[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1745) SpringTransaction fails with HibernateJpaDialect and FlushMode.MANUAL
by Darryl Smith (JIRA)
SpringTransaction fails with HibernateJpaDialect and FlushMode.MANUAL
----------------------------------------------------------------------
Key: JBSEAM-1745
URL: http://jira.jboss.com/jira/browse/JBSEAM-1745
Project: JBoss Seam
Issue Type: Bug
Components: Spring
Reporter: Darryl Smith
When using flushMode = MANUAL with org.springframework.orm.jpa.vendor.HibernateJpaDialect, the flushMode is changed to AUTO when beginning transaction
SessionImpl.setFlushMode(FlushMode) line: 1286
HibernateSessionProxy.setFlushMode(FlushMode) line: 381
SeamHibernateJpaDialect(HibernateJpaDialect).beginTransaction(EntityManager, TransactionDefinition) line: 60
JpaTransactionManager.doBegin(Object, TransactionDefinition) line: 326
JpaTransactionManager(AbstractPlatformTransactionManager).getTransaction(TransactionDefinition) line: 350
SpringTransaction.begin() line: 74
Unless the transaction definition is set to readOnly spring will change the flushMode to manual
HibernateJpaDialect:45
--------------------------------
public Object beginTransaction(EntityManager entityManager, TransactionDefinition definition)
throws PersistenceException, SQLException, TransactionException {
super.beginTransaction(entityManager, definition);
Session session = getSession(entityManager);
FlushMode flushMode = session.getFlushMode();
FlushMode previousFlushMode = null;
if (definition.isReadOnly()) {
// We should suppress flushing for a read-only transaction.
session.setFlushMode(FlushMode.MANUAL);
previousFlushMode = flushMode;
}
else {
// We need AUTO or COMMIT for a non-read-only transaction.
if (flushMode.lessThan(FlushMode.COMMIT)) {
session.setFlushMode(FlushMode.AUTO);
previousFlushMode = flushMode;
}
}
return new SessionTransactionData(session, previousFlushMode);
}
Perhaps SpringTransaction should set should pass readOnly transaction def to Spring when the flushMode is manual.
Current Workaround: use DefaultJpaDialect
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 10 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-2423) checkEntityPermission only checks one method
by Andrew (JIRA)
checkEntityPermission only checks one method
--------------------------------------------
Key: JBSEAM-2423
URL: http://jira.jboss.com/jira/browse/JBSEAM-2423
Project: JBoss Seam
Issue Type: Bug
Components: Security
Affects Versions: 2.0.1.CR1
Environment: JPA on tomcat6
Reporter: Andrew
Priority: Critical
If an entity has more than one method marked as @PrePersist, only one method is used to check for security. All methods should be considered and the result "anded" together.
Code in the Identity bean only checks for a @Restrict on the first method found. In my case, I extend an object with a @PrePersist with no @Restrict. My entity has a method:
@PrePersist @PreUpdate @PreRemove @Restrict
public void beforeChange() {}
(everything is restricted except for read access)
According to the PrePersist documentation, multiple PrePersist methods are valid. There are workarounds, but this is dangerous code. If it were not for my unit tests it could have slipped through. The seam documentation does not mention this limitation
I marked this as critical as it creates security holes in the application.
Here is the relevant code:
public void checkEntityPermission(Object entity, EntityAction action)
{
isLoggedIn(true);
PersistenceProvider provider = PersistenceProvider.instance();
Class beanClass = provider.getBeanClass(entity);
if (beanClass != null)
{
String name = Seam.getComponentName(entity.getClass());
if (name == null) name = beanClass.getName();
Method m = null;
switch (action)
{
case READ:
m = provider.getPostLoadMethod(beanClass);
break;
case INSERT:
m = provider.getPrePersistMethod(beanClass);
break;
case UPDATE:
m = provider.getPreUpdateMethod(beanClass);
break;
case DELETE:
m = provider.getPreRemoveMethod(beanClass);
}
Restrict restrict = null;
if (m != null && m.isAnnotationPresent(Restrict.class))
{
restrict = m.getAnnotation(Restrict.class);
}
else if (entity.getClass().isAnnotationPresent(Restrict.class))
{
restrict = entity.getClass().getAnnotation(Restrict.class);
}
if (restrict != null)
{
if (Strings.isEmpty(restrict.value()))
{
checkPermission(name, action.toString(), entity);
}
else
{
checkRestriction(restrict.value());
}
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 10 months