[
http://jira.jboss.com/jira/browse/JBSEAM-1009?page=all ]
Leo Baschy updated JBSEAM-1009:
-------------------------------
Attachment: may-override-login-required.patch
This patch to Pages and Page uses a Boolean for loginRequired to allow TRUE, FALSE or
null, with null meaning not explicitely set for that page or wildcard.
This new way of deciding login-required by most specific instead of any true will only be
in effect if at pages element attribute may-override-login-required="true".
optionally login-require in a more specific page should be able to
override a wildcard login-require
----------------------------------------------------------------------------------------------------
Key: JBSEAM-1009
URL:
http://jira.jboss.com/jira/browse/JBSEAM-1009
Project: JBoss Seam
Issue Type: Patch
Components: Security
Affects Versions: 1.2.0.GA
Environment: all
Reporter: Leo Baschy
Attachments: may-override-login-required.patch
This should be optional to switch on, so no one's existing expectations of security
get broken.
The point is about having a generic wildcard <page view-id="*"
scheme="http" login-required="true"> to secure the whole site, and
then allowing specific pages or specific wildcards to have
login-required="false". E.g. for a registration (with preview) section as one
cannot be logged in if one isn't registered yet.
Some may suggest instead forcing pages into dedicated secure and not-secure directories,
but in reality if there are multiple reasons to force pages into directories different
ways (security, hyperlink management, publishability of URLs, etc.), one cannot serve all
of them.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira