SEC-1465: Change DelegatingMethodSecurityMetadataSource to use constructor injection to get round the problem of it being invoked before it has been initialized properly. Also changed the contacts tests to use the same app context and loading order as the actual webapp, to give better reassurance that the app will run successfully.

samples/contacts/src/main/resources/applicationContext-security.xml

@@ -11,7 +11,7 @@
     xmlns:b="http://www.springframework.org/schema/beans"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
 
     <global-method-security pre-post-annotations="enabled">
         <expression-handler ref="expressionHandler"/>

samples/contacts/src/main/webapp/WEB-INF/web.xml

@@ -18,9 +18,9 @@
     <context-param>
         <param-name>contextConfigLocation</param-name>
         <param-value>
-            /WEB-INF/applicationContext-security.xml
             classpath:applicationContext-common-business.xml
             classpath:applicationContext-common-authorization.xml
+            classpath:applicationContext-security.xml
         </param-value>
     </context-param>
 

samples/contacts/src/test/java/sample/contact/ContactManagerTests.java

@@ -40,9 +40,9 @@ import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
  * @Author Luke Taylor
  */
 @ContextConfiguration(locations={
+                "/applicationContext-security.xml",
                 "/applicationContext-common-authorization.xml",
-                "/applicationContext-common-business.xml",
-                "/applicationContext-contacts-test.xml"})
+                "/applicationContext-common-business.xml"})
 @RunWith(SpringJUnit4ClassRunner.class)
 public class ContactManagerTests {
     //~ Instance fields ================================================================================================

samples/contacts/src/test/resources/applicationContext-contacts-test.xml

@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  - Application context containing authentication beans.
-  -
-  - Only used by unit tests.
-  -
-  -->
-
-<b:beans xmlns="http://www.springframework.org/schema/security"
-    xmlns:b="http://www.springframework.org/schema/beans"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
-
-    <global-method-security pre-post-annotations="enabled">
-        <expression-handler ref="expressionHandler"/>
-    </global-method-security>
-
-    <authentication-manager>
-        <authentication-provider>
-            <password-encoder hash="md5"/>
-            <jdbc-user-service data-source-ref="dataSource"/>
-        </authentication-provider>
-    </authentication-manager>
-
-    <b:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
-        <b:property name="permissionEvaluator">
-            <b:bean class="org.springframework.security.acls.AclPermissionEvaluator">
-                <b:constructor-arg ref="aclService"/>
-            </b:bean>
-        </b:property>
-    </b:bean>
-
-</b:beans>