Better protect access to Jackrabbit user manager

[lgpl/argeo-commons.git] / security / runtime / org.argeo.security.core / src / main / java / org / argeo / security / jcr / SimpleJcrSecurityModel.java

diff --git a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/SimpleJcrSecurityModel.java b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/SimpleJcrSecurityModel.java
index e564e9fd08380fc7179c03f4cf27eac3ca0be07a..aa2ad4915ea242a2d941a4def8c66e1a828981e9 100644 (file)
--- a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/SimpleJcrSecurityModel.java
+++ b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/SimpleJcrSecurityModel.java
@@ -31,7 +31,8 @@ public class SimpleJcrSecurityModel implements JcrSecurityModel {
        /** The home base path. */
        private String homeBasePath = "/home";
 
-       public Node sync(Session session, String username, List<String> roles) {
+       public synchronized Node sync(Session session, String username,
+                       List<String> roles) {
                // TODO check user name validity (e.g. should not start by ROLE_)
 
                try {
@@ -57,7 +58,7 @@ public class SimpleJcrSecurityModel implements JcrSecurityModel {
 
                        // Remote roles
                        if (roles != null) {
-                               //writeRemoteRoles(userHome, roles);
+                               // writeRemoteRoles(userHome, roles);
                        }
 
                        Node userProfile = UserJcrUtils.getUserProfile(session, username);