Release Notes - Spring Security - Version 1.0.4 - HTML format

Bug

• [SEC-357] - SwitchUserProcessingFilter allows a null j_username
• [SEC-376] - FilterSecurityInterceptor is not applied to /j_acegi_switch_user
• [SEC-395] - HttpSessionEventPublisher causes a NullPointerException
• [SEC-397] - TokenBasedRememberMeServices cookie path changes result in side effects.
• [SEC-401] - AclEntryVoter and BasicAclEntryVoter use startsWith for configuration attribute matching
• [SEC-402] - SwitchUserProcessingFilter's switchUserUrl
• [SEC-404] - Logout when not logged in cause NullPointerException
• [SEC-407] - Hitting LogoutFilter's URL when not logged in causes NPE
• [SEC-411] - SecurityContextHolderAwareRequestWrapper does not define required constructor
• [SEC-416] - jsf tag in acegi's error page not work properly!
• [SEC-419] - org.acegisecurity.afterinvocation.CollectionFilterer's logger error
• [SEC-423] - CLONE -SEC 356 Introduces New Bug: Changes to Authentication leak into synchronous requests when using HttpSessionContextIntegrationFilter
• [SEC-424] - MethodDefinitionMap - Can't access inherited methods
• [SEC-425] - <include> bypasses FilterInvocationInterceptor
• [SEC-431] - copyFiles.bat in acegi-security-sample-tutorial.war archive
• [SEC-433] - Fix to SEC-359 has introduced a NullPointer to TokenBasedRememberMeServices.logout()
• [SEC-434] - AuthenticationManager.authenticate() with a valid username and a null password causes NPE.
• [SEC-437] - Missing JAR in CAS documentation
• [SEC-438] - exceptionMappings in ProviderManager cannot be added from subclasses
• [SEC-439] - AclEntryAfterInvocationProvider.decide() returns null when result object not applicable to the provider
• [SEC-440] - Documentation: Correction in CAS chapter (section 18.3.2) of Acegi Security documentation for v1.0.3
• [SEC-444] - Race condition inside ConcurrentSessionControllerImpl
• [SEC-447] - Exploitable XSS in sample apps
• [SEC-451] - Empty context path in LogoutFilter and AbstractProcessingFilter
• [SEC-453] - CasAuthenticationHandler does not log root cause of AuthenticationException.
• [SEC-459] - Incorrect MessageSource constructor used
• [SEC-461] - HttpSessionContextIntegrationFilter with cloneFromHttpSession = true causes problems at login
• [SEC-464] - NPE when missing 'j_acegi_logout' when not logged in
• [SEC-466] - BasicProcessingFilter
• [SEC-474] - TokenBasedRememberMeServices fail with empty password
• [SEC-478] - Incorrect decoding of base64 cookie value by TokenBasedRememberMeServices.autoLogin

Improvement

• [SEC-298] - Max age of cookie could be limited in TokenBasedRememberMeServices
• [SEC-305] - HttpSessionContextIntegrationFilter to retain SecurityContext when rendering error pages
• [SEC-307] - RememberMeProcessingFilter should store authentication authenticated by authenticationManager
• [SEC-343] - FilterChainProxy.obtainAllDefinedFilters(ConfigAttributeDefinition) should allow subclasses to override
• [SEC-363] - jsp:include parameters are missing
• [SEC-400] - ObjectIdentityImpl to clarify non-null contract for accessor on domain objects
• [SEC-403] - Add messages_zh_CN.properties
• [SEC-405] - Difficult to customise success targetUrl on AbstractProcessingFilter
• [SEC-409] - More flexibility in UserDetailsService
• [SEC-415] - Add Document Management System ACL sample
• [SEC-421] - Parent of MutableAcl is a MutableAcl, should be a simple Acl
• [SEC-436] - Make BasePermission and CumulativePermission provide hashCode() method
• [SEC-442] - AbstractProcessingFilter.obtainFullRequestUrl is static and cannot be overridden
• [SEC-443] - Redirect URL cannot be made relative in AbstractProcessingFilter.sendRedirect()
• [SEC-463] - AbstractSecurityInterceptor: make retrieval and setting of Authentication object customizable
• [SEC-467] - New Acl package not compatible with Mysql Db
• [SEC-470] - make org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices can customize cookie name and tokenExpiryTime
• [SEC-472] - Allow overriding AuthenticationProcessingFilterEntryPoint to choose alternative login form URLs.
• [SEC-476] - LoggerListener logs non-AbstractAuthenticationFailureEvents at warn level

Task

• [SEC-452] - Dependency from Spring 1.2.8 to Spring 2.0.x

The text area below allows the project release notes to be edited and copied to another document.