From 0c43fe1f4aadd77f9dac82438dae8fe9207f76ba Mon Sep 17 00:00:00 2001
From: Ben Alex <ben.alex@springsource.com>
Date: Mon, 2 Aug 2004 23:08:52 +0000
Subject: [PATCH] Make SecurityEnforcementFilter more subclass friendly.

---
 changelog.txt                                     |  1 +
 .../intercept/web/SecurityEnforcementFilter.java  | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/changelog.txt b/changelog.txt
index a9bb74f532..42d8860077 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -12,6 +12,7 @@ Changes in version 0.6 (2004-xx-xx)
 * Added failed Authentication object to AuthenticationExceptions
 * Added signed JARs to all official release builds (see readme.txt)
 * Added remote client authentication validation package
+* Added protected sendAccessDeniedError method to SecurityEnforcementFilter
 * Updated Authentication to be serializable (Weblogic support)
 * Updated to Clover 1.3
 * Updated to HSQLDB version 1.7.2 Release Candidate 6D
diff --git a/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java b/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java
index 2b000291c6..7254b9efb5 100644
--- a/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java
+++ b/core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java
@@ -202,11 +202,24 @@ public class SecurityEnforcementFilter implements Filter, InitializingBean {
                     "Access is denied - sending back forbidden response");
             }
 
-            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN); // 403
+            sendAccessDeniedError(request, response);
         } catch (Throwable otherException) {
             throw new ServletException(otherException);
         }
     }
 
     public void init(FilterConfig filterConfig) throws ServletException {}
+
+    /**
+     * Allows subclasses to override if required
+     *
+     * @param request
+     * @param response
+     *
+     * @throws IOException
+     */
+    protected void sendAccessDeniedError(ServletRequest request,
+        ServletResponse response) throws IOException {
+        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN); // 403
+    }
 }