Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-31 22:46:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow ACL to be owned by GrantedAuthoritySid

Browse Source 
Closes gh-9425
This commit is contained in:
Roberto Paolillo
2021-02-12 13:15:06 +01:00
committed by Joe Grandja
parent 92b3a7b01b
commit efb394d3b2
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java
+8 -2
View File
@@ -93,11 +93,17 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
&& ((changeType == CHANGE_GENERAL) || (changeType == CHANGE_OWNERSHIP))) {
return;
}
// Not authorized by ACL ownership; try via adminstrative permissions
GrantedAuthority requiredAuthority = getRequiredAuthority(changeType);
// Iterate this principal's authorities to determine right
Set<String> authorities = AuthorityUtils.authorityListToSet(authentication.getAuthorities());
if (acl.getOwner() instanceof GrantedAuthoritySid
&& authorities.contains(((GrantedAuthoritySid) acl.getOwner()).getGrantedAuthority())) {
return;
}
// Not authorized by ACL ownership; try via adminstrative permissions
GrantedAuthority requiredAuthority = getRequiredAuthority(changeType);
if (authorities.contains(requiredAuthority.getAuthority())) {
return;
}