hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-08 10:34:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

[DS-3662] DSpace 'logging in' without password or with non-existent e-mail using Shib and Password authentication (master port)

Browse Source
This commit is contained in:
Kim Shepherd
2018-04-13 12:07:14 +12:00
parent 8218b1ce24
commit 04181ef271
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
dspace-api/src/main/java/org/dspace/authenticate/ShibAuthentication.java
View File

@@ -1090,6 +1090,8 @@ public class ShibAuthentication implements AuthenticationMethod {
* *
* This method will not interpret the header value in any way. * This method will not interpret the header value in any way.
* *
* This method will return null if value is empty.
*
* @param request The HTTP request to look for values in. * @param request The HTTP request to look for values in.
* @param name The name of the attribute or header * @param name The name of the attribute or header
* @return The value of the attribute or header requested, or null if none found. * @return The value of the attribute or header requested, or null if none found.
@@ -1118,6 +1120,16 @@ public class ShibAuthentication implements AuthenticationMethod {
value = request.getHeader(name.toUpperCase()); value = request.getHeader(name.toUpperCase());
} }
// Added extra check for empty value of an attribute.
// In case that value is Empty, it should not be returned, return 'null' instead.
// This prevents passing empty value to other methods, stops the authentication process
// and prevents creation of 'empty' DSpace EPerson if autoregister == true and it subsequent
// authentication.
if (StringUtils.isEmpty(value)) {
log.debug("ShibAuthentication - attribute " + name + " is empty!");
return null;
}
boolean reconvertAttributes = boolean reconvertAttributes =
configurationService.getBooleanProperty( configurationService.getBooleanProperty(
"authentication-shibboleth.reconvert.attributes", "authentication-shibboleth.reconvert.attributes",