From 7268c81192fc4a759bcb13d6e0e21ecde1cc6823 Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Fri, 8 Jul 2005 21:16:12 +0000
Subject: [PATCH] Fix for SEC-27. Now checks for a null authentication before
 proceeding to fire the success event.

---
 .../RememberMeProcessingFilter.java           | 35 +++++++++++--------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/core/src/main/java/org/acegisecurity/ui/rememberme/RememberMeProcessingFilter.java b/core/src/main/java/org/acegisecurity/ui/rememberme/RememberMeProcessingFilter.java
index ad742722f4..db56bcf92b 100644
--- a/core/src/main/java/org/acegisecurity/ui/rememberme/RememberMeProcessingFilter.java
+++ b/core/src/main/java/org/acegisecurity/ui/rememberme/RememberMeProcessingFilter.java
@@ -17,6 +17,7 @@ package net.sf.acegisecurity.ui.rememberme;
 
 import net.sf.acegisecurity.context.SecurityContextHolder;
 import net.sf.acegisecurity.ui.InteractiveAuthenticationSuccesEvent;
+import net.sf.acegisecurity.Authentication;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -103,7 +104,7 @@ public class RememberMeProcessingFilter implements Filter, InitializingBean,
     }
 
     /**
-     * Does nothing - we reply on IoC lifecycle services instead.
+     * Does nothing - we rely on IoC lifecycle services instead.
      */
     public void destroy() {}
 
@@ -121,21 +122,25 @@ public class RememberMeProcessingFilter implements Filter, InitializingBean,
         HttpServletResponse httpResponse = (HttpServletResponse) response;
 
         if (SecurityContextHolder.getContext().getAuthentication() == null) {
-            SecurityContextHolder.getContext().setAuthentication(rememberMeServices
-                .autoLogin(httpRequest, httpResponse));
+            Authentication rememberMeAuth =
+                    rememberMeServices.autoLogin(httpRequest, httpResponse);
 
-            if (logger.isDebugEnabled()) {
-                logger.debug(
-                    "Replaced SecurityContextHolder with remember-me token: '"
-                    + SecurityContextHolder.getContext().getAuthentication()
-                    + "'");
-            }
+            if(rememberMeAuth != null) {
+                SecurityContextHolder.getContext().setAuthentication(rememberMeAuth);
 
-            // Fire event
-            if (this.context != null) {
-                context.publishEvent(new InteractiveAuthenticationSuccesEvent(
-                        SecurityContextHolder.getContext().getAuthentication(),
-                        this.getClass()));
+                if (logger.isDebugEnabled()) {
+                    logger.debug(
+                        "Replaced SecurityContextHolder with remember-me token: '"
+                        + SecurityContextHolder.getContext().getAuthentication()
+                        + "'");
+                }
+
+                // Fire event
+                if (this.context != null) {
+                    context.publishEvent(new InteractiveAuthenticationSuccesEvent(
+                            SecurityContextHolder.getContext().getAuthentication(),
+                            this.getClass()));
+                }
             }
         } else {
             if (logger.isDebugEnabled()) {
@@ -150,7 +155,7 @@ public class RememberMeProcessingFilter implements Filter, InitializingBean,
     }
 
     /**
-     * Does nothing - we reply on IoC lifecycle services instead.
+     * Does nothing - we rely on IoC lifecycle services instead.
      *
      * @param arg0 not used
      *