[JBoss JIRA] (SEAM-102) Discrepancies in User and Group management API in Seam Security 3
by Luca Cavagnoli (Created) (JIRA)
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAM-102
URL: https://issues.jboss.org/browse/SEAM-102
Project: Seam 3 Distribution
Issue Type: Bug
Affects Versions: 3.0.0.Final
Environment: Seam 3.1.0.Beta2
JBoss AS 7
Reporter: Luca Cavagnoli
Priority: Minor
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type", the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite 'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 5 months
[JBoss JIRA] Created: (SEAMWICKET-41) EJB and Seam Wicket result in NotSerializableException
by Thierry Peng (JIRA)
EJB and Seam Wicket result in NotSerializableException
------------------------------------------------------
Key: SEAMWICKET-41
URL: https://issues.jboss.org/browse/SEAMWICKET-41
Project: Seam for Apache Wicket
Issue Type: Enhancement
Affects Versions: 3.0.0.Final
Environment: Wicket 1.4.17, Glassfish 3.1 and Glassfish 3.1.1
Reporter: Thierry Peng
Fix For: Future
Injection of EJBs with Seam for Apache Wicket does not work properly. Wicket tries to serialize all injected references once the page/component changes its version. The culprit is the org.glassfish.weld.ejb.SessionObjectReferenceImpl.ejbRef which is not serializable, see the forum reference for the stacktrace.
There are few discussions about this problem, one mentioned, that the spec doesn't require that an ejb must be serializable, which is true. Because this is a Problem which mainly affects wicket and its way to serializable the component tree, I suggest that we solve it in this module.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 5 months