HibernateUserModuleImpl.removeUser potential unwanted NPE --------------------------------------------------------- Key: JBPORTAL-1545 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1545 Project: JBoss Portal Issue Type: Bug Security Level: Public (Everyone can see) Components: Portal Identity Affects Versions: 2.6 Final Environment: 2.6.0GA Reporter: Antoine Herzog Priority: Minor Fix For: 2.6.1 Final In HibernateUserModuleImpl In the removeUser method code is : String userName = user.getUserName(); if (user == null) { throw new NoSuchUserException("No such user " + id); } session.delete(user); session.flush(); //fire events fireUserDestroyedEvent(id, userName); This first line will throw a NPE, and the null test is done after. The code should be : if (user == null) { throw new NoSuchUserException("No such user " + id); } String userName = user.getUserName(); session.delete(user); session.flush(); //fire events fireUserDestroyedEvent(id, userName); -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira