[jboss-jira] [JBoss JIRA] Resolved: (JBAS-4231) JMXOpsAccessControlFilter is Not Thread Safe

Thu Mar 22 11:50:34 EDT 2007

     [ http://jira.jboss.com/jira/browse/JBAS-4231?page=all ]

Darran Lofthouse resolved JBAS-4231.
------------------------------------

    Resolution: Done

Removed member variable that contained list os current users role and access this information locally within the 'authorize' method.

> JMXOpsAccessControlFilter is Not Thread Safe
> --------------------------------------------
>
>                 Key: JBAS-4231
>                 URL: http://jira.jboss.com/jira/browse/JBAS-4231
>             Project: JBoss Application Server
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Security
>    Affects Versions: JBossAS-3.2.8.SP2, JBossAS-4.0.5.GA
>            Reporter: Darran Lofthouse
>         Assigned To: Darran Lofthouse
>             Fix For: JBossAS-5.0.0.Beta2, JBossAS-4.2.0.GA, JBossAS-4.0.5.SP1 , JBossAS-3.2.8.SP2
>
>
> According to the servlet specification (SRV.6.2.1) for each <filter> definition only one instance is instantiated per JVM.
> The current implementation of JMXOpsAccessControlFilter stores the roles of the current user in a member variable, if there are mutliple calls simultaneously there will be a race condition one call can receive the permissions of the other user.
> http://wiki.jboss.org/wiki/Wiki.jsp?page=AccessControlForJMXConsole

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira