eclipse-sailing-analytics/sailing-analytics
1
0 Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-11-07 19:42:17 +00:00
Code Activity

Bug 4892: added meta permission check for adding a role to a usergroup +

Browse Source 
adjusted ownership removal when deleting a usergroup
This commit is contained in:
Steffen Jacobs committed 2019-06-24 12:43:34 +02:00
1 parent 42c05bc80b
commit 49d3d9395c
1 file changed
+11 -10
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/UserGroupResource.java
+11 -10
View File
@@ -22,6 +22,7 @@ import com.sap.sse.common.Util;
import com.sap.sse.security.jaxrs.AbstractSecurityResource;
import com.sap.sse.security.shared.RoleDefinition;
import com.sap.sse.security.shared.UserGroupManagementException;
import com.sap.sse.security.shared.impl.Ownership;
import com.sap.sse.security.shared.impl.SecuredSecurityTypes;
import com.sap.sse.security.shared.impl.User;
import com.sap.sse.security.shared.impl.UserGroup;
@@ -160,16 +161,10 @@ public class UserGroupResource extends AbstractSecurityResource {
response = Response.status(Status.BAD_REQUEST).entity("Usergroup with this name does not exist.")
.build();
} else {
if (getService().hasCurrentUserDeletePermission(usergroup)) {
try {
getService().deleteUserGroup(usergroup);
response = Response.status(Status.NO_CONTENT).build();
} catch (UserGroupManagementException e) {
response = Response.status(Status.INTERNAL_SERVER_ERROR).entity(e.getMessage()).build();
}
} else {
response = Response.status(Status.UNAUTHORIZED).build();
}
getService().checkPermissionAndDeleteOwnershipForObjectRemoval(usergroup, () -> {
getService().deleteUserGroup(usergroup);
});
response = Response.status(Status.NO_CONTENT).build();
}
} catch (IllegalArgumentException e) {
response = Response.status(Status.BAD_REQUEST).entity("Invalid group id.").build();
@@ -288,6 +283,12 @@ public class UserGroupResource extends AbstractSecurityResource {
JSONObject jsonBody = (JSONObject) JSONValue.parse(body);
boolean roleForAll = Boolean.valueOf((String) jsonBody.get(KEY_FOR_ALL));
if (forAll == null || forAll != roleForAll) {
if (!getService().hasCurrentUserMetaPermissionsOfRoleDefinitionWithQualification(role,
new Ownership(null, usergroup))) {
response = Response.status(Status.UNAUTHORIZED)
.entity(String.format("Not permitted to add role %s to group", role.getName()))
.build();
}
getService().putRoleDefinitionToUserGroup(usergroup, role, roleForAll);
response = Response.ok().build();
} else {