Skip to content

Commit bd4e5e9

Browse files
lmajanolmajano
committed
Merge branch 'development'
2 parents 5e6291c + 31fe911 commit bd4e5e9

File tree

12 files changed

+72
-53
lines changed

12 files changed

+72
-53
lines changed

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,6 @@ test-harness/logs/**
1111
test-harness/modules/**
1212

1313
# log files
14-
logs/**
14+
logs/**
15+
16+
modules/**

‎box.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name":"ColdBox Security",
3-
"version":"2.9.0",
3+
"version":"2.10.0",
44
"location":"https://downloads.ortussolutions.com/ortussolutions/coldbox-modules/cbsecurity/@build.version@/[email protected]@.zip",
55
"author":"Ortus Solutions.com <[email protected]>",
66
"slug":"cbsecurity",

‎changelog.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
----
99

10+
## [2.10.0] => 2021-FEB-12
11+
12+
### Added
13+
14+
* Moved the registration of the validator from the `configure()` to the `afterAspectsLoad()` interception point to allow for modules to declare the validator if needed.
15+
* Moved handler bean to `afterAspectsLoad()` to allow for module based invalid events to work.
16+
17+
----
18+
1019
## [2.9.0] => 2020-DEC-11
1120

1221
### Fixed

‎interceptors/Security.cfc‎

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,6 @@ component accessors="true" extends="coldbox.system.Interceptor" {
2828
* Configure the security firewall
2929
*/
3030
function configure(){
31-
variables.onInvalidEventHandlerBean = javacast( "null", "" );
32-
if ( len( variables.invalidEventHandler ) ) {
33-
variables.onInvalidEventHandlerBean = handlerService.getHandlerBean( variables.invalidEventHandler );
34-
}
35-
3631
// init the security modules dictionary
3732
variables.securityModules = {};
3833

@@ -49,10 +44,7 @@ component accessors="true" extends="coldbox.system.Interceptor" {
4944
setProperty( "rules", variables.rulesLoader.loadRules( getProperties() ) );
5045
}
5146

52-
// Load up the validator
53-
registerValidator( getInstance( getProperty( "validator" ) ) );
54-
55-
// Coldbox version 5 (and lower) needs a little extra invalid event handler checking.
47+
// Coldbox version 5 (and lower) needs a little extra invalid event handler checking.
5648
variables.enableInvalidHandlerCheck = ( listGetAt( controller.getColdboxSettings().version, 1, "." ) <= 5 );
5749
}
5850

@@ -66,6 +58,10 @@ component accessors="true" extends="coldbox.system.Interceptor" {
6658
prc,
6759
buffer
6860
){
61+
62+
// Register the validator
63+
registerValidator( getInstance( getProperty( "validator" ) ) );
64+
6965
// Register cbSecurity modules so we can incorporate them.
7066
controller
7167
.getSetting( "modules" )
@@ -82,6 +78,12 @@ component accessors="true" extends="coldbox.system.Interceptor" {
8278
// Register Module
8379
registerModule( arguments.module, arguments.config.settings.cbSecurity );
8480
} );
81+
82+
// Once ColdBox has loaded, load up the invalid event bean
83+
variables.onInvalidEventHandlerBean = javacast( "null", "" );
84+
if ( len( variables.invalidEventHandler ) ) {
85+
variables.onInvalidEventHandlerBean = handlerService.getHandlerBean( variables.invalidEventHandler );
86+
}
8587
}
8688

8789
/**
@@ -241,14 +243,14 @@ component accessors="true" extends="coldbox.system.Interceptor" {
241243
){
242244
// Get handler bean for the current event
243245
var handlerBean = variables.handlerService.getHandlerBean( arguments.event.getCurrentEvent() );
244-
246+
245247
// Are we running Coldbox 5 or older?
246248
// is an onInvalidHandlerBean configured?
247249
// is the current handlerBean the configured onInvalidEventHandlerBean?
248-
if (
249-
variables.enableInvalidHandlerCheck &&
250-
!isNull( variables.onInvalidEventHandlerBean ) &&
251-
isInvalidEventHandlerBean( handlerBean )
250+
if (
251+
variables.enableInvalidHandlerCheck &&
252+
!isNull( variables.onInvalidEventHandlerBean ) &&
253+
isInvalidEventHandlerBean( handlerBean )
252254
) {
253255
// ColdBox tries to detect invalid event handler loops by keeping
254256
// track of the last invalid event to fire. If that invalid event
@@ -260,7 +262,7 @@ component accessors="true" extends="coldbox.system.Interceptor" {
260262
request._lastInvalidEvent = variables.invalidEventHandler;
261263
return;
262264
}
263-
265+
264266
if ( handlerBean.getHandler() == "" ) {
265267
return;
266268
}
@@ -555,13 +557,9 @@ component accessors="true" extends="coldbox.system.Interceptor" {
555557
* @return { allow:boolean, type:string(authentication|authorization)}
556558
*/
557559
private struct function verifySecuredAnnotation( required securedValue, required event ){
558-
// If no value, then default it to true
559-
if ( !len( arguments.securedValue ) ) {
560-
arguments.securedValue = true;
561-
}
562560

563561
// Are we securing?
564-
if ( isBoolean( arguments.securedValue ) && !arguments.securedValue ) {
562+
if ( len( arguments.securedValue ) && isBoolean( arguments.securedValue ) && !arguments.securedValue ) {
565563
return {
566564
"allow" : true,
567565
"type" : "authentication"
@@ -741,7 +739,7 @@ component accessors="true" extends="coldbox.system.Interceptor" {
741739

742740
return len( CGI.REMOTE_ADDR ) ? CGI.REMOTE_ADDR : "127.0.0.1";
743741
}
744-
742+
745743
/**
746744
* Returns true of the passed handlerBean matches Coldbox's configured invalid event handler.
747745
*

‎interfaces/IAuthUser.cfc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ interface{
1212
function getId();
1313

1414
/**
15-
* Verify if the user has one or more of the passed in permissions
15+
* Verify if the user has the permission passed in
1616
*
17-
* @permission One or a list of permissions to check for access
17+
* @permission A single permission to check for access
1818
*
1919
*/
2020
boolean function hasPermission( required permission );

‎interfaces/ISecurityValidator.cfc‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,10 @@ interface{
1010
* This function is called once an incoming event matches a security rule.
1111
* You will receive the security rule that matched and an instance of the ColdBox controller.
1212
*
13-
* You must return a struct with two keys:
13+
* You must return a struct with three keys:
1414
* - allow:boolean True, user can continue access, false, invalid access actions will ensue
1515
* - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue.
16+
* - messages:string Info/debug messages
1617
*
1718
* @return { allow:boolean, type:string(authentication|authorization), messages:string }
1819
*/
@@ -22,9 +23,10 @@ interface{
2223
* This function is called once access to a handler/action is detected.
2324
* You will receive the secured annotation value and an instance of the ColdBox Controller
2425
*
25-
* You must return a struct with two keys:
26+
* You must return a struct with three keys:
2627
* - allow:boolean True, user can continue access, false, invalid access actions will ensue
2728
* - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue.
29+
* - messages:string Info/debug messages
2830
*
2931
* @return { allow:boolean, type:string(authentication|authorization), messages:string }
3032
*/

‎models/CBSecurity.cfc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -416,7 +416,7 @@ component singleton accessors="true" {
416416
* @items One, a list or an array
417417
*/
418418
private function arrayWrap( required items ){
419-
return isArray( arguments.items ) ? items : items.listToArray();
419+
return isArray( arguments.items ) ? items : listToArray( items );
420420
}
421421

422422
}

‎models/jwt/JwtService.cfc‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -759,10 +759,7 @@ component accessors="true" singleton {
759759
results.allow = (
760760
tokenHasScopes( arguments.permissions, payload.scope )
761761
||
762-
variables.cbSecurity
763-
.getAuthService()
764-
.getUser()
765-
.hasPermission( arguments.permissions )
762+
variables.cbSecurity.has( arguments.permissions )
766763
);
767764
results.type = "authorization";
768765
} else {

‎models/validators/CBAuthValidator.cfc‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,25 @@
22
* Copyright since 2016 by Ortus Solutions, Corp
33
* www.ortussolutions.com
44
* ---
5-
* This is the core validator which leverages CF Security via cflogin and cfloginuser
5+
* This is the core validator which leverages CBAuth
66
* https://helpx.adobe.com/coldfusion/developing-applications/developing-cfml-applications/securing-applications/using-coldfusion-security-tags-and-functions.html
77
*/
88
component singleton {
99

1010
// Injection
11-
property name="cbauth" inject="authenticationService@cbauth";
11+
property name="cbSecurity" inject="CBSecurity@cbSecurity";
1212

1313
/**
1414
* This function is called once an incoming event matches a security rule.
1515
* You will receive the security rule that matched and an instance of the
1616
* ColdBox controller.
1717
*
18-
* You must return a struct with two keys:
18+
* You must return a struct with three keys:
1919
* - allow:boolean True, user can continue access, false, invalid access actions will ensue
2020
* - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue.
2121
* - messages:string Info/debug messages
2222
*
23-
* @return { allow:boolean, type:authentication|authorization, messages:string }
23+
* @return { allow:boolean, type:string(authentication|authorization), messages:string }
2424
*/
2525
struct function ruleValidator( required rule, required controller ){
2626
return validateSecurity( arguments.rule.permissions );
@@ -30,12 +30,12 @@ component singleton {
3030
* This function is called once access to a handler/action is detected.
3131
* You will receive the secured annotation value and an instance of the ColdBox Controller
3232
*
33-
* You must return a struct with two keys:
33+
* You must return a struct with three keys:
3434
* - allow:boolean True, user can continue access, false, invalid access actions will ensue
3535
* - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue.
3636
* - messages:string Info/debug messages
3737
*
38-
* @return { allow:boolean, type:authentication|authorization, messages:string }
38+
* @return { allow:boolean, type:string(authentication|authorization), messages:string }
3939
*/
4040
struct function annotationValidator( required securedValue, required controller ){
4141
return validateSecurity( arguments.securedValue );
@@ -54,10 +54,10 @@ component singleton {
5454
};
5555

5656
// Are we logged in?
57-
if ( variables.cbauth.isLoggedIn() ) {
57+
if ( variables.cbSecurity.getAuthService().isLoggedIn() ) {
5858
// Do we have any permissions?
5959
if ( listLen( arguments.permissions ) ) {
60-
results.allow = variables.cbauth.getUser().hasPermission( arguments.permissions );
60+
results.allow = variables.cbSecurity.has( arguments.permissions );
6161
results.type = "authorization";
6262
} else {
6363
// We are satisfied!

‎models/validators/CFValidator.cfc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,12 @@ component singleton {
1212
* You will receive the security rule that matched and an instance of the
1313
* ColdBox controller.
1414
*
15-
* You must return a struct with two keys:
15+
* You must return a struct with three keys:
1616
* - allow:boolean True, user can continue access, false, invalid access actions will ensue
1717
* - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue.
1818
* - messages:string Info/debug messages
1919
*
20-
* @return { allow:boolean, type:authentication|authorization, messages:string }
20+
* @return { allow:boolean, type:string(authentication|authorization), messages:string }
2121
*/
2222
struct function ruleValidator( required rule, required controller ){
2323
return validateSecurity( arguments.rule.roles );
@@ -27,12 +27,12 @@ component singleton {
2727
* This function is called once access to a handler/action is detected.
2828
* You will receive the secured annotation value and an instance of the ColdBox Controller
2929
*
30-
* You must return a struct with two keys:
30+
* You must return a struct with three keys:
3131
* - allow:boolean True, user can continue access, false, invalid access actions will ensue
3232
* - type:string(authentication|authorization) The type of block that ocurred. Either an authentication or an authorization issue.
3333
* - messages:string Info/debug messages
3434
*
35-
* @return { allow:boolean, type:authentication|authorization, messages:string }
35+
* @return { allow:boolean, type:string(authentication|authorization), messages:string }
3636
*/
3737
struct function annotationValidator( required securedValue, required controller ){
3838
return validateSecurity( arguments.securedValue );

0 commit comments

Comments
 (0)