See http://www.nabble.com/AOP-security-bubbling-up-to-views-tf3870458s2369.html

AccessDeniedException doesn't properly bubble up to the view layer as intended.

The case is where a non-authorized, and non-ROLE_ADMIN, user tries to save a user. The UserSecurityAdvice should throw AccessDeniedException according to the aop:advisor, and the user should get a HTTP 403, and an "Access Denied" message page for their view.

This doesn't happen because the UserAction class doesn't catch a AccessDeniedException when saveUser is called. A catch statement in the UserAction.save(), after the saveUser call, will fix it, generally:

                        user = userManager.saveUser(user);
                } catch (AccessDeniedException ade) {
                        this.getResponse().sendError(HttpServletResponse.SC_FORBIDDEN);
                        return null;
                }

This affects both UserAction and SignupAction type controllers.

In the AppFuse 1.x implementation using Struts 1.x, the BaseAction was configured to catch this, and all Struts Actions extended BaseAction. AF2/Struts2 isn't setup the same way, so AccessDeniedException should be caught in each Action that needs it.

The attached patch fixes this for User/Signup controllers for JSF, Spring, Struts, and Tapestry web frameworks. It passes all maven tests on the current HEAD revision.