[jira] Created: (OFBIZ-3577) LoginWorker.doBasicLogout does not check userLogin against null

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

[jira] Created: (OFBIZ-3577) LoginWorker.doBasicLogout does not check userLogin against null

Nicolas Malin (Jira)
LoginWorker.doBasicLogout does not check userLogin against null
---------------------------------------------------------------

                 Key: OFBIZ-3577
                 URL: https://issues.apache.org/jira/browse/OFBIZ-3577
             Project: OFBiz
          Issue Type: Bug
          Components: framework
    Affects Versions: SVN trunk
            Reporter: Stefan Roggensack


The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values.

userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test.
This occurs when a user that is allready logout reloads the logout page.

--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

Reply | Threaded
Open this post in threaded view
|

[jira] Commented: (OFBIZ-3577) LoginWorker.doBasicLogout does not check userLogin against null

Nicolas Malin (Jira)

    [ https://issues.apache.org/jira/browse/OFBIZ-3577?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12850195#action_12850195 ]

Jacques Le Roux commented on OFBIZ-3577:
----------------------------------------

Hi Stefan,

A patch ?

> LoginWorker.doBasicLogout does not check userLogin against null
> ---------------------------------------------------------------
>
>                 Key: OFBIZ-3577
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-3577
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Stefan Roggensack
>
> The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values.
> userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test.
> This occurs when a user that is allready logout reloads the logout page.

--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

Reply | Threaded
Open this post in threaded view
|

[jira] Updated: (OFBIZ-3577) LoginWorker.doBasicLogout does not check userLogin against null

Nicolas Malin (Jira)
In reply to this post by Nicolas Malin (Jira)

     [ https://issues.apache.org/jira/browse/OFBIZ-3577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Stefan Roggensack updated OFBIZ-3577:
-------------------------------------

    Attachment: LoginWorker.java.patch

The requestst patch. Simple make a null check before use.

> LoginWorker.doBasicLogout does not check userLogin against null
> ---------------------------------------------------------------
>
>                 Key: OFBIZ-3577
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-3577
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Stefan Roggensack
>         Attachments: LoginWorker.java.patch
>
>
> The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values.
> userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test.
> This occurs when a user that is allready logout reloads the logout page.

--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.

Reply | Threaded
Open this post in threaded view
|

[jira] Closed: (OFBIZ-3577) LoginWorker.doBasicLogout does not check userLogin against null

Nicolas Malin (Jira)
In reply to this post by Nicolas Malin (Jira)

     [ https://issues.apache.org/jira/browse/OFBIZ-3577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jacques Le Roux closed OFBIZ-3577.
----------------------------------

       Resolution: Fixed
    Fix Version/s: SVN trunk
                   Release Branch 9.04
         Assignee: Jacques Le Roux

Thanks Stefan,

Your patch is in trunk at r928037, R9.04 at r928040

Actually it's was almost easier to do it by hand since I have to search where the file is :p. Normally we create patches from the root to easily patch. This is detailled [here|http://cwiki.apache.org/confluence/display/OFBADMIN/OFBiz+Contributors+Best+Practices]

Also how do you reload the logout page when you are already logged out? I did not find an easy way to do that.

> LoginWorker.doBasicLogout does not check userLogin against null
> ---------------------------------------------------------------
>
>                 Key: OFBIZ-3577
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-3577
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework
>    Affects Versions: SVN trunk
>            Reporter: Stefan Roggensack
>            Assignee: Jacques Le Roux
>             Fix For: Release Branch 9.04, SVN trunk
>
>         Attachments: LoginWorker.java.patch
>
>
> The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values.
> userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test.
> This occurs when a user that is allready logout reloads the logout page.

--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.