Uploaded image for project: 'Wicket'
  1. Wicket
  2. WICKET-3974

Wicket-auth annotation always denies access if the deny list is empty

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 1.4.17
    • 6.0.0-beta1
    • wicket-auth-roles
    • None

    Description

      I am developing a web application that uses the wicket-auth framework 1.4.17,
      more specifically the following class :

      org.apache.wicket.authorization.strategies.role.annotations.AnnotationsRoleAuthorizationStrategy

      and I am experiencing an issue that I think might be a bug (but I'm not sure, it might be
      that I'm doing something wrong). I am using an annotation like below :

      @AuthorizeAction(action = ..., roles = ...)

      However I have found that I am always denied access to the page. I have traced the reason
      of the access to the following code, in method "check" of the above class :

      if (hasAny(new Roles(authorizeActionAnnotation.deny())))

      { return false; }

      The deny list returned by "authorizeActionAnnotation.deny()" is empty, therefore "hasAny"
      always returns true, which means that when the deny list is empty you are always denied
      access to the page!

      Maybe it's a feature but it sounds like counter-intuitive to me Using the following
      annotation did fix the issue :

      @AuthorizeAction(action = ..., deny="dummyRoleToDeny", roles = ...)

      I posted this on the mailing list and obtained confirmation that this seems to be an incorrect check,
      and not a misunderstanding on my part

      Attachments

        1. WICKET-3974.patch
          66 kB
          Martin Tzvetanov Grigorov
        2. WICKET-3974.patch
          64 kB
          Martin Tzvetanov Grigorov

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            mgrigorov Martin Tzvetanov Grigorov
            mmg Mathieu Marcotte-Gagnon
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Issue deployment