From 647f001ea14fe76324071f5941ff5802fc624c22 Mon Sep 17 00:00:00 2001 From: Steffen Jacobs Date: Wed, 26 Jun 2019 17:30:07 +0200 Subject: [PATCH] Bug 5080: added meta permission check when adding a user to a user group to UserManagementServiceImpl --- .../sse/security/ui/server/UserManagementServiceImpl.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java index d0e73b848a4..bac9132c002 100644 --- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java +++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java @@ -391,7 +391,13 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U if (userByName == null) { throw new UserManagementException("user '" + username + "' not found."); } - getSecurityService().addUserToUserGroup(tenant, userByName); + if (getSecurityService().hasCurrentUserMetaPermissionsOfRoleDefinitionsWithQualification( + tenant.getRoleDefinitionMap().keySet(), new Ownership(null, tenant))) { + getSecurityService().addUserToUserGroup(tenant, userByName); + } else { + throw new UnauthorizedException( + "Current user does not have all the meta permissions of the user group the user would be added to"); + } } else { throw new UnauthorizedException("Not permitted to add user to group"); }