Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-04 09:17:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1635: Stop security interceptors from calling AfterInvocationManager if exception occurs during invocation

Browse Source
This commit is contained in:
Luke Taylor
2010-12-14 16:20:27 +00:00
parent 2be2660b13
commit ce421f22bf
7 changed files with 105 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/manual/src/docbook/technical-overview.xml
+8 -3
View File
@@ -551,7 +551,9 @@ Successfully authenticated. Security context contains: \
</listitem>
<listitem>
<para>Call the <interfacename>AfterInvocationManager</interfacename> if
configured, once the invocation has returned.</para>
configured, once the invocation has returned. If the invocation raised an
exception, the <interfacename>AfterInvocationManager</interfacename>
will not be invoked.</para>
</listitem>
</orderedlist></para>
<section xml:id="tech-intro-config-attributes">
@@ -602,7 +604,7 @@ Successfully authenticated. Security context contains: \
</section>
<section>
<title>AfterInvocationManager</title>
<para>Following the secure object proceeding and then returning - which may mean a
<para>Following the secure object invocation proceeding and then returning - which may mean a
method invocation completing or a filter chain proceeding - the
<classname>AbstractSecurityInterceptor</classname> gets one final chance to
handle the invocation. At this stage the
@@ -613,7 +615,10 @@ Successfully authenticated. Security context contains: \
<classname>AbstractSecurityInterceptor</classname> will pass control to an
<literal>AfterInvocationManager</literal> to actually modify the object if
needed. This class can even entirely replace the object, or throw an exception,
or not change it in any way as it chooses.</para>
or not change it in any way as it chooses. The after-invocation checks will only
be executed if the invocation is successful. If an exception occurs, the additional
checks will be skipped.
</para>
<para><classname>AbstractSecurityInterceptor</classname> and its related objects are
shown in <xref linkend="abstract-security-interceptor"/>. <figure
xml:id="abstract-security-interceptor">