Hello Professor,

I have some problems with my security stuff. Actually, I got my ACCESS DENIED part working for both blog entry and comment with the help of method access decision voters. I have these write permissions on saveBlogEntry/saveComment, so they are invoked only when these methods are called. Now the problem is, if any user apart from the owner or admin knows the URL for add or edit, he is still able to get to the JSP page and gets the ACCESS DENIED message only after he submits the page.

I think I need to write a BusinessObjectAccessVoter to handle the read permissions. Now unlike getEnrollmentById, I can't have these read permissions for getBlogEntryById or getCommentById because these methods are also used by the view controllers apart from the add/edit controllers.

So how do I manage this?

Thanks,

Vishal

oh ok...Thanks Professor