mx4j/src/core/javax/management/remote/rmi RMIServerImpl.java,1.10,1.11

Update of /cvsroot/mx4j/mx4j/src/core/javax/management/remote/rmi
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv30875/core/javax/management/remote/rmi

Modified Files:
	RMIServerImpl.java 
Log Message:
Wrapping the call to the JMXAuthenticator into a privileged block

Index: RMIServerImpl.java
===================================================================
RCS file: /cvsroot/mx4j/mx4j/src/core/javax/management/remote/rmi/RMIServerImpl.java,v
retrieving revision 1.10
retrieving revision 1.11
diff -C2 -d -r1.10 -r1.11
*** RMIServerImpl.java	7 Sep 2003 18:16:25 -0000	1.10
--- RMIServerImpl.java	1 Mar 2004 18:08:53 -0000	1.11
***************
*** 18,21 ****
--- 18,22 ----
  import java.security.AccessController;
  import java.security.AccessControlContext;
+ import java.security.PrivilegedAction;
  
  import javax.management.MBeanServer;
***************
*** 131,140 ****
     }
  
!    private Subject authenticate(Map env, Object credentials) throws SecurityException
     {
        Logger logger = getLogger();
  
        Subject subject = null;
!       JMXAuthenticator authenticator = (JMXAuthenticator)env.get(JMXConnectorServer.AUTHENTICATOR);
        if (authenticator != null)
        {
--- 132,141 ----
     }
  
!    private Subject authenticate(Map env, final Object credentials) throws SecurityException
     {
        Logger logger = getLogger();
  
        Subject subject = null;
!       final JMXAuthenticator authenticator = (JMXAuthenticator)env.get(JMXConnectorServer.AUTHENTICATOR);
        if (authenticator != null)
        {
***************
*** 142,146 ****
           try
           {
!             subject = authenticator.authenticate(credentials);
              if (subject == null) throw new SecurityException("JMXAuthenticator returned null Subject");
              if (logger.isEnabledFor(Logger.TRACE)) logger.trace("Authentication successful");
--- 143,155 ----
           try
           {
!             // We must check that the code that provided the JMXAuthenticator
!             // has the permission to create a Subject
!             subject = (Subject)AccessController.doPrivileged(new PrivilegedAction()
!             {
!                public Object run()
!                {
!                   return authenticator.authenticate(credentials);
!                }
!             }, getContext());
              if (subject == null) throw new SecurityException("JMXAuthenticator returned null Subject");
              if (logger.isEnabledFor(Logger.TRACE)) logger.trace("Authentication successful");



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click