You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by Alex Kotchnev <ak...@gmail.com> on 2010/05/17 18:48:57 UTC
Re: [T5.1 + TSS 2.1.0] @Secured annotation on class doesn't avoid
call to onActivate
Thiago,
what would be the proper render event to decorate for access security
checks (if not @SetupRender) if the page is annotated as @Secured ?
Nicolas,
although it certainly is annoying, can you annotate the page w/ @Secured,
and in the cases where you have onActivate, annotate them as well ? It
certainly isn't ideal (or clean), but can that work for your use case for
now ?
Regards,
Alex Kotchnev
On Mon, May 17, 2010 at 12:40 PM, Thiago H. de Paula Figueiredo <
thiagohp@gmail.com> wrote:
> On Mon, 17 May 2010 11:12:48 -0300, Nicolas Bouillon <ni...@bouil.org>
> wrote:
>
> Hi,
>>
>
> Hi!
>
> I'm using Tapestry 5.1 with Tapestry Spring Security 2.1.0 and I've
>> noticied a strange behaviour :
>> But even if the user is not logged in, the onActivate is called.
>>
>
> As far as I can remember, TSS checks the @Secured in page classes
> annotation by decorating the @SetupRender render event, which is triggered
> after the activate event. That's exactly why I left TSS and started working
> on a security package of my own.
>
> --
> Thiago H. de Paula Figueiredo
> Independent Java, Apache Tapestry 5 and Hibernate consultant, developer,
> and instructor
> Owner, Ars Machina Tecnologia da Informação Ltda.
> http://www.arsmachina.com.br
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>
Re: [T5.1 + TSS 2.1.0] @Secured annotation on class doesn't avoid
call to onActivate
Posted by "Thiago H. de Paula Figueiredo" <th...@gmail.com>.
On Tue, 18 May 2010 15:21:43 -0300, Jim O'Callaghan
<jc...@yahoo.co.uk> wrote:
> This is really worrying. Is it possible to contribute / decorate a
> ComponentEventRenderFilter to overcome this security hole?
Just write a ComponentEventRenderFilter with the checking logic and
contribute it to the ComponentEventRenderHandler service. No need for
decoration or overriding.
--
Thiago H. de Paula Figueiredo
Independent Java, Apache Tapestry 5 and Hibernate consultant, developer,
and instructor
Owner, Ars Machina Tecnologia da Informação Ltda.
http://www.arsmachina.com.br
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
RE: [T5.1 + TSS 2.1.0] @Secured annotation on class doesn't avoid call to onActivate
Posted by Jim O'Callaghan <jc...@yahoo.co.uk>.
This is really worrying. Is it possible to contribute / decorate a ComponentEventRenderFilter to overcome this security hole?
Regards,
Jim.
-----Original Message-----
From: Thiago H. de Paula Figueiredo [mailto:thiagohp@gmail.com]
Sent: 17 May 2010 18:14
To: Tapestry users
Subject: Re: [T5.1 + TSS 2.1.0] @Secured annotation on class doesn't avoid call to onActivate
On Mon, 17 May 2010 13:48:57 -0300, Alex Kotchnev <ak...@gmail.com>
wrote:
> Thiago,
> what would be the proper render event to decorate for access security
> checks (if not @SetupRender) if the page is annotated as @Secured ?
In this case, there's no rendering event that is triggered in every
request and before @SetupRender. The solution is to do this page
class-level check in a ComponentEventRenderFilter, not in a
ComponentClassTransformWorker, as TSS does. By the way, when a page class
is annotated with @Secured in TSS, event requests are not checked either,
which is a serious security bug, as (almost) all actions that change data
in Tapestry applications are done in action requests.
--
Thiago H. de Paula Figueiredo
Independent Java, Apache Tapestry 5 and Hibernate consultant, developer,
and instructor
Owner, Ars Machina Tecnologia da Informa��o Ltda.
http://www.arsmachina.com.br
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: [T5.1 + TSS 2.1.0] @Secured annotation on class doesn't avoid
call to onActivate
Posted by "Thiago H. de Paula Figueiredo" <th...@gmail.com>.
On Mon, 17 May 2010 13:48:57 -0300, Alex Kotchnev <ak...@gmail.com>
wrote:
> Thiago,
> what would be the proper render event to decorate for access security
> checks (if not @SetupRender) if the page is annotated as @Secured ?
In this case, there's no rendering event that is triggered in every
request and before @SetupRender. The solution is to do this page
class-level check in a ComponentEventRenderFilter, not in a
ComponentClassTransformWorker, as TSS does. By the way, when a page class
is annotated with @Secured in TSS, event requests are not checked either,
which is a serious security bug, as (almost) all actions that change data
in Tapestry applications are done in action requests.
--
Thiago H. de Paula Figueiredo
Independent Java, Apache Tapestry 5 and Hibernate consultant, developer,
and instructor
Owner, Ars Machina Tecnologia da Informação Ltda.
http://www.arsmachina.com.br
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org