TRUNK-6203: Global properties access should be privileged (#190)

openmrs · Jun 3, 2024 · 16bab70 · 16bab70
1 parent 981fccc
commit 16bab70
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/omod/src/main/java/org/openmrs/web/servlet/LoginServlet.java b/omod/src/main/java/org/openmrs/web/servlet/LoginServlet.java
@@ -33,6 +33,7 @@
 import org.openmrs.api.context.ContextAuthenticationException;
 import org.openmrs.util.LocaleUtility;
 import org.openmrs.util.OpenmrsConstants;
+import org.openmrs.util.PrivilegeConstants;
 import org.openmrs.web.OpenmrsCookieLocaleResolver;
 import org.openmrs.web.WebConstants;
 import org.openmrs.web.WebUtil;
@@ -81,8 +82,16 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
 		// look up the allowed # of attempts per IP
 		Integer allowedLockoutAttempts = 100;
 
-		String allowedLockoutAttemptsGP = Context.getAdministrationService().getGlobalProperty(
-		    GP_ALLOWED_LOGIN_ATTEMPTS_PER_IP, "100");
+		String allowedLockoutAttemptsGP = "100";
+		try {
+			Context.addProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+			allowedLockoutAttemptsGP = Context.getAdministrationService().getGlobalProperty(
+			    GP_ALLOWED_LOGIN_ATTEMPTS_PER_IP, "100");
+		}
+		finally {
+			Context.removeProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+		}
+
 		try {
 			allowedLockoutAttempts = Integer.valueOf(allowedLockoutAttemptsGP.trim());
 		}