mx4j/src/core/mx4j/remote MX4JRemoteUtils.java,1.11,1.12

Update of /cvsroot/mx4j/mx4j/src/core/mx4j/remote
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv31500/core/mx4j/remote

Modified Files:
	MX4JRemoteUtils.java 
Log Message:
Fixing the security in case of delegate call: the Subject.doAs() call will use the delegate subject, not the authenticated one.

Index: MX4JRemoteUtils.java
===================================================================
RCS file: /cvsroot/mx4j/mx4j/src/core/mx4j/remote/MX4JRemoteUtils.java,v
retrieving revision 1.11
retrieving revision 1.12
diff -C2 -d -r1.11 -r1.12
*** MX4JRemoteUtils.java	29 Sep 2003 17:36:54 -0000	1.11
--- MX4JRemoteUtils.java	2 Mar 2004 13:58:37 -0000	1.12
***************
*** 141,148 ****
        }
  
        try
        {
           AccessControlContext subjectContext = getSubjectContext(subject, context);
!          return Subject.doAsPrivileged(subject, action, subjectContext);
        }
        catch (PrivilegedActionException x)
--- 141,155 ----
        }
  
+       // The precedent stack frames have normally AllPermission, since - for example in RMI - they
+       // are JDK domains or JMX/MX4J domains. Below I take the context at start() moment, and I
+       // inject the JSR 160 domain with the authenticated Subject, then call Subject.doAsPrivileged()
+       // with, eventually, the delegate Subject.
        try
        {
           AccessControlContext subjectContext = getSubjectContext(subject, context);
!          if (delegate == null)
!             return Subject.doAsPrivileged(subject, action, subjectContext);
!          else
!             return Subject.doAsPrivileged(delegate, action, subjectContext);
        }
        catch (PrivilegedActionException x)



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click