rotty3000/liferay-portal — pull request #129 by zberentey (2012-11-16 13:22:47+00:00)
Title: LPS-30769

Hey Ray, I have made some changes. Allowing reflections when the caller class loader is null is not safe. If in our case the caller were someone else the caller class loader would still be null but in this case we should not allow the reflection. Hence the code to find out the real class loader. I put it into PortalSecurityManager and forgot the new CheckAccessMemberPermission because the performance of Reflection.getCallerClass() degrades more and more the further you're checking in the call stack, so trying to do the same later would have an unecessary hit on performance. Let me know if there are some other concerns besides the poor performance of walking thorugh the call stack, which I am totally aware of but couldn't find any other way... Thanks.