[SM-1925] Add security check on remote broker when using JMSFlow/JCAFlow

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.2.3, 3.3.1
• Fix Version/s: 3.2.4, 3.3.2
• Component/s: servicemix-core
• Assignee: Chris Custine
• Reporter: Chris Custine
• Created: 11/Jan/10 20:51
• Updated: 12/Jan/10 20:43
• Resolved: 12/Jan/10 20:43

Description

SecuredBroker checks security AFTER a component is invoked, which works fine when the consumer and components are on the same broker. If a consumer is on brokerA and a provider endpoint is on brokerB using JMSFlow it is possible to bypass security and invoke the endpoint on brokerB even if it is using SecuredBroker.