[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3972) identity login security bug
by David Croe (JIRA)
identity login security bug
---------------------------
Key: JBSEAM-3972
URL: https://jira.jboss.org/jira/browse/JBSEAM-3972
Project: Seam
Issue Type: Bug
Components: Security
Affects Versions: 2.1.1.GA
Environment: jboss 4.2.3.
Reporter: David Croe
Hello !
I think there is a major security bug in the seamspace example, which will give a user the permissions of the user which has been logged in before.
To reproduce the scenario:
1. login in as user demo.
2. click the back button or enter the login page manually in the url of your browser
3. login as another user.
the second user will have the admin permissions of the demo user!
Problem is that the authenticate method will not be invoked if you are allready logged in ( even as another user) and the old principal with the assigned permissions will stay in memory.
Greetings
D.Croe
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 1 month
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3941) IdentityMaanger: extend permission checks to allow user to modify his own password
by Raimund Hölle (JIRA)
IdentityMaanger: extend permission checks to allow user to modify his own password
----------------------------------------------------------------------------------
Key: JBSEAM-3941
URL: https://jira.jboss.org/jira/browse/JBSEAM-3941
Project: Seam
Issue Type: Feature Request
Components: Security
Affects Versions: 2.1.1.GA, 2.1.1.CR2, 2.1.1.CR1, 2.1.0.SP1
Reporter: Raimund Hölle
Priority: Minor
Because IdentityManager.changePassword() requires the permission ("seam.user", "update"), it is not possible to use that method to change the password of the authenticated user itself without granting that permission to him.
But granting that means, the user is able to modify _any_ user.
I'm suggest to add a new permission target (or maybe a new action) and extend the changePassword() method:
public static final String OWNPASSWORD_PERMISSION_NAME = "seam.user.ownpassword";
public boolean changePassword(String name, String password) {
Identity identity = Identity.instance();
try {
identity.checkPermission(USER_PERMISSION_NAME, PERMISSION_UPDATE);
} catch (AuthorizationException e) {
if ( identity.isLoggedIn() && identity.getCredentials().getUsername().equals(name) ) {
Identity.instance().checkPermission(OWNPASSWORD_PERMISSION_NAME, PERMISSION_UPDATE);
} else {
throw e;
}
}
return identityStore.changePassword(name, password);
}
Or maybe a specialized method?
Many regards,
Raimund
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 1 month
[JBoss JIRA] Created: (SOLDER-75) Remove / update license headers
by Jozef Hartinger (JIRA)
Remove / update license headers
-------------------------------
Key: SOLDER-75
URL: https://issues.jboss.org/browse/SOLDER-75
Project: Seam Solder
Issue Type: Task
Affects Versions: 3.0.0.Beta3
Reporter: Jozef Hartinger
Assignee: Stuart Douglas
Priority: Minor
Fix For: 3.0.0.CR1
Although the module is now distributed under the terms of ASL, some files still contain LGPL headers.
Please either:
a) Remove the license headers
for Java files, this can be done by running
{noformat}for i in `find . -name "*.java"`; do sed -E -n '1h;1!H;${;g;s/\/\*.*package/package/g;p;}' -i $i; done{noformat}
b) Replace the LGPL license headers with ASL license headers
A list of files containing LGPL headers follows:
./impl/src/main/java/org/jboss/logging/Log4jLogger.java
./impl/src/main/java/org/jboss/logging/Log4jLoggerProvider.java
./impl/src/main/java/org/jboss/logging/Slf4jLocationAwareLogger.java
./impl/src/main/java/org/jboss/logging/ParameterConverter.java
./impl/src/main/java/org/jboss/logging/JBossLogManagerProvider.java
./impl/src/main/java/org/jboss/logging/MDC.java
./impl/src/main/java/org/jboss/logging/Slf4jLoggerProvider.java
./impl/src/main/java/org/jboss/logging/JBossLogManagerLogger.java
./impl/src/main/java/org/jboss/logging/Slf4jLogger.java
./impl/src/main/java/org/jboss/logging/NDC.java
./api/src/main/java/org/jboss/logging/SerializedLogger.java
./api/src/main/java/org/jboss/logging/JDKLoggerProvider.java
./api/src/main/java/org/jboss/logging/LoggerProvider.java
./api/src/main/java/org/jboss/logging/JDKLogger.java
./api/src/main/java/org/jboss/logging/AbstractMdcLoggerProvider.java
./api/src/main/java/org/jboss/logging/JBossLogRecord.java
./api/src/main/java/org/jboss/logging/JDKLevel.java
./api/src/main/java/org/jboss/logging/BasicLogger.java
./api/src/main/java/org/jboss/logging/AbstractLoggerProvider.java
./api/src/main/java/org/jboss/logging/Logger.java
./api/src/main/java/org/jboss/logging/LoggingProxy.java
./api/src/main/java/org/jboss/logging/LoggerProviders.java
./api/src/main/java/org/jboss/seam/solder/logging/MessageLogger.java
./api/src/main/java/org/jboss/seam/solder/logging/LogMessage.java
./api/src/main/java/org/jboss/seam/solder/logging/Cause.java
./api/src/main/java/org/jboss/seam/solder/logging/MessageBundle.java
./api/src/main/java/org/jboss/seam/solder/logging/MessageBundleInvocationHandler.java
./api/src/main/java/org/jboss/seam/solder/logging/MessageLoggerInvocationHandler.java
./api/src/main/java/org/jboss/seam/solder/logging/Message.java
./api/src/main/java/org/jboss/seam/solder/logging/Messages.java
./api/src/main/java/org/jboss/seam/solder/logging/StatusMessage.java
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 1 month
[JBoss JIRA] Created: (SEAMPERSIST-31) Remove / update license headers
by Jozef Hartinger (JIRA)
Remove / update license headers
-------------------------------
Key: SEAMPERSIST-31
URL: https://issues.jboss.org/browse/SEAMPERSIST-31
Project: Seam Persistence
Issue Type: Task
Affects Versions: 3.0.0.Beta4
Reporter: Jozef Hartinger
Assignee: Stuart Douglas
Priority: Minor
Fix For: 3.0.0.CR1
Although the module is now distributed under the terms of ASL, some files still contain LGPL headers.
Please either:
a) Remove the license headers
for Java files, this can be done by running
{noformat}for i in `find . -name "*.java"`; do sed -E -n '1h;1!H;${;g;s/\/\*.*package/package/g;p;}' -i $i; done{noformat}
b) Replace the LGPL license headers with ASL license headers
A list of files containing LGPL headers follows:
./impl/src/main/java/org/jboss/seam/persistence/transaction/NoTransaction.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/TransactionInterceptor.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/SeSynchronizations.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/Synchronizations.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/DefaultSeamTransaction.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/Work.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/TransactionManagerSynchronizations.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/UTTransaction.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/CMTTransaction.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/TransactionExtension.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/LocalEjbSynchronizations.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/scope/TransactionScopeContext.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/scope/ContextualIdentifierStore.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/scope/TransactionScopeExtension.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/EntityTransaction.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/AbstractUserTransaction.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/SynchronizationRegistry.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/TransactionInterceptorBindingLiteral.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/TransactionalInterceptorBinding.java
./impl/src/main/java/org/jboss/seam/persistence/transaction/HibernateTransaction.java
./impl/src/main/java/org/jboss/seam/persistence/InjectionEventListener.java
./impl/src/main/java/org/jboss/seam/persistence/ManagedPersistenceContextBeanLifecycle.java
./impl/src/main/java/org/jboss/seam/persistence/QueryParser.java
./impl/src/main/java/org/jboss/seam/persistence/util/InstanceResolver.java
./impl/src/main/java/org/jboss/seam/persistence/util/ExceptionUtil.java
./impl/src/main/java/org/jboss/seam/persistence/util/EJBContextUtils.java
./impl/src/main/java/org/jboss/seam/persistence/util/EjbApi.java
./impl/src/main/java/org/jboss/seam/persistence/util/EnvironmentUtils.java
./impl/src/main/java/org/jboss/seam/persistence/util/NamingUtils.java
./impl/src/main/java/org/jboss/seam/persistence/ManagedPersistenceContextExtension.java
./impl/src/main/java/org/jboss/seam/persistence/FlushModeManagerImpl.java
./impl/src/main/java/org/jboss/seam/persistence/PersistenceContextProxyHandler.java
./impl/src/main/java/org/jboss/seam/persistence/hibernate/HibernateManagedSessionExtensionImpl.java
./impl/src/main/java/org/jboss/seam/persistence/hibernate/HibernateManagedSessionBeanLifecycle.java
./impl/src/main/java/org/jboss/seam/persistence/hibernate/HibernateManagedSessionExtension.java
./impl/src/main/java/org/jboss/seam/persistence/hibernate/HibernateExtension.java
./impl/src/main/java/org/jboss/seam/persistence/hibernate/HibernateManagedSessionProxyHandler.java
./impl/src/main/java/org/jboss/seam/persistence/ManagedPersistenceContextProxyHandler.java
./impl/src/main/java/org/jboss/seam/persistence/DefaultPersistenceProvider.java
./impl/src/main/java/org/jboss/seam/persistence/SePersistenceContextExtension.java
./api/src/main/java/org/jboss/seam/persistence/SeamManagedPersistenceContextCreated.java
./api/src/main/java/org/jboss/seam/persistence/transaction/Transactional.java
./api/src/main/java/org/jboss/seam/persistence/transaction/SeamTransaction.java
./api/src/main/java/org/jboss/seam/persistence/transaction/TransactionScoped.java
./api/src/main/java/org/jboss/seam/persistence/transaction/TransactionPropagation.java
./api/src/main/java/org/jboss/seam/persistence/transaction/literal/DefaultTransactionLiteral.java
./api/src/main/java/org/jboss/seam/persistence/transaction/literal/TransactionScopedLiteral.java
./api/src/main/java/org/jboss/seam/persistence/FlushModeManager.java
./api/src/main/java/org/jboss/seam/persistence/SeamManaged.java
./api/src/main/java/org/jboss/seam/persistence/ManagedPersistenceContext.java
./api/src/main/java/org/jboss/seam/persistence/PersistenceContexts.java
./api/src/main/java/org/jboss/seam/persistence/hibernate/SeamManagedHibernateSessionCreated.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/test/jboss/ManagedPersistenceContextTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/test/jboss/EntityInjectionTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/test/jboss/ManagedPersistenceContextCreatedEventTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/test/jboss/JbossHibernateSearchTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/test/jboss/ManagedPersistenceContextELTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/test/jboss/JNDIManagedPersistenceContextTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/transaction/test/jboss/TransactionInterceptorStereotypeTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/transaction/test/jboss/TransactionInterceptorTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/transaction/test/jboss/TransactionAttributeInterceptorTest.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/transaction/test/util/JNDIManagedPersistenceContextProvider.java
./tests/jbossas-hibernate/src/test/java/org/jboss/seam/persistence/transaction/test/util/JbossasTestUtils.java
./tests/jetty-openjpa/src/test/java/org/jboss/seam/persistence/test/openjpa/ManagedPersistenceContextTest.java
./tests/jetty-openjpa/src/test/java/org/jboss/seam/persistence/test/openjpa/util/JettyTestUtils.java
./tests/jetty-openjpa/src/test/java/org/jboss/seam/persistence/test/openjpa/ManagedPersistenceContextCreatedEventTest.java
./tests/jetty-openjpa/src/test/java/org/jboss/seam/persistence/test/openjpa/ManagedPersistenceContextELTest.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/ManagedPersistenceContextELTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/HibernateSearchTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/EntityInjectionTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/util/IndexedHotel.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/util/HelloService.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/util/ManagedHibernateSessionProvider.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/util/ManagedPersistenceContextProvider.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/util/Hotel.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/util/ManagedPersistenceContextObserver.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/util/EntityManagerProvider.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/ManagedPersistenceContextFlushModeTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/ManagedPersistenceContextTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/test/ManagedPersistenceContextCreatedEventTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/StereotypeTransactionManagedBean.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/UserTransactionTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/TransactionAttributeManagedBean.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/TransactionInterceptorStereotypeTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/TransactionScopedTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/TransactionInterceptorTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/TransactionScopedObject.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/TransactionAttributeInterceptorTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/transactions/test/TransactionManagedBean.java
./tests/base/src/main/java/org/jboss/seam/persistence/hibernate/test/ManagedHibernateSessionFlushModeTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/hibernate/test/HibernateSearchTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/hibernate/test/ManagedHibernateSessionTestBase.java
./tests/base/src/main/java/org/jboss/seam/persistence/hibernate/test/ManagedHibernateSessionELTestBase.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/test/jetty/ManagedPersistenceContextFlushModeTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/test/jetty/ManagedPersistenceContextTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/test/jetty/util/JettyTestUtils.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/test/jetty/ManagedPersistenceContextCreatedEventTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/test/jetty/HibernateSearchTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/test/jetty/ManagedPersistenceContextELTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/hibernate/test/ManagedHibernateSessionELTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/hibernate/test/ManagedHibernateSessionSearchTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/hibernate/test/ManagedHibernateSessionFlushModeTest.java
./tests/jetty-hibernate/src/test/java/org/jboss/seam/persistence/hibernate/test/ManagedHibernateSessionTest.java
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
15 years, 1 month