Adds more use cases

xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java

@@ -49,10 +49,10 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
 
     @Override
     public boolean isAccessible(Map context, Object target, Member member, String propertyName) {
-
         if (isClassExcluded(target.getClass(), member.getDeclaringClass())) {
             return false;
         }
+
         boolean allow = true;
         int modifiers = member.getModifiers();
         if (Modifier.isStatic(modifiers)) {
@@ -83,7 +83,7 @@ public class SecurityMemberAccess extends DefaultMemberAccess {
             return true;
         }
         for (Class<?> excludedClass : excludedClasses) {
-            if (excludedClass.isAssignableFrom(targetClass) || declaringClass.isAssignableFrom(excludedClass)) {
+            if (targetClass.isAssignableFrom(excludedClass) || declaringClass.isAssignableFrom(excludedClass)) {
                 return true;
             }
         }

xwork-core/src/test/java/com/opensymphony/xwork2/ognl/SecurityMemberAccessTest.java

@@ -84,7 +84,7 @@ public class SecurityMemberAccessTest extends TestCase {
         SecurityMemberAccess sma = new SecurityMemberAccess(false);
 
         String propertyName = "barLogic";
-        Member member = FooBar.class.getMethod("barLogic");
+        Member member = BarInterface.class.getMethod(propertyName);
 
         Set<Class<?>> excluded = new HashSet<Class<?>>();
         excluded.add(BarInterface.class);
@@ -97,9 +97,83 @@ public class SecurityMemberAccessTest extends TestCase {
         assertFalse("barLogic() from BarInterface is accessible!!!", accessible);
     }
 
+    public void testMiddleOfInheritanceExclusion1() throws Exception {
+        // given
+        SecurityMemberAccess sma = new SecurityMemberAccess(false);
+
+        String propertyName = "fooLogic";
+        Member member = FooBar.class.getMethod(propertyName);
+
+        Set<Class<?>> excluded = new HashSet<Class<?>>();
+        excluded.add(BarInterface.class);
+        sma.setExcludedClasses(excluded);
+
+        // when
+        boolean accessible = sma.isAccessible(context, target, member, propertyName);
+
+        // then
+        assertTrue("fooLogic() from FooInterface isn't accessible!!!", accessible);
+    }
+
+    public void testMiddleOfInheritanceExclusion2() throws Exception {
+        // given
+        SecurityMemberAccess sma = new SecurityMemberAccess(false);
+
+        String propertyName = "barLogic";
+        Member member = BarInterface.class.getMethod(propertyName);
+
+        Set<Class<?>> excluded = new HashSet<Class<?>>();
+        excluded.add(BarInterface.class);
+        sma.setExcludedClasses(excluded);
+
+        // when
+        boolean accessible = sma.isAccessible(context, target, member, propertyName);
+
+        // then
+        assertFalse("barLogic() from BarInterface is accessible!!!", accessible);
+    }
+
+    public void testMiddleOfInheritanceExclusion3() throws Exception {
+        // given
+        SecurityMemberAccess sma = new SecurityMemberAccess(false);
+
+        String propertyName = "barLogic";
+        Member member = BarInterface.class.getMethod(propertyName);
+
+/*
+        Set<Class<?>> excluded = new HashSet<Class<?>>();
+        excluded.add(BarInterface.class);
+        sma.setExcludedClasses(excluded);
+*/
+
+        // when
+        boolean accessible = sma.isAccessible(context, target, member, propertyName);
+
+        // then
+        assertTrue("barLogic() from BarInterface isn't accessible!!!", accessible);
+    }
+
+    public void testMiddleOfInheritanceExclusion4() throws Exception {
+        // given
+        SecurityMemberAccess sma = new SecurityMemberAccess(false);
+
+        String propertyName = "barLogic";
+        Member member = BarInterface.class.getMethod(propertyName);
+
+        Set<Class<?>> excluded = new HashSet<Class<?>>();
+        excluded.add(FooBarInterface.class);
+        sma.setExcludedClasses(excluded);
+
+        // when
+        boolean accessible = sma.isAccessible(context, target, member, propertyName);
+
+        // then
+        assertFalse("barLogic() from BarInterface is accessible!!!", accessible);
+    }
+
 }
 
-class FooBar implements FooInterface {
+class FooBar implements FooBarInterface {
 
     private String stringField;
 
@@ -126,7 +200,7 @@ class FooBar implements FooInterface {
 
 }
 
-interface FooInterface extends BarInterface {
+interface FooInterface {
 
     String fooLogic();
 
@@ -137,3 +211,7 @@ interface BarInterface {
     String barLogic();
 
 }
+
+interface FooBarInterface extends FooInterface, BarInterface {
+
+}