eclipse-sailing-analytics/sailing-analytics
1
0
Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-09-21 21:25:38 +00:00
Code Activity

bug6097: in SecurityApi wait sufficiently between user creations

Browse Source
This commit is contained in:
Axel Uhl
2025-03-19 21:15:30 +01:00
parent fd974a09dd
commit f6a3bd16b0
3 changed files with 24 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java
+9
View File
@@ -12,6 +12,7 @@ import java.util.function.Consumer;
import java.util.function.Function;
import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.cache.CacheManager;
@@ -19,6 +20,7 @@ import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.osgi.framework.BundleContext;
import com.sap.sse.common.Duration;
import com.sap.sse.common.Util;
import com.sap.sse.common.Util.Pair;
import com.sap.sse.common.http.HttpHeaderUtil;
@@ -59,6 +61,7 @@ import com.sap.sse.security.shared.impl.UserGroup;
import com.sap.sse.security.shared.subscription.Subscription;
import com.sap.sse.security.shared.subscription.SubscriptionPlan;
import com.sap.sse.shared.classloading.ClassLoaderRegistry;
import com.sap.sse.util.HttpRequestUtils;
/**
* A service interface for security management. Intended to be used as an OSGi service that can be registered, e.g., by
@@ -78,6 +81,12 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
String ALL_USERNAME = "<all>";
String TENANT_SUFFIX = "-tenant";
String REPLICABLE_FULLY_QUALIFIED_CLASSNAME = SecurityServiceImpl.class.getName();
/**
* The default locking duration per client IP address for user creation.
*
* @see HttpRequestUtils#getClientIP(HttpServletRequest)
*/
Duration DEFAULT_CLIENT_IP_BASED_USER_CREATION_LOCKING_DURATION = Duration.ONE_MINUTE;
SecurityManager getSecurityManager();
java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
-9
View File
@@ -84,7 +84,6 @@ import org.scribe.model.Token;
import org.scribe.oauth.OAuthService;
import com.sap.sse.ServerInfo;
import com.sap.sse.common.Duration;
import com.sap.sse.common.TimePoint;
import com.sap.sse.common.Util;
import com.sap.sse.common.Util.Pair;
@@ -192,7 +191,6 @@ import com.sap.sse.security.util.RemoteServerUtil;
import com.sap.sse.shared.classloading.ClassLoaderRegistry;
import com.sap.sse.shared.util.impl.ApproximateTime;
import com.sap.sse.util.ClearStateTestSupport;
import com.sap.sse.util.HttpRequestUtils;
import com.sap.sse.util.ThreadPoolUtil;
public class SecurityServiceImpl
@@ -283,13 +281,6 @@ implements ReplicableSecurityService, ClearStateTestSupport {
*/
private final ConcurrentMap<String, LockingAndBanning> clientIPBasedLockingAndBanningForUserCreation;
/**
* The default locking duration per client IP address for user creation.
*
* @see HttpRequestUtils#getClientIP(HttpServletRequest)
*/
private final static Duration DEFAULT_CLIENT_IP_BASED_USER_CREATION_LOCKING_DURATION = Duration.ONE_MINUTE;
/**
* When working with a user's subscriptions, such as first reading, then changing and updating a user's subscription
* based on what was read, a user-specific write lock must be obtained to ensure that no writes can cut in between.