From 62f23b15f8b04732d8aa36cc3cb81e5148efe7fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kai=20B=C3=B6rnert?= Date: Tue, 3 Jul 2018 10:46:38 +0200 Subject: [PATCH] bug4479 added permissions check --- .../sap/sailing/server/gateway/jaxrs/api/WindResource.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/WindResource.java b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/WindResource.java index 5bd49178c9f..9a0ec2bb869 100644 --- a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/WindResource.java +++ b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/WindResource.java @@ -6,6 +6,7 @@ import javax.ws.rs.Path; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; +import org.apache.shiro.SecurityUtils; import org.json.simple.JSONArray; import org.json.simple.JSONObject; import org.json.simple.JSONValue; @@ -16,6 +17,8 @@ import com.sap.sailing.domain.common.Wind; import com.sap.sailing.domain.common.WindSource; import com.sap.sailing.domain.common.WindSourceType; import com.sap.sailing.domain.common.impl.WindSourceWithAdditionalID; +import com.sap.sailing.domain.common.security.Permission; +import com.sap.sailing.domain.common.security.Permission.Mode; import com.sap.sailing.domain.tracking.DynamicTrackedRace; import com.sap.sailing.server.gateway.deserialization.JsonDeserializationException; import com.sap.sailing.server.gateway.deserialization.JsonDeserializer; @@ -32,6 +35,8 @@ public class WindResource extends AbstractSailingServerResource { @Consumes(MediaType.APPLICATION_JSON) @Path("putWind") public Response putWind(String json) throws ParseException, JsonDeserializationException { + SecurityUtils.getSubject().checkPermission(Permission.EVENT.getStringPermission(Mode.UPDATE)); + Object requestBody = JSONValue.parseWithException(json); JSONObject requestObject = Helpers.toJSONObjectSafe(requestBody); JSONArray windDatas = (JSONArray) requestObject.get("windData");