[WW-4117] RolesInterceptor ignores disallowedRoles when allowedRoles are configured

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.3.16
• Component/s: Core Interceptors
• Flags: Patch
• Assignee: Lukasz Lenart
• Reporter: Cam Morris
• Created: 19/Jun/13 16:04
• Updated: 08/Dec/13 17:21
• Resolved: 16/Oct/13 13:39

Description

The isAllowed method of RolesInterceptor does not enforce the disallowedRoles when allowedRoles are configured. ex:

    
<interceptor-ref name="roles">
  <param name="allowedRoles">authenticated</param>
  <param name="disallowedRoles">restrictedUser</param>
</interceptor-ref>

With the above configuration a user with the roles "authenticated", and "restrictedUser" would be granted access.

Issue Links

• relates to: WW-4118 Allow RolesInterceptor to validate role names