BasicSecuritySystem only allows modifications for members logged into same group

[jamoore]

BSS only permitted modifications to an object which was group-writable if the user had logged in explicitly to the group, e.g. via Login(userName,password, groupName, eventType)

The implementation was roughly:

1.  boolean allowUpdate(){
2.    //...
3.    if ( p.isGranted(GROUP,WRITE) && group.getId().equals( currentGroupId() ))
4.        return true;
5.    //...
6.  }

Line 3 should be changed to:

      if ( p.isGranted(GROUP,WRITE) && memberOfGroups().contains( group.getId() ))

[jmoore]

r890 implements the suggested fix.

[jmoore]

This is working in (client) WriteSecurityTest?. Closing.