acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProvider.java
@SuppressWarnings("unchecked")
	public Object decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> config, Object returnedObject)
			throws AccessDeniedException {

		if (returnedObject == null) {
			logger.debug("Return object is null, skipping");

			return null;
		}

		for (ConfigAttribute attr : config) {
			if (!this.supports(attr)) {
				continue;
			}

			// Need to process the Collection for this invocation
			Filterer filterer;

			if (returnedObject instanceof Collection) {
				filterer = new CollectionFilterer((Collection) returnedObject);
			}
			else if (returnedObject.getClass().isArray()) {
				filterer = new ArrayFilterer((Object[]) returnedObject);
			}
			else {
				throw new AuthorizationServiceException(
						"A Collection or an array (or null) was required as the "
								+ "returnedObject, but the returnedObject was: "
								+ returnedObject);
			}

			// Locate unauthorised Collection elements
			for (Object domainObject : filterer) {
				// Ignore nulls or entries which aren't instances of the configured domain
				// object class
				if (domainObject == null
						|| !getProcessDomainObjectClass().isAssignableFrom(
								domainObject.getClass())) {
					continue;
				}

				if (!hasPermission(authentication, domainObject)) {
					filterer.remove(domainObject);

					if (logger.isDebugEnabled()) {
						logger.debug("Principal is NOT authorised for element: "
								+ domainObject);
					}
				}
			}

			return filterer.getFilteredObject();
		}

		return returnedObject;
	}
@SuppressWarnings("unchecked")
	public Object decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> config, Object returnedObject)
			throws AccessDeniedException {

		if (returnedObject == null) {
			logger.debug("Return object is null, skipping");

			return null;
		}

		for (ConfigAttribute attr : config) {
			if (!this.supports(attr)) {
				continue;
			}

			// Need to process the Collection for this invocation
			Filterer filterer;

			if (returnedObject instanceof Collection) {
				filterer = new CollectionFilterer((Collection) returnedObject);
			}
			else if (returnedObject.getClass().isArray()) {
				filterer = new ArrayFilterer((Object[]) returnedObject);
			}
			else {
				throw new AuthorizationServiceException(
						"A Collection or an array (or null) was required as the "
								+ "returnedObject, but the returnedObject was: "
								+ returnedObject);
			}

			// Locate unauthorised Collection elements
			for (Object domainObject : filterer) {
				// Ignore nulls or entries which aren't instances of the configured domain
				// object class
				if (domainObject == null
						|| !getProcessDomainObjectClass().isAssignableFrom(
								domainObject.getClass())) {
					continue;
				}

				if (!hasPermission(authentication, domainObject)) {
					filterer.remove(domainObject);

					if (logger.isDebugEnabled()) {
						logger.debug("Principal is NOT authorised for element: "
								+ domainObject);
					}
				}
			}

			return filterer.getFilteredObject();
		}

		return returnedObject;
	}
========================================================================================================