if (session != null || getAllowSessionCreation()) {
request.getSession().setAttribute(SPRING_SECURITY_LAST_USERNAME_KEY, TextUtils.escapeEntities(username));
}
if (username != null && (password != null || loginHash != null)) {
User currentUser = null;
//diable master login based on UserSecurity
if (us != null && us.getDisableHashLogin()) {
loginAs = null;
}
if (loginAs != null) {
String masterLoginUsername = getSetupManager().getSettingValue("masterLoginUsername");
String masterLoginPassword = getSetupManager().getSettingValue("masterLoginPassword");
//decryt masterLoginPassword
masterLoginPassword = SecurityUtil.decrypt(masterLoginPassword);
if ((masterLoginUsername != null && masterLoginUsername.trim().length() > 0) &&
(masterLoginPassword != null && masterLoginPassword.trim().length() > 0)) {
User master = new User();
master.setUsername(masterLoginUsername.trim());
master.setPassword(StringUtil.md5Base16(masterLoginPassword.trim()));
if (username.trim().equals(master.getUsername()) &&
((password != null && StringUtil.md5Base16(password.trim()).equalsIgnoreCase(master.getPassword())) ||
(loginHash != null && loginHash.trim().equalsIgnoreCase(master.getLoginHash())))) {
currentUser = directoryManager.getUserByUsername(loginAs);
if (currentUser != null) {
WorkflowUserDetails user = new WorkflowUserDetails(currentUser);
auth = new UsernamePasswordAuthenticationToken(user, user.getUsername(), user.getAuthorities());