tomee-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From pesticide <pestic...@mail.ru>
Subject Re: may be a bug ?
Date Tue, 15 Mar 2011 14:38:37 GMT
Unfortunately it is not possible to change existing ejb-jar.xml (it might be
very error prone).

Besides according to the specification it is absolutely legal to have
several method-permission elements:

21.3.2 Method Permissions
...
The method permissions relation is defined as the union of all the method
permissions defined
in the individual method-permission elements.
...

I made an investigation and discovered this:

org.apache.openejb.assembler.classic.MethodInfoUtil.resolveAttributes(...)
line 249:

attributes.put(method, attributeInfo);

which means that multiple method declaration is overwritten with the last
method-permission element:

boiled down example:

&lt;method-permission&gt;
  &lt;role-name&gt;Superman&lt;/role-name&gt;
    &lt;method&gt;
      &lt;ejb-name>MegaBean&lt;/ejb-name&gt;
         &lt;method-name>saveTheWorld&lt;/method-name&gt;
    &lt;/method&gt;
&lt;/method-permission&gt;
&lt;method-permission&gt;
  &lt;role-name&gt;Battman&lt;/role-name&gt;
    &lt;method&gt;
      &lt;ejb-name&gt;MegaBean&lt;/ejb-name&gt;
    &lt;method-name&gt;saveTheWorld&lt;/method-name&gt;
  &lt;/method&gt;
&lt;/method-permission&gt;

saveTheWorld method must have both roles instead it is gonna have only one:
"Battman"

So from my point of view 

attributes.put(method, attributeInfo);

must be replaced with something more elaborate to allow to merge
attributeInfos



--
View this message in context: http://openejb.979440.n4.nabble.com/may-be-a-bug-tp3346396p3356775.html
Sent from the OpenEJB User mailing list archive at Nabble.com.

Mime
View raw message