You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2017/11/07 10:13:51 UTC

[sling-org-apache-sling-security] annotated tag org.apache.sling.security-1.0.16 created (now d9eaa31)

This is an automated email from the ASF dual-hosted git repository.

rombert pushed a change to annotated tag org.apache.sling.security-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-security.git.


      at d9eaa31  (tag)
 tagging da5bd086ba682799b5ceb6e586b8394c3915765a (commit)
      by Antonio Sanso
      on Tue Sep 1 09:31:09 2015 +0000

- Log -----------------------------------------------------------------
org.apache.sling.security-1.0.16
-----------------------------------------------------------------------

This annotated tag includes the following new commits:

     new 039593a  SLING-2141 - Add a way to check the referrer for modification requests
     new 6b5f16b  Ignore target
     new 78f00c6  SLING-2141 - Add a way to check the referrer for modification requests
     new ac5acb3  SLING-2141 - Add a way to check the referrer for modification requests
     new 8256705  SLING-2141 - Add a way to check the referrer for modification requests
     new 2e74bb2  SLING-2141 - Add a way to check the referrer for modification requests
     new a493d9f  SLING-2150 : Update plugins to use the latest available versions
     new 2989f95  SLING-2141 : Update localhost and server handling
     new bb90451  Update to recent snapshot
     new 3f3a1c3  Allow empty referrers by default
     new ea48c8c  Update default list
     new e782ad3  Using latest released parent pom
     new 04c948c  SLING-2664 : Use global filter instead of Sling filter
     new dfbcc57  Use latest Commons OSGi and return 403 instead of 500
     new d87917c  SLING-2198 - allowing request if the referrer host name matches the request host name (also, internalizing the PropertiesUtil class for compatibility purposes)
     new 23166c5  SLING-2200 - adding a configuration printer to the referrer filter
     new 01f70f8  Remove duplicate entry
     new 7a45910  SLING-2279 : ReferrerFilter should not reverse lookup the IPs of interfaces. Apply patch from Tobias Bocanegra
     new ceda7a9  [maven-release-plugin] prepare release org.apache.sling.security-1.0.0
     new d431bfd  [maven-release-plugin] prepare for next development iteration
     new 37a4ee1  Use latest parent pom in all projects
     new 9962937  Use latest parent pom everywhere
     new c537035  Set svn:ignore
     new b9b53a5  SLING-2694 :  Only check referrer header if request is from a browser
     new fa7665e  [maven-release-plugin] prepare release org.apache.sling.security-1.0.2
     new 38c657b  [maven-release-plugin] prepare for next development iteration
     new 64faf10  Use latest releases and update to new parent pom
     new 0f149ec  Update to latest parent pom and use latest releases in launchpad
     new fbfc8e8  SLING-2836 : Missing @(De)Activate annotations in ReferrerFilter#(de)activate() methods cause Sling Referrer Filter Tab clones
     new 4c40987  [maven-release-plugin] prepare release org.apache.sling.security-1.0.4
     new 6c3a2d5  [maven-release-plugin] prepare for next development iteration
     new fc2c9e5  Correct reactor pom and update to parent pom 16
     new 45dec5c  FELIX-2870 :  Support allowed hosts patterns in ReferrerFilter . Apply patch from Timothee Maret
     new 604b0b7  [maven-release-plugin] prepare release org.apache.sling.security-1.0.6
     new 6bd5364  [maven-release-plugin] prepare for next development iteration
     new a456ca7  SLING-4019 - ReferrerFilter should have DEFAULT_ALLOW_EMPTY set to false
     new daac5d7  SLING-4019 - ReferrerFilter should have DEFAULT_ALLOW_EMPTY set to false
     new 16d9866  [maven-release-plugin] prepare release org.apache.sling.security-1.0.8
     new a04352b  [maven-release-plugin] prepare for next development iteration
     new bd06fa0  SLING-3829 - Add support for Content-Disposition attachment
     new 5621fdb  [maven-release-plugin] prepare release org.apache.sling.security-1.0.10
     new 1bbc61c  [maven-release-plugin] prepare for next development iteration
     new b53e819  Remove duplicate dependency
     new 66f4cf3  Use latest parent pom
     new 19340b9  Update contrib modules to Parent 23
     new 9f722df  set parent version to 24 and add empty relativePath where missing
     new bdc9688  SLING-4604 - Multiple Content-Disposition headers added
     new 11ae6ca  SLING-4604 - Multiple Content-Disposition headers added
     new 5137124  SLING-4883 - Extend content disposition filter protection to jcr:data
     new e9d32c8  SLING-4883 - Extend content disposition filter protection to jcr:data
     new 0ff3107  SLING-4883 - Extend content disposition filter protection to jcr:data
     new 19b2034  SLING-4883 - Extend content disposition filter protection to jcr:data
     new 25c5733  SLING-4883 - Extend content disposition filter protection to jcr:data
     new ffbe306  SLING-4883 - Extend content disposition filter protection to jcr:data
     new 982486c  [maven-release-plugin] prepare release org.apache.sling.security-1.0.12
     new 56503a7  [maven-release-plugin] prepare for next development iteration
     new 0e3d293  SLING-4973 - Add Content Disposition Excluded Paths
     new 1b66ab6  [maven-release-plugin] prepare release org.apache.sling.security-1.0.14
     new c2314a8  [maven-release-plugin] prepare for next development iteration
     new 5842e4a  SLING-4982 - NPE in ContentDispositionFilter
     new e9492aa  SLING-4982 - NPE in ContentDispositionFilter
     new 782ea38  SLING-4983 - Limit the Content Disposition Filter to GET operations
     new ca77486  [maven-release-plugin] prepare release org.apache.sling.security-1.0.16
     new da5bd08  [maven-release-plugin] copy for tag org.apache.sling.security-1.0.16

The 64 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


-- 
To stop receiving notification emails like this one, please contact
['"commits@sling.apache.org" <co...@sling.apache.org>'].

[sling-org-apache-sling-security] 01/06: [maven-release-plugin] prepare for next development iteration

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.security-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-security.git

commit c2314a870668ca6d928ad2c0a86a43c7cce0f28c
Author: Antonio Sanso <as...@apache.org>
AuthorDate: Fri Aug 28 10:48:43 2015 +0000

    [maven-release-plugin] prepare for next development iteration
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security@1698302 13f79535-47bb-0310-9956-ffa450edef68
---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index cacf1c3..a98f3c8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@
     </parent>
 
     <artifactId>org.apache.sling.security</artifactId>
-    <version>1.0.14</version>
+    <version>1.0.15-SNAPSHOT</version>
     <packaging>bundle</packaging>
 
     <name>Apache Sling Security</name>
@@ -37,9 +37,9 @@
     </description>
 
     <scm>
-        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/tags/org.apache.sling.security-1.0.14</connection>
-        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.security-1.0.14</developerConnection>
-        <url>http://svn.apache.org/viewvc/sling/tags/org.apache.sling.security-1.0.14</url>
+        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security</connection>
+        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security</developerConnection>
+        <url>http://svn.apache.org/viewvc/sling/trunk/contrib/extensions/security</url>
     </scm>
 
     <build>

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-security] 06/06: [maven-release-plugin] copy for tag org.apache.sling.security-1.0.16

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.security-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-security.git

commit da5bd086ba682799b5ceb6e586b8394c3915765a
Author: Antonio Sanso <as...@apache.org>
AuthorDate: Tue Sep 1 09:31:09 2015 +0000

    [maven-release-plugin] copy for tag org.apache.sling.security-1.0.16
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.security-1.0.16@1700442 13f79535-47bb-0310-9956-ffa450edef68

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-security] 03/06: SLING-4982 - NPE in ContentDispositionFilter

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.security-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-security.git

commit e9492aa5a1651388dad9c89e57be552449ecd6f8
Author: Antonio Sanso <as...@apache.org>
AuthorDate: Tue Sep 1 09:02:53 2015 +0000

    SLING-4982 - NPE in ContentDispositionFilter
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security@1700426 13f79535-47bb-0310-9956-ffa450edef68
---
 .../security/impl/ContentDispositionFilter.java    | 28 ++++++++++++----------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java b/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
index 96b2df0..34e7871 100644
--- a/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
+++ b/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
@@ -283,19 +283,23 @@ public class ContentDispositionFilter implements Filter {
         
         private boolean isJcrData(Resource resource){
             boolean jcrData = false;
-            if (resource!= null) {
-                ValueMap props = resource.adaptTo(ValueMap.class);
-                if (props != null && props.containsKey(PROP_JCR_DATA) ) {
-                    jcrData = true;
-                } else {
-                    Resource jcrContent = resource.getChild(JCR_CONTENT_LEAF);
-                    if (jcrContent!= null) {
-                        props = jcrContent.adaptTo(ValueMap.class);
-                        if (props != null && props.containsKey(PROP_JCR_DATA) ) {
-                            jcrData = true;
+            try {
+                if (resource!= null) {
+                    ValueMap props = resource.adaptTo(ValueMap.class);
+                    if (props != null && props.containsKey(PROP_JCR_DATA) ) {
+                        jcrData = true;
+                    } else {
+                        Resource jcrContent = resource.getChild(JCR_CONTENT_LEAF);
+                        if (jcrContent!= null) {
+                            props = jcrContent.adaptTo(ValueMap.class);
+                            if (props != null && props.containsKey(PROP_JCR_DATA) ) {
+                                jcrData = true;
+                            }
                         }
-                    }
-                }     
+                    }     
+                }
+            } catch (Exception e) {
+                logger.error("Exception in isJcrData", e);
             }
             return jcrData;
         }

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-security] 02/06: SLING-4982 - NPE in ContentDispositionFilter

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.security-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-security.git

commit 5842e4a6af2abbc4f1870c1bedb1cf960aa0abc7
Author: Antonio Sanso <as...@apache.org>
AuthorDate: Tue Sep 1 08:55:03 2015 +0000

    SLING-4982 - NPE in ContentDispositionFilter
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security@1700424 13f79535-47bb-0310-9956-ffa450edef68
---
 .../security/impl/ContentDispositionFilter.java    |  4 +-
 .../impl/ContentDispositionFilterTest.java         | 57 ++++++++++++++++++++++
 2 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java b/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
index 09f4424..96b2df0 100644
--- a/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
+++ b/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
@@ -285,13 +285,13 @@ public class ContentDispositionFilter implements Filter {
             boolean jcrData = false;
             if (resource!= null) {
                 ValueMap props = resource.adaptTo(ValueMap.class);
-                if (props.containsKey(PROP_JCR_DATA) ) {
+                if (props != null && props.containsKey(PROP_JCR_DATA) ) {
                     jcrData = true;
                 } else {
                     Resource jcrContent = resource.getChild(JCR_CONTENT_LEAF);
                     if (jcrContent!= null) {
                         props = jcrContent.adaptTo(ValueMap.class);
-                        if (props.containsKey(PROP_JCR_DATA) ) {
+                        if (props != null && props.containsKey(PROP_JCR_DATA) ) {
                             jcrData = true;
                         }
                     }
diff --git a/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java b/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
index f601135..49b1ae7 100644
--- a/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
+++ b/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
@@ -1474,4 +1474,61 @@ public class ContentDispositionFilterTest {
         
         Assert.assertTrue(result);
     }
+    
+    @Test
+    public void test_isJcrData6() throws Throwable {
+        contentDispositionFilter = new ContentDispositionFilter();
+        final SlingHttpServletRequest request = context.mock(SlingHttpServletRequest.class);
+        final SlingHttpServletResponse response = context.mock(SlingHttpServletResponse.class);       
+        final ContentDispositionFilter.RewriterResponse rewriterResponse = contentDispositionFilter. new RewriterResponse(request, response);
+        
+        
+        final Resource resource = context.mock(Resource.class);
+        final ValueMap properties = context.mock(ValueMap.class);
+        
+        context.checking(new Expectations() {
+            {
+                allowing(resource).adaptTo(ValueMap.class);
+                will(returnValue(null));
+                allowing(resource).getChild(JCR_CONTENT_LEAF);
+                will(returnValue(null));
+            }
+        });     
+        
+        Boolean result = (Boolean) PrivateAccessor.invoke(rewriterResponse,"isJcrData",  new Class[]{Resource.class},new Object[]{resource});
+        
+        Assert.assertFalse(result);
+    }
+    
+    
+    @Test
+    public void test_isJcrData7() throws Throwable {
+        contentDispositionFilter = new ContentDispositionFilter();
+        final SlingHttpServletRequest request = context.mock(SlingHttpServletRequest.class);
+        final SlingHttpServletResponse response = context.mock(SlingHttpServletResponse.class);       
+        final ContentDispositionFilter.RewriterResponse rewriterResponse = contentDispositionFilter. new RewriterResponse(request, response);
+        
+        final Resource child = context.mock(Resource.class, "child");
+        final Resource resource = context.mock(Resource.class, "resource" );
+        final ValueMap properties = context.mock(ValueMap.class);
+        final ValueMap childPropoerties = context.mock(ValueMap.class, "childPropoerties");
+
+        
+        context.checking(new Expectations() {
+            {
+                allowing(resource).adaptTo(ValueMap.class);
+                will(returnValue(properties));
+                allowing(properties).containsKey(PROP_JCR_DATA);
+                will(returnValue(false));
+                allowing(resource).getChild(JCR_CONTENT_LEAF);
+                will(returnValue(child));
+                allowing(child).adaptTo(ValueMap.class);
+                will(returnValue(null));
+            }
+        });     
+        
+        Boolean result = (Boolean) PrivateAccessor.invoke(rewriterResponse,"isJcrData",  new Class[]{Resource.class},new Object[]{resource});
+        
+        Assert.assertFalse(result);
+    }
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-security] 05/06: [maven-release-plugin] prepare release org.apache.sling.security-1.0.16

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.security-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-security.git

commit ca7748611d4273a2b567fc925ac160a5581df4b1
Author: Antonio Sanso <as...@apache.org>
AuthorDate: Tue Sep 1 09:30:55 2015 +0000

    [maven-release-plugin] prepare release org.apache.sling.security-1.0.16
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security@1700441 13f79535-47bb-0310-9956-ffa450edef68
---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index a98f3c8..723befa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@
     </parent>
 
     <artifactId>org.apache.sling.security</artifactId>
-    <version>1.0.15-SNAPSHOT</version>
+    <version>1.0.16</version>
     <packaging>bundle</packaging>
 
     <name>Apache Sling Security</name>
@@ -37,9 +37,9 @@
     </description>
 
     <scm>
-        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security</connection>
-        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security</developerConnection>
-        <url>http://svn.apache.org/viewvc/sling/trunk/contrib/extensions/security</url>
+        <connection>scm:svn:http://svn.apache.org/repos/asf/sling/tags/org.apache.sling.security-1.0.16</connection>
+        <developerConnection>scm:svn:https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.security-1.0.16</developerConnection>
+        <url>http://svn.apache.org/viewvc/sling/tags/org.apache.sling.security-1.0.16</url>
     </scm>
 
     <build>

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.

[sling-org-apache-sling-security] 04/06: SLING-4983 - Limit the Content Disposition Filter to GET operations

Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rombert pushed a commit to annotated tag org.apache.sling.security-1.0.16
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-security.git

commit 782ea38c6365eee325741794a6e1c7f6136a36be
Author: Antonio Sanso <as...@apache.org>
AuthorDate: Tue Sep 1 09:21:11 2015 +0000

    SLING-4983 - Limit the Content Disposition Filter to GET operations
    
    git-svn-id: https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security@1700435 13f79535-47bb-0310-9956-ffa450edef68
---
 .../security/impl/ContentDispositionFilter.java    | 94 +++++++++++-----------
 .../impl/ContentDispositionFilterTest.java         | 44 ++++++++++
 2 files changed, 90 insertions(+), 48 deletions(-)

diff --git a/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java b/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
index 34e7871..bc3d64b 100644
--- a/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
+++ b/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
@@ -221,47 +221,49 @@ public class ContentDispositionFilter implements Filter {
          * @see javax.servlet.ServletResponseWrapper#setContentType(java.lang.String)
          */
         public void setContentType(String type) { 
-            String previousContentType = (String) request.getAttribute(ATTRIBUTE_NAME);
-            
-            if (previousContentType != null && previousContentType.equals(type)) {
-                return;
-            }
-            request.setAttribute(ATTRIBUTE_NAME, type);
-            Resource resource = request.getResource();
-            String resourcePath = resource.getPath();
-            
-            if (!contentDispositionExcludedPaths.contains(resourcePath)) {
+            if ("GET".equals(request.getMethod())) {
+                String previousContentType = (String) request.getAttribute(ATTRIBUTE_NAME);
+
+                if (previousContentType != null && previousContentType.equals(type)) {
+                    return;
+                }
+                request.setAttribute(ATTRIBUTE_NAME, type);
+                Resource resource = request.getResource();
+                String resourcePath = resource.getPath();
+
+                if (!contentDispositionExcludedPaths.contains(resourcePath)) {
 
-                if (enableContentDispositionAllPaths) {
-                    setContentDisposition(resource);
-                } else {               
+                    if (enableContentDispositionAllPaths) {
+                        setContentDisposition(resource);
+                    } else {               
 
-                    boolean contentDispositionAdded = false;
-                    if (contentDispositionPaths.contains(resourcePath)) {
+                        boolean contentDispositionAdded = false;
+                        if (contentDispositionPaths.contains(resourcePath)) {
 
-                        if (contentTypesMapping.containsKey(resourcePath)) {
-                            Set <String> exceptions = contentTypesMapping.get(resourcePath);
-                            if (!exceptions.contains(type)) {
+                            if (contentTypesMapping.containsKey(resourcePath)) {
+                                Set <String> exceptions = contentTypesMapping.get(resourcePath);
+                                if (!exceptions.contains(type)) {
+                                    contentDispositionAdded = setContentDisposition(resource);
+                                }
+                            } else {
                                 contentDispositionAdded = setContentDisposition(resource);
                             }
-                        } else {
-                            contentDispositionAdded = setContentDisposition(resource);
-                        }
-                    }            
-                    if (!contentDispositionAdded) {
-                        for (String path : contentDispositionPathsPfx) {
-                            if (resourcePath.startsWith(path)) {
-                                if (contentTypesMapping.containsKey(path)) {
-                                    Set <String> exceptions = contentTypesMapping.get(path);
-                                    if (!exceptions.contains(type)) {
+                        }            
+                        if (!contentDispositionAdded) {
+                            for (String path : contentDispositionPathsPfx) {
+                                if (resourcePath.startsWith(path)) {
+                                    if (contentTypesMapping.containsKey(path)) {
+                                        Set <String> exceptions = contentTypesMapping.get(path);
+                                        if (!exceptions.contains(type)) {
+                                            setContentDisposition(resource);
+                                            break;
+                                        }
+                                    } else {
                                         setContentDisposition(resource);
                                         break;
                                     }
-                                } else {
-                                    setContentDisposition(resource);
-                                    break;
-                                }
 
+                                }
                             }
                         }
                     }
@@ -283,23 +285,19 @@ public class ContentDispositionFilter implements Filter {
         
         private boolean isJcrData(Resource resource){
             boolean jcrData = false;
-            try {
-                if (resource!= null) {
-                    ValueMap props = resource.adaptTo(ValueMap.class);
-                    if (props != null && props.containsKey(PROP_JCR_DATA) ) {
-                        jcrData = true;
-                    } else {
-                        Resource jcrContent = resource.getChild(JCR_CONTENT_LEAF);
-                        if (jcrContent!= null) {
-                            props = jcrContent.adaptTo(ValueMap.class);
-                            if (props != null && props.containsKey(PROP_JCR_DATA) ) {
-                                jcrData = true;
-                            }
+            if (resource!= null) {
+                ValueMap props = resource.adaptTo(ValueMap.class);
+                if (props != null && props.containsKey(PROP_JCR_DATA) ) {
+                    jcrData = true;
+                } else {
+                    Resource jcrContent = resource.getChild(JCR_CONTENT_LEAF);
+                    if (jcrContent!= null) {
+                        props = jcrContent.adaptTo(ValueMap.class);
+                        if (props != null && props.containsKey(PROP_JCR_DATA) ) {
+                            jcrData = true;
                         }
-                    }     
-                }
-            } catch (Exception e) {
-                logger.error("Exception in isJcrData", e);
+                    }
+                }     
             }
             return jcrData;
         }
diff --git a/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java b/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
index 49b1ae7..b777857 100644
--- a/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
+++ b/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
@@ -280,6 +280,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -320,6 +322,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -366,6 +370,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -412,6 +418,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -458,6 +466,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -510,6 +520,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -556,6 +568,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -596,6 +610,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -635,6 +651,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -680,6 +698,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -726,6 +746,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -766,6 +788,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -805,6 +829,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
                 will(returnValue(null));
                 allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -851,6 +877,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -907,6 +935,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 exactly(1).of(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -967,6 +997,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 exactly(1).of(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1029,6 +1061,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 exactly(1).of(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1090,6 +1124,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 exactly(1).of(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1150,6 +1186,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 exactly(1).of(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1210,6 +1248,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 exactly(1).of(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1269,6 +1309,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -1322,6 +1364,8 @@ public class ContentDispositionFilterTest {
         
         context.checking(new Expectations() {
             {
+                allowing(request).getMethod();
+                will(returnValue("GET"));
                 allowing(response).containsHeader("Content-Disposition");
                 will(returnValue(false));
                 allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);

-- 
To stop receiving notification emails like this one, please contact
"commits@sling.apache.org" <co...@sling.apache.org>.