You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2013/08/07 11:23:08 UTC
svn commit: r1511221 - in /tomcat/tc7.0.x/trunk: ./
java/org/apache/catalina/core/ApplicationContextFacade.java
webapps/docs/changelog.xml
Author: markt
Date: Wed Aug 7 09:23:07 2013
New Revision: 1511221
URL: http://svn.apache.org/r1511221
Log:
When using a security manager always use the same method inside the doPrivileged call as triggered the call.
Modified:
tomcat/tc7.0.x/trunk/ (props changed)
tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/ApplicationContextFacade.java
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml
Propchange: tomcat/tc7.0.x/trunk/
------------------------------------------------------------------------------
Merged /tomcat/trunk:r1511217
Modified: tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/ApplicationContextFacade.java
URL: http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/ApplicationContextFacade.java?rev=1511221&r1=1511220&r2=1511221&view=diff
==============================================================================
--- tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/ApplicationContextFacade.java (original)
+++ tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/ApplicationContextFacade.java Wed Aug 7 09:23:07 2013
@@ -462,7 +462,8 @@ public class ApplicationContextFacade im
Class<? extends Filter> filterClass) {
if (SecurityUtil.isPackageProtectionEnabled()) {
return (FilterRegistration.Dynamic) doPrivileged("addFilter",
- new Object[]{filterName, filterClass.getName()});
+ new Class[]{String.class, Class.class},
+ new Object[]{filterName, filterClass});
} else {
return context.addFilter(filterName, filterClass);
}
@@ -530,7 +531,8 @@ public class ApplicationContextFacade im
Class<? extends Servlet> servletClass) {
if (SecurityUtil.isPackageProtectionEnabled()) {
return (ServletRegistration.Dynamic) doPrivileged("addServlet",
- new Object[]{servletName, servletClass.getName()});
+ new Class[]{String.class, Class.class},
+ new Object[]{servletName, servletClass});
} else {
return context.addServlet(servletName, servletClass);
}
@@ -630,7 +632,8 @@ public class ApplicationContextFacade im
public void addListener(Class<? extends EventListener> listenerClass) {
if (SecurityUtil.isPackageProtectionEnabled()) {
doPrivileged("addListener",
- new Object[]{listenerClass.getName()});
+ new Class[]{Class.class},
+ new Object[]{listenerClass});
} else {
context.addListener(listenerClass);
}
@@ -652,7 +655,8 @@ public class ApplicationContextFacade im
public <T extends EventListener> void addListener(T t) {
if (SecurityUtil.isPackageProtectionEnabled()) {
doPrivileged("addListener",
- new Object[]{t.getClass().getName()});
+ new Class[]{EventListener.class},
+ new Object[]{t});
} else {
context.addListener(t);
}
@@ -683,9 +687,7 @@ public class ApplicationContextFacade im
@Override
public void declareRoles(String... roleNames) {
if (SecurityUtil.isPackageProtectionEnabled()) {
-//FIXME
- doPrivileged("declareRoles",
- new Object[]{roleNames});
+ doPrivileged("declareRoles", new Object[]{roleNames});
} else {
context.declareRoles(roleNames);
}
Modified: tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml
URL: http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?rev=1511221&r1=1511220&r2=1511221&view=diff
==============================================================================
--- tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml Wed Aug 7 09:23:07 2013
@@ -101,6 +101,12 @@
<bug>55333</bug>: Correct a regression in the fix for <bug>55071</bug>.
(markt)
</fix>
+ <fix>
+ When using a security manager, ensure that calls to the ServletContext
+ that are routed via an <code>AccessController.doPrivileged</code> block
+ do not result in a call to a different underlying method on the
+ ServletContext. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org