thymeleaf / thymeleaf-extras-springsecurity

Thymeleaf "extras" integration module for Spring Security 3.x and 4.x
http://www.thymeleaf.org
Apache License 2.0
477 stars 107 forks source link

Checking permission with hasPermission always return false #64

Closed chanhlt closed 5 years ago

chanhlt commented 5 years ago

I am using Spring Boot 2.x.x with Spring security ACL. I have a problem with hasPermission(#vars.object, ‘edit’) in HTML file. It always returns FALSE. However, hasRole(‘admin’) works perfectly. And hasPermission(returnObject, ‘edit’) in Java code works too.

Did I miss something ?

It seems this one #17 is still remain.

chanhlt commented 5 years ago

Actually, I forgot to set AclPermissionEvaluator for DefaultWebSecurityExpressionHandler.

@Override
    public void configure(final WebSecurity web) throws Exception {
        DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();
        AclPermissionEvaluator permissionEva=new AclPermissionEvaluator(aclService);
        permissionEva.setPermissionFactory(new CustomPermissionFactory());
        handler.setPermissionEvaluator(permissionEva);
        web.expressionHandler(handler);
        web.ignoring().antMatchers("/static/**");
    }

After doing this, everything works perfectly. :))