LoginWorker.doBasicLogout does not check userLogin against null
--------------------------------------------------------------- Key: OFBIZ-3577 URL: https://issues.apache.org/jira/browse/OFBIZ-3577 Project: OFBiz Issue Type: Bug Components: framework Affects Versions: SVN trunk Reporter: Stefan Roggensack The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values. userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test. This occurs when a user that is allready logout reloads the logout page. -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
[ https://issues.apache.org/jira/browse/OFBIZ-3577?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12850195#action_12850195 ] Jacques Le Roux commented on OFBIZ-3577: ---------------------------------------- Hi Stefan, A patch ? > LoginWorker.doBasicLogout does not check userLogin against null > --------------------------------------------------------------- > > Key: OFBIZ-3577 > URL: https://issues.apache.org/jira/browse/OFBIZ-3577 > Project: OFBiz > Issue Type: Bug > Components: framework > Affects Versions: SVN trunk > Reporter: Stefan Roggensack > > The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values. > userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test. > This occurs when a user that is allready logout reloads the logout page. -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-3577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Stefan Roggensack updated OFBIZ-3577: ------------------------------------- Attachment: LoginWorker.java.patch The requestst patch. Simple make a null check before use. > LoginWorker.doBasicLogout does not check userLogin against null > --------------------------------------------------------------- > > Key: OFBIZ-3577 > URL: https://issues.apache.org/jira/browse/OFBIZ-3577 > Project: OFBiz > Issue Type: Bug > Components: framework > Affects Versions: SVN trunk > Reporter: Stefan Roggensack > Attachments: LoginWorker.java.patch > > > The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values. > userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test. > This occurs when a user that is allready logout reloads the logout page. -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-3577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Jacques Le Roux closed OFBIZ-3577. ---------------------------------- Resolution: Fixed Fix Version/s: SVN trunk Release Branch 9.04 Assignee: Jacques Le Roux Thanks Stefan, Your patch is in trunk at r928037, R9.04 at r928040 Actually it's was almost easier to do it by hand since I have to search where the file is :p. Normally we create patches from the root to easily patch. This is detailled [here|http://cwiki.apache.org/confluence/display/OFBADMIN/OFBiz+Contributors+Best+Practices] Also how do you reload the logout page when you are already logged out? I did not find an easy way to do that. > LoginWorker.doBasicLogout does not check userLogin against null > --------------------------------------------------------------- > > Key: OFBIZ-3577 > URL: https://issues.apache.org/jira/browse/OFBIZ-3577 > Project: OFBiz > Issue Type: Bug > Components: framework > Affects Versions: SVN trunk > Reporter: Stefan Roggensack > Assignee: Jacques Le Roux > Fix For: Release Branch 9.04, SVN trunk > > Attachments: LoginWorker.java.patch > > > The method org.ofbiz.webapp.control.LoginWorker.doBasicLogout is use userLogin without check for against null values. > userLogin is the values of request.getSession().getAttribute("userLogin") (Line 568) in Line 589 this is value is used. For the use in Line 585 there is a null pointer test. > This occurs when a user that is allready logout reloads the logout page. -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
Free forum by Nabble | Edit this page |