diff --git a/src/main/java/de/thm/arsnova/aop/AuthorizationAdviser.java b/src/main/java/de/thm/arsnova/aop/AuthorizationAdviser.java index 6e7ee94c7985806cc77518900f232d99a2066cd3..8fe9ae26156001ee21b3a1e12c4cb26d372be393 100644 --- a/src/main/java/de/thm/arsnova/aop/AuthorizationAdviser.java +++ b/src/main/java/de/thm/arsnova/aop/AuthorizationAdviser.java @@ -27,6 +27,8 @@ public class AuthorizationAdviser { public void checkAuthorization(Authenticated authenticated, Object object) { User u = userService.getUser(SecurityContextHolder.getContext().getAuthentication()); if (u == null) throw new UnauthorizedException(); + // TODO: For unauthorized users e.g. after logout there is still a user object with username 'anonymous' + if (u.getUsername().equals("anonymous")) throw new UnauthorizedException(); } /** This method checks if the user is enlisted in current ARSnova session diff --git a/src/main/java/de/thm/arsnova/services/UserService.java b/src/main/java/de/thm/arsnova/services/UserService.java index ab0436a0d16cc128624e7c07afc1ac5c05b38a70..166c25cbe27fd74ebe39d4b6b3cd0d6b981deeb0 100644 --- a/src/main/java/de/thm/arsnova/services/UserService.java +++ b/src/main/java/de/thm/arsnova/services/UserService.java @@ -7,13 +7,11 @@ import org.springframework.security.authentication.AnonymousAuthenticationToken; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.cas.authentication.CasAuthenticationToken; import org.springframework.security.core.Authentication; -import org.springframework.stereotype.Service; import com.github.leleuj.ss.oauth.client.authentication.OAuthAuthenticationToken; import de.thm.arsnova.entities.User; -@Service public class UserService implements IUserService { @Override diff --git a/src/main/webapp/WEB-INF/spring/spring-main.xml b/src/main/webapp/WEB-INF/spring/spring-main.xml index 775e6179d3c8081773b1d112937c8b368cb4cbc5..f6cce1fcf84c7600286ef9f24ed6447553a02617 100644 --- a/src/main/webapp/WEB-INF/spring/spring-main.xml +++ b/src/main/webapp/WEB-INF/spring/spring-main.xml @@ -77,5 +77,11 @@ init-method="startServer" destroy-method="stopServer" scope="singleton" p:portNumber="${socketio.port}" p:hostIp="${socketio.ip}" p:useSSL="${security.ssl}" p:keystore="${security.keystore}" p:storepass="${security.storepass}" /> + + <bean id="authorizationAdviser" class="de.thm.arsnova.aop.AuthorizationAdviser"> + <property name="userService" ref="userService" /> + </bean> + + <bean id="userService" scope="singleton" class="de.thm.arsnova.services.UserService" /> </beans>