test/cuba
1
0
Fork 0
mirror of https://gitee.com/jmix/cuba.git synced 2024-12-04 20:28:00 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

PL-8242 Do not use User session fixation protection if connection is not authenticated

Browse Source
This commit is contained in:
Yuriy Artamonov 2016-11-22 15:31:41 +04:00
parent 7fd3acff5e
commit a4fa2c0afc
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
modules/web/src/com/haulmont/cuba/web/DefaultApp.java
View File

@ -84,7 +84,8 @@ public class DefaultApp extends App implements ConnectionListener, UserSubstitut
// substitution listeners are cleared by connection on logout
connection.addSubstitutionListener(this);
if (webConfig.getUseSessionFixationProtection()) {
if (connection.isAuthenticated()
&& webConfig.getUseSessionFixationProtection()) {
VaadinService.reinitializeSession(VaadinService.getCurrentRequest());
WrappedSession session = VaadinSession.getCurrent().getSession();