From 5ddb98402ee1836210f216650b94a55066674f9f Mon Sep 17 00:00:00 2001
From: Thomas Wiese <mail@thomaswiese.de>
Date: Tue, 27 Nov 2018 18:08:53 +0100
Subject: [PATCH] filter boats by permission READ_PUBLIC

---
 .../gwt/ui/server/SailingServiceImpl.java        | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java
index 103305da626..67cb1a7e050 100755
--- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java
+++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java
@@ -5655,12 +5655,24 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public Iterable<BoatDTO> getAllBoats() {
-        return convertToBoatDTOs(getService().getBaseDomainFactory().getCompetitorAndBoatStore().getBoats());
+        List<BoatDTO> result = new ArrayList<>();
+        getSecurityService().filterObjectsWithPermissionForCurrentUser(SecuredDomainType.BOAT,
+                SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC,
+                getService().getBaseDomainFactory().getCompetitorAndBoatStore().getBoats(),
+                boat -> boat.getIdentifier().toString(),
+                filteredObject -> result.add(baseDomainFactory.convertToBoatDTO(filteredObject)));
+        return result;
     }
 
     @Override
     public Iterable<BoatDTO> getStandaloneBoats() {
-        return convertToBoatDTOs(getService().getBaseDomainFactory().getCompetitorAndBoatStore().getStandaloneBoats());
+        List<BoatDTO> result = new ArrayList<>();
+        getSecurityService().filterObjectsWithPermissionForCurrentUser(SecuredDomainType.BOAT,
+                SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC,
+                getService().getBaseDomainFactory().getCompetitorAndBoatStore().getStandaloneBoats(),
+                boat -> boat.getIdentifier().toString(),
+                filteredObject -> result.add(baseDomainFactory.convertToBoatDTO(filteredObject)));
+        return result;
     }
 
     @Override