From 519234f8f5b5abade80087155c727665dc55494b Mon Sep 17 00:00:00 2001 From: Omair Majid Date: Fri, 17 Dec 2010 16:19:35 -0500 Subject: use full privileges when checking whether to prompt user or not 2010-12-17 Omair Majid * netx/net/sourceforge/jnlp/security/SecurityWarning.java (shouldPromptUser): Use full privileges when checking configuration. This value is not security-sensitive and the method is private. * netx/net/sourceforge/jnlp/services/ServiceUtil.java (shouldPromptUser): Likewise. --- netx/net/sourceforge/jnlp/security/SecurityWarning.java | 9 +++++++-- netx/net/sourceforge/jnlp/services/ServiceUtil.java | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) (limited to 'netx/net/sourceforge') diff --git a/netx/net/sourceforge/jnlp/security/SecurityWarning.java b/netx/net/sourceforge/jnlp/security/SecurityWarning.java index 08f67fd..f3d6dfb 100644 --- a/netx/net/sourceforge/jnlp/security/SecurityWarning.java +++ b/netx/net/sourceforge/jnlp/security/SecurityWarning.java @@ -319,8 +319,13 @@ public class SecurityWarning { * @return true if security warnings should be shown to the user. */ private static boolean shouldPromptUser() { - return Boolean.valueOf(JNLPRuntime.getConfiguration() - .getProperty(DeploymentConfiguration.KEY_SECURITY_PROMPT_USER)); + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Boolean run() { + return Boolean.valueOf(JNLPRuntime.getConfiguration() + .getProperty(DeploymentConfiguration.KEY_SECURITY_PROMPT_USER)); + } + }); } } diff --git a/netx/net/sourceforge/jnlp/services/ServiceUtil.java b/netx/net/sourceforge/jnlp/services/ServiceUtil.java index b55bba4..d030395 100644 --- a/netx/net/sourceforge/jnlp/services/ServiceUtil.java +++ b/netx/net/sourceforge/jnlp/services/ServiceUtil.java @@ -299,8 +299,13 @@ public class ServiceUtil { * @return true if the user should be prompted for JNLP API related permissions. */ private static boolean shouldPromptUser() { - return Boolean.valueOf(JNLPRuntime.getConfiguration() - .getProperty(DeploymentConfiguration.KEY_SECURITY_PROMPT_USER_FOR_JNLP)); + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Boolean run() { + return Boolean.valueOf(JNLPRuntime.getConfiguration() + .getProperty(DeploymentConfiguration.KEY_SECURITY_PROMPT_USER_FOR_JNLP)); + } + }); } } -- cgit v1.2.3