From a2ef10e65f4c3d4f91502712d5385f85325bf00d Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Mon, 8 Dec 2008 21:54:47 +0000
Subject: [PATCH] SEC-1033: Fixed missing AuthenticationTrustResolver in web
 SecurityExpressionRoot. Converted some logging to trace level.

---
 .../method/ExpressionAnnotationMethodDefinitionSource.java    | 4 ++--
 .../expression/support/DefaultSecurityExpressionHandler.java  | 1 +
 .../security/expression/support/SecurityExpressionRoot.java   | 4 ++++
 .../security/expression/web/WebExpressionConfigAttribute.java | 4 ++++
 .../security/expression/web/WebExpressionVoter.java           | 4 ++++
 5 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/org/springframework/security/expression/method/ExpressionAnnotationMethodDefinitionSource.java b/core/src/main/java/org/springframework/security/expression/method/ExpressionAnnotationMethodDefinitionSource.java
index 6e04f4c7b5..7bc5b1bf7a 100644
--- a/core/src/main/java/org/springframework/security/expression/method/ExpressionAnnotationMethodDefinitionSource.java
+++ b/core/src/main/java/org/springframework/security/expression/method/ExpressionAnnotationMethodDefinitionSource.java
@@ -58,7 +58,7 @@ public class ExpressionAnnotationMethodDefinitionSource extends AbstractMethodDe
             return null;
         }
 
-        logger.debug("Looking for expression annotations for method '" +
+        logger.trace("Looking for expression annotations for method '" +
                 method.getName() + "' on target class '" + targetClass + "'");
         PreFilter preFilter = findAnnotation(method, targetClass, PreFilter.class);
         PreAuthorize preAuthorize = findAnnotation(method, targetClass, PreAuthorize.class);
@@ -68,7 +68,7 @@ public class ExpressionAnnotationMethodDefinitionSource extends AbstractMethodDe
 
         if (preFilter == null && preAuthorize == null && postFilter == null && postAuthorize == null ) {
             // There is no meta-data so return
-            logger.debug("No expression annotations found");
+            logger.trace("No expression annotations found");
             return null;
         }
 
diff --git a/core/src/main/java/org/springframework/security/expression/support/DefaultSecurityExpressionHandler.java b/core/src/main/java/org/springframework/security/expression/support/DefaultSecurityExpressionHandler.java
index 712cee2b6f..fa71fcdf09 100644
--- a/core/src/main/java/org/springframework/security/expression/support/DefaultSecurityExpressionHandler.java
+++ b/core/src/main/java/org/springframework/security/expression/support/DefaultSecurityExpressionHandler.java
@@ -61,6 +61,7 @@ public class DefaultSecurityExpressionHandler implements SecurityExpressionHandl
     public EvaluationContext createEvaluationContext(Authentication authentication, FilterInvocation fi) {
         StandardEvaluationContext ctx = new StandardEvaluationContext();
         SecurityExpressionRoot root = new WebSecurityExpressionRoot(authentication, fi);
+        root.setTrustResolver(trustResolver);
         ctx.setRootObject(root);
 
         return ctx;
diff --git a/core/src/main/java/org/springframework/security/expression/support/SecurityExpressionRoot.java b/core/src/main/java/org/springframework/security/expression/support/SecurityExpressionRoot.java
index 929bbe5a84..4d9fec64a5 100644
--- a/core/src/main/java/org/springframework/security/expression/support/SecurityExpressionRoot.java
+++ b/core/src/main/java/org/springframework/security/expression/support/SecurityExpressionRoot.java
@@ -69,6 +69,10 @@ abstract class SecurityExpressionRoot {
         return trustResolver.isAnonymous(authentication);
     }
 
+    public final boolean isAuthenticated() {
+        return !isAnonymous();
+    }
+
     public final boolean isRememberMe() {
         return trustResolver.isRememberMe(authentication);
     }
diff --git a/core/src/main/java/org/springframework/security/expression/web/WebExpressionConfigAttribute.java b/core/src/main/java/org/springframework/security/expression/web/WebExpressionConfigAttribute.java
index e7ad2d603f..803dc94e67 100644
--- a/core/src/main/java/org/springframework/security/expression/web/WebExpressionConfigAttribute.java
+++ b/core/src/main/java/org/springframework/security/expression/web/WebExpressionConfigAttribute.java
@@ -25,4 +25,8 @@ class WebExpressionConfigAttribute implements ConfigAttribute {
         return null;
     }
 
+    @Override
+    public String toString() {
+        return authorizeExpression.getExpressionString();
+    }
 }
diff --git a/core/src/main/java/org/springframework/security/expression/web/WebExpressionVoter.java b/core/src/main/java/org/springframework/security/expression/web/WebExpressionVoter.java
index b3d4aeaace..4dcda56d8f 100644
--- a/core/src/main/java/org/springframework/security/expression/web/WebExpressionVoter.java
+++ b/core/src/main/java/org/springframework/security/expression/web/WebExpressionVoter.java
@@ -21,6 +21,10 @@ public class WebExpressionVoter implements AccessDecisionVoter {
     private SecurityExpressionHandler expressionHandler = new DefaultSecurityExpressionHandler();
 
     public int vote(Authentication authentication, Object object, List<ConfigAttribute> attributes) {
+        assert authentication != null;
+        assert object != null;
+        assert attributes != null;
+
         WebExpressionConfigAttribute weca = findConfigAttribute(attributes);
 
         if (weca == null) {