Improved: Normalize contextPath in hasBasePermission (OFBIZ-12887)

Better have a normalized contextPath in LoginWorker::hasBasePermission
apache · Feb 4, 2024 · 0d9ac6e · 0d9ac6e
1 parent c81a7ad
commit 0d9ac6e
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java
@@ -21,6 +21,8 @@
 import static org.apache.ofbiz.base.util.UtilGenerics.checkMap;
 
 import java.math.BigInteger;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.security.cert.X509Certificate;
 import java.sql.Timestamp;
 import java.util.ArrayList;
@@ -1372,6 +1374,13 @@ public static boolean hasBasePermission(GenericValue userLogin, HttpServletReque
             if (UtilValidate.isEmpty(contextPath)) {
                 contextPath = "/";
             }
+
+            try {
+                contextPath = new URI(contextPath).normalize().toString();
+            } catch (URISyntaxException e) {
+                throw new RuntimeException(e);
+            }
+
             ComponentConfig.WebappInfo info = ComponentConfig.getWebAppInfo(serverId, contextPath);
             if (info != null) {
                 return hasApplicationPermission(info, security, userLogin);