Just got some security advices to work on Inectis. The code is really simple, and I surely could use some input here.
First, I've got this poorly-named class:
public class SecurityManager { public void authenticate(String username, String password) throws SecurityManagerException { if (username == null || password == null || "".equals(username) || "".equals(password))
throw new
SecurityManagerException("Invalid login - null or empty
username/password");
// find user with that username User user = EntryPoint.findUser(username); if(user == null) { throw new SecurityManagerException("Invalid login - unknown user"); }
if (hasAcl) { if (loggedOn) { return checkAcl(jp, manager, acl); } else { throw new SecurityManagerException(
"User is not logged - call to " + method + ")"); } } else { return jp.proceed(); } }
The checkAcl method will remain hidden to protect the innocent and to
avoid people having heart attacks (it's as sloppy as it gets for now,
but it works). Anyway, you can guess what's going on there.
So, what do you think? Could I have made it better somehow, and I'm
missing something important? Please, keep in mind that I don't want to
use J2EE-based security, because I don't know yet if this code will run
only on a J2EE container (it might be usefult to create a desktop app
to manage content, maybe?).
Previous Topic
