QPID-2870: move the authorisation check outside the AtomicBoolean wrapped queue deletion process to prevent an unauthorised attempt from barring all future deletion attempts

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@998545 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 6 insertions, 5 deletions

diff --git a/java/broker/src/main/java/org/apache/qpid/server/queue/SimpleAMQQueue.java b/java/broker/src/main/java/org/apache/qpid/server/queue/SimpleAMQQueue.java
index fc04e1382e..112f682fdc 100644
--- a/java/broker/src/main/java/org/apache/qpid/server/queue/SimpleAMQQueue.java
+++ b/java/broker/src/main/java/org/apache/qpid/server/queue/SimpleAMQQueue.java
@@ -1357,13 +1357,14 @@ public class SimpleAMQQueue implements AMQQueue, Subscription.StateListener
     // TODO list all thrown exceptions
     public int delete() throws AMQSecurityException, AMQException
     {
+        // Check access
+        if (!_virtualHost.getSecurityManager().authoriseDelete(this))
+        {
+            throw new AMQSecurityException("Permission denied: " + getName());
+        }
+        
         if (!_deleted.getAndSet(true))
         {
-            // Check access
-            if (!_virtualHost.getSecurityManager().authoriseDelete(this))
-            {
-                throw new AMQSecurityException("Permission denied: " + getName());
-            }
 
             for (Binding b : getBindings())
             {