hazelcast/hazelcast — pull request #2546 by dbrimley (2014-05-23 15:04:58+00:00)
Title: Security permission fix

Permissions do not work when you have multiple perms for a Data Structure.

For example in MapPermission class we initialise the bitwise integers with hex values, this is incorrect and will not produce the correct mask when performing AND operations where multiple permissions are combined.

Take an example where READ and CREATE are allowed....

READ was being set with 0x16 (which is 22 not setting bit 16 as intended)
CREATE was being set with 0x01

Assume this is a allowed set of operations against a Map. When 2 values are added to create a mask it will come out to 10111 now when this is applied with bit AND against a PUT permission which is 0x04 which is 00100 it will return a true for the PUT permission.

Please see com.hazelcast.security.permission.MapPermissionTest