URL: http://jira.jboss.com/jira/browse/JBAS-4691 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: Security Affects Versions: JBossAS-4.2.0.GA Reporter: Anil Saldhana Assigned To: Anil Saldhana Fix For: JBossAS-4.2.2.GA If security constraints exist with an excluding auth-constraint, then a WUDP needs to be added to unchecked policy for http methods that are non-excluded. Additionally, an unchecked perm should be added for : /** * A WebResourcePermission and a WebUserDataPermission must be added to the unchecked * policy statements for each url-pattern in the DD and the default pattern, "/", that is not combined by the webresource-collection elements of the deployment descriptor * with every HTTP method value. (JACC 1.0: Section 3.1.3.1) */