Skip to content

Commit 315a0bc

Browse files
author
Marco Rietveld
committed
BZ-1229171 - Any authenticated user can see tasks from other users via Java Remote REST API: NPE fix when cmd user == null
(cherry picked from commit 37c28f6)
1 parent a1e6e2b commit 315a0bc

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

kie-remote/kie-remote-client/src/main/java/org/kie/services/client/api/command/AbstractRemoteCommandObject.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,7 @@ void preprocessCommand( Command cmd ) {
142142
if( cmdUserId == null ) {
143143
taskCmd.setUserId(authUserId);
144144
logger.debug("Using user id '" + authUserId + "' for '" + cmdName + "'.");
145-
}
146-
if( ! cmdUserId.equals(authUserId) ) {
145+
} else if( ! cmdUserId.equals(authUserId) ) {
147146
throw new RemoteApiException("The user id used when retrieving task information (" + cmdUserId + ")"
148147
+ " must match the authenticating user (" + authUserId + ")!");
149148
}

0 commit comments

Comments
 (0)