From 0c89822c56b1402336afae55bf6a35dfcf2730c2 Mon Sep 17 00:00:00 2001
From: Ben Alex <ben.alex@springsource.com>
Date: Sat, 28 Jan 2006 01:24:52 +0000
Subject: [PATCH] SEC-162: Properly handle null Authentication.

---
 .../intercept/method/MethodInvocationPrivilegeEvaluator.java | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/core/src/main/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluator.java b/core/src/main/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluator.java
index 6ee33f0384..e459f48bd8 100644
--- a/core/src/main/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluator.java
+++ b/core/src/main/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluator.java
@@ -64,9 +64,6 @@ public class MethodInvocationPrivilegeEvaluator implements InitializingBean {
     }
 
     public boolean isAllowed(MethodInvocation mi, Authentication authentication) {
-        Assert.notNull(authentication, "Authentication required");
-        Assert.notNull(authentication.getAuthorities(),
-            "Authentication must provided non-null GrantedAuthority[]s");
         Assert.notNull(mi, "MethodInvocation required");
         Assert.notNull(mi.getMethod(),
             "MethodInvocation must provide a non-null getMethod()");
@@ -82,7 +79,7 @@ public class MethodInvocationPrivilegeEvaluator implements InitializingBean {
             return true;
         }
 
-        if (authentication == null) {
+        if (authentication == null || authentication.getAuthorities() == null || authentication.getAuthorities().length == 0) {
             return false;
         }