From e4b77b38ee724d2afda75f76384f5cecd483dd6f Mon Sep 17 00:00:00 2001 From: Georg Herdt Date: Mon, 24 Feb 2020 16:21:35 +0100 Subject: [PATCH] filter deny actions for anonymous user ( -> userGroupId is null) #5059 --- .../com/sap/sse/security/impl/SecurityServiceImpl.java | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java index cc0ad23c82c..6acfa58cb14 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java @@ -29,6 +29,7 @@ import java.util.function.Consumer; import java.util.function.Function; import java.util.logging.Level; import java.util.logging.Logger; +import java.util.stream.Collectors; import javax.servlet.Filter; import javax.servlet.ServletContext; @@ -535,10 +536,14 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat } for (Map.Entry> entry : permissionMap.entrySet()) { final UserGroup userGroup = entry.getKey(); + // filter any denied action for anonymous user + Set filteredActions = entry.getValue().stream() + .filter(action -> !(entry.getKey() == null && action != null && action.startsWith("!"))) + .collect(Collectors.toSet()); + final UUID userGroupId = userGroup == null ? null : userGroup.getId(); - final Set actions = entry.getValue(); // avoid the UserGroup object having to be serialized with the operation by using the ID - apply(s -> s.internalAclPutPermissions(idOfAccessControlledObject, userGroupId, actions)); + apply(s -> s.internalAclPutPermissions(idOfAccessControlledObject, userGroupId, filteredActions)); } return accessControlStore.getAccessControlList(idOfAccessControlledObject).getAnnotation(); }