From 88545d6f61432bc26a3670905ee19cd70a15aa88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kai=20B=C3=B6rnert?= Date: Mon, 29 Oct 2018 18:57:21 +0100 Subject: [PATCH] initial security check implementation for Home&Dispatch --- .../sap/sailing/domain/base/EventBase.java | 3 +- .../domain/base/impl/EventBaseImpl.java | 13 +++++ .../com/sap/sailing/domain/base/Event.java | 16 +----- .../communication/SailingDispatchContext.java | 4 ++ .../anniversary/GetAnniversariesAction.java | 3 +- .../GetCompetitionFormatRacesAction.java | 6 +- .../event/GetEventListViewAction.java | 3 +- .../event/GetEventViewAction.java | 11 ++-- .../event/GetFinishedRacesAction.java | 2 +- .../event/GetLiveRacesForEventAction.java | 4 +- .../event/GetLiveRacesForRegattaAction.java | 4 +- .../event/GetRegattaListViewAction.java | 3 +- .../event/GetRegattaStatisticsAction.java | 2 +- .../event/GetRegattaWithProgressAction.java | 5 +- ...GetRegattasAndLiveRacesForEventAction.java | 7 ++- .../event/GetSeriesStatisticsAction.java | 7 ++- .../GetMiniLeaderbordAction.java | 2 +- .../GetMiniOverallLeaderbordAction.java | 8 ++- .../news/GetEventOverviewNewsAction.java | 2 +- .../statistics/GetEventStatisticsAction.java | 2 +- .../start/GetRecentEventsAction.java | 3 +- .../start/GetStagedEventsAction.java | 3 +- .../start/GetStartViewAction.java | 3 +- .../gwt/home/server/EventActionUtil.java | 55 +++++++++++-------- .../gwt/home/server/LeaderboardContext.java | 22 +++++--- .../server/SailingDispatchContextImpl.java | 5 ++ .../sailing/gwt/server/HomeServiceUtil.java | 8 ++- .../META-INF/MANIFEST.MF | 3 +- java/com.sap.sse.gwt/META-INF/MANIFEST.MF | 3 +- .../com.sap.sailing.android.shared/.classpath | 1 + 30 files changed, 135 insertions(+), 78 deletions(-) diff --git a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/EventBase.java b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/EventBase.java index 0e80ed4b526..23d9bfc9c15 100644 --- a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/EventBase.java +++ b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/EventBase.java @@ -8,13 +8,14 @@ import com.sap.sse.common.NamedWithID; import com.sap.sse.common.Renamable; import com.sap.sse.common.TimePoint; import com.sap.sse.common.media.ImageSize; +import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; import com.sap.sse.shared.media.WithMedia; /** * Base interface for an Event consisting of all static information, which might be shared * by the server and an Android application. */ -public interface EventBase extends NamedWithID, WithDescription, Renamable, WithMedia { +public interface EventBase extends NamedWithID, WithDescription, Renamable, WithMedia, WithQualifiedObjectIdentifier { void setDescription(String description); diff --git a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java index fdf9ae5cb14..17f47214ed4 100644 --- a/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java +++ b/java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java @@ -13,6 +13,7 @@ import java.util.concurrent.ConcurrentLinkedQueue; import com.sap.sailing.domain.base.EventBase; import com.sap.sailing.domain.base.Venue; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sse.common.TimePoint; import com.sap.sse.common.Util; import com.sap.sse.common.Util.Pair; @@ -20,6 +21,8 @@ import com.sap.sse.common.media.ImageSize; import com.sap.sse.common.media.MediaTagConstants; import com.sap.sse.common.media.MimeType; import com.sap.sse.concurrent.CopyOnWriteHashMap; +import com.sap.sse.security.shared.HasPermissions; +import com.sap.sse.security.shared.QualifiedObjectIdentifier; import com.sap.sse.shared.media.ImageDescriptor; import com.sap.sse.shared.media.MediaDescriptor; import com.sap.sse.shared.media.MediaUtils; @@ -368,4 +371,14 @@ public abstract class EventBaseImpl implements EventBase { } return false; } + + @Override + public QualifiedObjectIdentifier getIdentifier() { + return getType().getQualifiedObjectIdentifier(getId().toString()); + } + + @Override + public HasPermissions getType() { + return SecuredDomainType.EVENT; + } } diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Event.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Event.java index 7f68d62257b..74aad516501 100755 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Event.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Event.java @@ -4,11 +4,7 @@ import java.util.UUID; import com.sap.sailing.domain.common.WindSource; import com.sap.sailing.domain.common.WindSourceType; -import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.leaderboard.LeaderboardGroup; -import com.sap.sse.security.shared.HasPermissions; -import com.sap.sse.security.shared.QualifiedObjectIdentifier; -import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; /** * An event is a group of {@link Regatta regattas} carried out at a common venue within a common time frame. For @@ -18,7 +14,7 @@ import com.sap.sse.security.shared.WithQualifiedObjectIdentifier; * @author Axel Uhl (D043530) * */ -public interface Event extends EventBase, WithQualifiedObjectIdentifier { +public interface Event extends EventBase { /** * For events, the ID is always a UUID. @@ -74,14 +70,4 @@ public interface Event extends EventBase, WithQualifiedObjectIdentifier { * logo / link on the event's UI representation. */ void setWindFinderReviewedSpotsCollection(Iterable reviewedSpotsCollectionIds); - - @Override - default QualifiedObjectIdentifier getIdentifier() { - return getType().getQualifiedObjectIdentifier(getId().toString()); - } - - @Override - default HasPermissions getType() { - return SecuredDomainType.EVENT; - } } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/SailingDispatchContext.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/SailingDispatchContext.java index 1c55791e0bb..bbfc7e69778 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/SailingDispatchContext.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/SailingDispatchContext.java @@ -9,6 +9,7 @@ import com.sap.sailing.news.EventNewsService; import com.sap.sailing.server.RacingEventService; import com.sap.sailing.server.statistics.TrackedRaceStatisticsCache; import com.sap.sse.gwt.dispatch.client.system.DispatchContext; +import com.sap.sse.security.SecurityService; /** * {@link DispatchContext} implementation, which is passed to backend-side {@link SailingAction} executions to provide @@ -36,6 +37,9 @@ public interface SailingDispatchContext extends DispatchContext { @GwtIncompatible Date getCurrentClientTime(); + @GwtIncompatible + SecurityService getSecurityService(); + T getPreferenceForCurrentUser(String preferenceKey); void setPreferenceForCurrentUser(String preferenceKey, Object preference); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/anniversary/GetAnniversariesAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/anniversary/GetAnniversariesAction.java index 9f5473c30ea..c1f2d75d4ac 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/anniversary/GetAnniversariesAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/anniversary/GetAnniversariesAction.java @@ -51,7 +51,8 @@ public class GetAnniversariesAction implements SailingAction(timeToLiveCalculator.getTimeToLive(), anniversaries); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetCompetitionFormatRacesAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetCompetitionFormatRacesAction.java index 479278ed257..dad6174be5a 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetCompetitionFormatRacesAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetCompetitionFormatRacesAction.java @@ -49,8 +49,12 @@ public class GetCompetitionFormatRacesAction implements @Override @GwtIncompatible public ResultWithTTL> execute(SailingDispatchContext context) throws DispatchException { + context.getSecurityService() + .checkCurrentUserReadPermission(context.getRacingEventService().getLeaderboardByName(regattaId)); + context.getSecurityService() + .checkCurrentUserReadPermission(context.getRacingEventService().getRegattaByName(regattaId)); RaceCompetitionFormatDataCalculator competitionFormatDataCalculator = new RaceCompetitionFormatDataCalculator(); - EventActionUtil.forRacesOfRegatta(context, eventId, regattaId, competitionFormatDataCalculator); + EventActionUtil.forRacesOfRegattaWithReadPermissions(context, eventId, regattaId, competitionFormatDataCalculator); Duration timeToLive = EventActionUtil.getEventStateDependentTTL(context, eventId, Duration.ONE_MINUTE); return new ResultWithTTL<>(timeToLive, new ListResult<>(competitionFormatDataCalculator.getResult())); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventListViewAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventListViewAction.java index 5654a29dc81..9167614190c 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventListViewAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventListViewAction.java @@ -19,7 +19,8 @@ public class GetEventListViewAction implements SailingAction, @GwtIncompatible public EventListViewDTO execute(SailingDispatchContext context) { EventListDataCalculator eventListDataCalculator = new EventListDataCalculator(context.getRacingEventService()); - HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(), + HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(), + context.getSecurityService(), eventListDataCalculator); return eventListDataCalculator.getResult(); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventViewAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventViewAction.java index 6cf2bd8b5c4..d0a724f229d 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventViewAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventViewAction.java @@ -61,6 +61,7 @@ public class GetEventViewAction implements SailingAction, IsClient if (event == null) { throw new RuntimeException("Event not found"); } + context.getSecurityService().checkCurrentUserReadPermission(event); final EventViewDTO dto = new EventViewDTO(); HomeServiceUtil.mapToMetadataDTO(event, dto, context.getRacingEventService()); @@ -89,16 +90,16 @@ public class GetEventViewAction implements SailingAction, IsClient final Set regattasOfEvent = new HashSet<>(); final Set relevantLeaderboardGroupsOfEvent = new HashSet<>(); - EventActionUtil.forLeaderboardsOfEvent(context, event, new LeaderboardCallback() { + EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, event, new LeaderboardCallback() { @Override - public void doForLeaderboard(LeaderboardContext context) { + public void doForLeaderboard(LeaderboardContext lcontext) { try { - Util.addAll(context.getLeaderboardGroups(), relevantLeaderboardGroupsOfEvent); - RegattaMetadataDTO regattaDTO = context.asRegattaMetadataDTO(); + Util.addAll(lcontext.getLeaderboardGroups(), relevantLeaderboardGroupsOfEvent); + RegattaMetadataDTO regattaDTO = lcontext.asRegattaMetadataDTO(); regattasOfEvent.add(regattaDTO); dto.getRegattas().add(regattaDTO); } catch (Exception e) { - logger.log(Level.SEVERE, "Catched exception while reading data for leaderboard " + context.getLeaderboardName(), e); + logger.log(Level.SEVERE, "Catched exception while reading data for leaderboard " + lcontext.getLeaderboardName(), e); } } }); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetFinishedRacesAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetFinishedRacesAction.java index 36103a132d4..5494ffaddd7 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetFinishedRacesAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetFinishedRacesAction.java @@ -50,7 +50,7 @@ public class GetFinishedRacesAction implements SailingAction> execute(SailingDispatchContext context) { RaceListDataCalculator raceListDataCalculator = new RaceListDataCalculator(); - EventActionUtil.forRacesOfRegatta(context, eventId, regattaId, raceListDataCalculator); + EventActionUtil.forRacesOfRegattaWithReadPermissions(context, eventId, regattaId, raceListDataCalculator); return new ResultWithTTL<>(EventActionUtil.getEventStateDependentTTL(context, eventId, Duration.ONE_MINUTE.times(5)), new ListResult<>(raceListDataCalculator.getResult())); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForEventAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForEventAction.java index bf97c14c2b9..510aee03011 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForEventAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForEventAction.java @@ -50,11 +50,11 @@ public class GetLiveRacesForEventAction implements SailingAction> execute(final SailingDispatchContext context) { - return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, new CalculationWithEvent>() { + return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, new CalculationWithEvent>() { @Override public ResultWithTTL> calculateWithEvent(Event event) { LiveRaceCalculator liveRaceCalculator = new LiveRaceCalculator(); - EventActionUtil.forRacesOfEvent(context, eventId, liveRaceCalculator); + EventActionUtil.forRacesOfEventWithReadPermissions(context, eventId, liveRaceCalculator); return liveRaceCalculator.getResult(); } }); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForRegattaAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForRegattaAction.java index f7735ec1d82..27d82a547b2 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForRegattaAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForRegattaAction.java @@ -53,11 +53,11 @@ public class GetLiveRacesForRegattaAction implements SailingAction> execute(final SailingDispatchContext context) { - return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, new CalculationWithEvent>() { + return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, new CalculationWithEvent>() { @Override public ResultWithTTL> calculateWithEvent(Event event) { LiveRaceCalculator liveRaceCalculator = new LiveRaceCalculator(); - EventActionUtil.forRacesOfRegatta(context, eventId, regattaName, liveRaceCalculator); + EventActionUtil.forRacesOfRegattaWithReadPermissions(context, eventId, regattaName, liveRaceCalculator); return liveRaceCalculator.getResult(); } }); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaListViewAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaListViewAction.java index 5b2ab095212..a4e2ef3687f 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaListViewAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaListViewAction.java @@ -48,8 +48,9 @@ public class GetRegattaListViewAction implements SailingAction> execute(final SailingDispatchContext context) { + context.getSecurityService().checkCurrentUserReadPermission(context.getRacingEventService().getEvent(eventId)); final List result = new LinkedList<>(); - EventActionUtil.forLeaderboardsOfEvent(context, eventId, new LeaderboardCallback() { + EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, eventId, new LeaderboardCallback() { @Override public void doForLeaderboard(LeaderboardContext leaderboardContext) { result.add(leaderboardContext.getRegattaWithProgress()); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaStatisticsAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaStatisticsAction.java index f228027b0bf..fe13c81d7c4 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaStatisticsAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaStatisticsAction.java @@ -46,7 +46,7 @@ public class GetRegattaStatisticsAction implements SailingAction execute(SailingDispatchContext context) throws DispatchException { StatisticsCalculator statisticsCalculator = new StatisticsCalculator(context.getTrackedRaceStatisticsCache()); - statisticsCalculator.doForLeaderboard(EventActionUtil.getLeaderboardContext(context, eventId, regattaId)); + statisticsCalculator.doForLeaderboard(EventActionUtil.getLeaderboardContextWithReadPermissions(context, eventId, regattaId)); return statisticsCalculator.getResult(); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaWithProgressAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaWithProgressAction.java index 53505dafe07..359f8efff5f 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaWithProgressAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaWithProgressAction.java @@ -48,8 +48,11 @@ public class GetRegattaWithProgressAction implements SailingAction execute(SailingDispatchContext context) { + context.getSecurityService().checkCurrentUserReadPermission(context.getRacingEventService().getEvent(eventId)); + context.getSecurityService() + .checkCurrentUserReadPermission(context.getRacingEventService().getRegattaByName(regattaId)); return new ResultWithTTL<>(EventActionUtil.getEventStateDependentTTL(context, eventId, Duration.ONE_MINUTE.times(5)), - EventActionUtil.getLeaderboardContext(context, eventId, regattaId).getRegattaWithProgress()); + EventActionUtil.getLeaderboardContextWithReadPermissions(context, eventId, regattaId).getRegattaWithProgress()); } @Override diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattasAndLiveRacesForEventAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattasAndLiveRacesForEventAction.java index 1218b9c0567..0fa3f57d1af 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattasAndLiveRacesForEventAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattasAndLiveRacesForEventAction.java @@ -52,12 +52,13 @@ public class GetRegattasAndLiveRacesForEventAction implements SailingAction execute(SailingDispatchContext context) { + context.getSecurityService().checkCurrentUserReadPermission(context.getRacingEventService().getEvent(eventId)); final Map regattas = mapRegattas(context); final TreeMap> regattasWithRaces = new TreeMap<>(); final TreeSet regattasWithoutRaces = new TreeSet<>(); final RaceRefreshCalculator refreshCalculator = new RaceRefreshCalculator(); - EventActionUtil.forRacesOfEvent(context, eventId, raceContent -> { + EventActionUtil.forRacesOfEventWithReadPermissions(context, eventId, raceContent -> { Optional liveRace = Optional.ofNullable(raceContent.getLiveRaceOrNull()); liveRace.ifPresent(r -> ensureRegatta(raceContent, regattas, regattasWithRaces).add(r)); refreshCalculator.doForRace(raceContent); @@ -66,13 +67,13 @@ public class GetRegattasAndLiveRacesForEventAction implements SailingAction result = new ResultWithTTL<>(refreshCalculator.getTTL(), dto); - return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, event -> result, dto); + return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, event -> result, dto); } @GwtIncompatible private Map mapRegattas(SailingDispatchContext context) { final Map result = new HashMap<>(); - EventActionUtil.forLeaderboardsOfEvent(context, eventId, new LeaderboardCallback() { + EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, eventId, new LeaderboardCallback() { @Override public void doForLeaderboard(LeaderboardContext context) { result.put(context.getLeaderboardName(), context.asRegattaMetadataDTO()); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetSeriesStatisticsAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetSeriesStatisticsAction.java index 20a03dc46c0..ed1be2447a1 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetSeriesStatisticsAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetSeriesStatisticsAction.java @@ -45,7 +45,12 @@ public class GetSeriesStatisticsAction implements SailingAction execute(SailingDispatchContext context) throws DispatchException { StatisticsCalculator statisticsCalculator = new StatisticsCalculator(context.getTrackedRaceStatisticsCache()); final LeaderboardGroup leaderboardGroupByID = context.getRacingEventService().getLeaderboardGroupByID(seriesLeaderboardGroupId); - leaderboardGroupByID.getLeaderboards().forEach(statisticsCalculator::addLeaderboard); + context.getSecurityService().checkCurrentUserReadPermission(leaderboardGroupByID); + leaderboardGroupByID.getLeaderboards().forEach(t -> { + if (context.getSecurityService().hasCurrentUserReadPermission(t)) { + statisticsCalculator.addLeaderboard(t); + } + }); return statisticsCalculator.getResult(); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniLeaderbordAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniLeaderbordAction.java index 65a27860e0b..101baa9ffe8 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniLeaderbordAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniLeaderbordAction.java @@ -64,7 +64,7 @@ public class GetMiniLeaderbordAction implements SailingAction execute(SailingDispatchContext context) { - return EventActionUtil.getLeaderboardContext(context, eventId, leaderboardName).calculateMiniLeaderboard(context.getRacingEventService(), limit); + return EventActionUtil.getLeaderboardContextWithReadPermissions(context, eventId, leaderboardName).calculateMiniLeaderboard(context.getRacingEventService(), limit); } @Override diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniOverallLeaderbordAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniOverallLeaderbordAction.java index f30f129691d..a7659dcd17d 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniOverallLeaderbordAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniOverallLeaderbordAction.java @@ -4,6 +4,7 @@ import java.util.UUID; import com.google.gwt.core.shared.GwtIncompatible; import com.sap.sailing.domain.base.Event; +import com.sap.sailing.domain.leaderboard.Leaderboard; import com.sap.sailing.domain.leaderboard.LeaderboardGroup; import com.sap.sailing.gwt.common.communication.routing.ProvidesLeaderboardRouting; import com.sap.sailing.gwt.home.communication.SailingAction; @@ -63,11 +64,16 @@ public class GetMiniOverallLeaderbordAction implements SailingAction execute(SailingDispatchContext context) { LeaderboardGroup leaderboardGroup = context.getRacingEventService().getLeaderboardGroupByID(leaderboardGroupUUID); + context.getSecurityService().checkCurrentUserReadPermission(leaderboardGroup); if(leaderboardGroup == null) { throw new RuntimeException("Invalid leaderboardGroupID"); } Event event = HomeServiceUtil.determineBestMatchingEvent(context.getRacingEventService(), leaderboardGroup); - LeaderboardContext lctx = new LeaderboardContext(context, event, event.getLeaderboardGroups(), leaderboardGroup.getOverallLeaderboard()); + context.getSecurityService().checkCurrentUserReadPermission(event); + Leaderboard overallLeaderBoard = leaderboardGroup.getOverallLeaderboard(); + context.getSecurityService().checkCurrentUserReadPermission(overallLeaderBoard); + LeaderboardContext lctx = new LeaderboardContext(context, event, event.getLeaderboardGroups(), + overallLeaderBoard); return lctx.calculateMiniLeaderboard(context.getRacingEventService(), limit); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/news/GetEventOverviewNewsAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/news/GetEventOverviewNewsAction.java index c1a02e2ac47..b859c1f97b9 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/news/GetEventOverviewNewsAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/news/GetEventOverviewNewsAction.java @@ -73,7 +73,7 @@ public class GetEventOverviewNewsAction implements SailingAction> execute(final SailingDispatchContext context) { - return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, new CalculationWithEvent>() { + return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, new CalculationWithEvent>() { @Override public ResultWithTTL> calculateWithEvent(Event event) { return new ResultWithTTL<>(Duration.ONE_MINUTE.times(2), new ListResult(getNews(context, event))); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/statistics/GetEventStatisticsAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/statistics/GetEventStatisticsAction.java index 3320936b176..b764b2a5bc2 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/statistics/GetEventStatisticsAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/statistics/GetEventStatisticsAction.java @@ -42,7 +42,7 @@ public class GetEventStatisticsAction implements SailingAction execute(SailingDispatchContext context) throws DispatchException { StatisticsCalculator statisticsCalculator = new StatisticsCalculator(context.getTrackedRaceStatisticsCache()); - EventActionUtil.forLeaderboardsOfEvent(context, eventId, statisticsCalculator); + EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, eventId, statisticsCalculator); return statisticsCalculator.getResult(); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetRecentEventsAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetRecentEventsAction.java index 64cd78cb6d0..fc003c2ad05 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetRecentEventsAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetRecentEventsAction.java @@ -41,7 +41,8 @@ public class GetRecentEventsAction implements SailingAction execute(final SailingDispatchContext context) throws DispatchException { final SortedSet events = new TreeSet<>(); - HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(), new EventVisitor() { + HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(), + context.getSecurityService(), new EventVisitor() { @Override public void visit(EventBase event, boolean onRemoteServer, URL baseURL) { EventQuickfinderDTO dto = new EventQuickfinderDTO(); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStagedEventsAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStagedEventsAction.java index eca984f7a22..b9621a27fcf 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStagedEventsAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStagedEventsAction.java @@ -36,7 +36,8 @@ public class GetStagedEventsAction implements SailingAction execute(final SailingDispatchContext context) throws DispatchException { EventStageCandidateCalculator stageCandidateCalculator = new EventStageCandidateCalculator(); - HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(), + HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(), + context.getSecurityService(), stageCandidateCalculator); ListResult result = new ListResult<>(); int count = 0; diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStartViewAction.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStartViewAction.java index 708ba2ded62..0edac530a74 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStartViewAction.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStartViewAction.java @@ -47,7 +47,8 @@ public class GetStartViewAction implements SailingAction, IsClient public StartViewDTO execute(SailingDispatchContext context) { EventStageCandidateCalculator stageCandidateCalculator = new EventStageCandidateCalculator(); RecentEventsCalculator recentEventsCalculator = new RecentEventsCalculator(); - HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(), stageCandidateCalculator, recentEventsCalculator); + HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(), + context.getSecurityService(), stageCandidateCalculator, recentEventsCalculator); StartViewDTO result = new StartViewDTO(); int count = 0; for (Pair pair : stageCandidateCalculator.getFeaturedEvents()) { diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/EventActionUtil.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/EventActionUtil.java index 37624580812..b2acb3d1344 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/EventActionUtil.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/EventActionUtil.java @@ -65,17 +65,23 @@ public final class EventActionUtil { return new LeaderboardContext(context, event, event.getLeaderboardGroups(), overallLeaderboard); } - public static LeaderboardContext getLeaderboardContext(SailingDispatchContext context, UUID eventId, String leaderboardId) { + public static LeaderboardContext getLeaderboardContextWithReadPermissions(SailingDispatchContext context, UUID eventId, String leaderboardId) { RacingEventService service = context.getRacingEventService(); Event event = service.getEvent(eventId); + context.getSecurityService().checkCurrentUserReadPermission(event); final LinkedHashSet leaderboardGroups = new LinkedHashSet<>(); Leaderboard leaderboard = null; for (LeaderboardGroup leaderboardGroup : event.getLeaderboardGroups()) { - for (Leaderboard l : leaderboardGroup.getLeaderboards()) { - if (l.getName().equals(leaderboardId)) { - leaderboardGroups.add(leaderboardGroup); - leaderboard = l; + if (context.getSecurityService().hasCurrentUserReadPermission(leaderboardGroup)) { + for (Leaderboard l : leaderboardGroup.getLeaderboards()) { + if (context.getSecurityService().hasCurrentUserReadPermission(l)) { + if (l.getName().equals(leaderboardId)) { + leaderboardGroups.add(leaderboardGroup); + leaderboard = l; + } + } } + } } if (leaderboardGroups.isEmpty()) { @@ -110,14 +116,15 @@ public final class EventActionUtil { return calculateTtlForNonLiveEvent(event, eventState); } - public static ResultWithTTL withLiveRaceOrDefaultSchedule(SailingDispatchContext context, + public static ResultWithTTL withLiveRaceOrDefaultScheduleWithReadPermissions(SailingDispatchContext context, UUID eventId, CalculationWithEvent callback) { - return withLiveRaceOrDefaultSchedule(context, eventId, callback, null); + return withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, callback, null); } - public static ResultWithTTL withLiveRaceOrDefaultSchedule(SailingDispatchContext context, + public static ResultWithTTL withLiveRaceOrDefaultScheduleWithReadPermissions(SailingDispatchContext context, UUID eventId, CalculationWithEvent callback, T defaultResult) { Event event = context.getRacingEventService().getEvent(eventId); + context.getSecurityService().checkCurrentUserReadPermission(event); EventState eventState = HomeServiceUtil.calculateEventState(event); if (eventState == EventState.FINISHED) { return new ResultWithTTL(calculateTtlForNonLiveEvent(event, eventState), defaultResult); @@ -167,25 +174,29 @@ public final class EventActionUtil { return Duration.NULL; } - public static void forLeaderboardsOfEvent(SailingDispatchContext context, UUID eventId, LeaderboardCallback callback) { + public static void forLeaderboardsOfEventWithReadPermissions(SailingDispatchContext context, UUID eventId, LeaderboardCallback callback) { RacingEventService service = context.getRacingEventService(); Event event = service.getEvent(eventId); if (event == null) { throw new RuntimeException("Event not found"); } - forLeaderboardsOfEvent(context, event, callback); + forLeaderboardsOfEventWithReadPermissions(context, event, callback); } - public static void forLeaderboardsOfEvent(SailingDispatchContext context, Event event, LeaderboardCallback callback) { + public static void forLeaderboardsOfEventWithReadPermissions(SailingDispatchContext context, Event event, LeaderboardCallback callback) { final Map> leaderboardGroupsForLeaderboard = new HashMap<>(); for (LeaderboardGroup leaderboardGroup : event.getLeaderboardGroups()) { - for (Leaderboard leaderboard : leaderboardGroup.getLeaderboards()) { - LinkedHashSet set = leaderboardGroupsForLeaderboard.get(leaderboard); - if (set == null) { - set = new LinkedHashSet<>(); - leaderboardGroupsForLeaderboard.put(leaderboard, set); + if (context.getSecurityService().hasCurrentUserReadPermission(leaderboardGroup)) { + for (Leaderboard leaderboard : leaderboardGroup.getLeaderboards()) { + if (context.getSecurityService().hasCurrentUserReadPermission(leaderboard)) { + LinkedHashSet set = leaderboardGroupsForLeaderboard.get(leaderboard); + if (set == null) { + set = new LinkedHashSet<>(); + leaderboardGroupsForLeaderboard.put(leaderboard, set); + } + set.add(leaderboardGroup); + } } - set.add(leaderboardGroup); } } for (Entry> e : leaderboardGroupsForLeaderboard.entrySet()) { @@ -203,16 +214,16 @@ public final class EventActionUtil { } } - public static void forRacesOfEvent(final SailingDispatchContext context, UUID eventId, final RaceCallback callback) { - forLeaderboardsOfEvent(context, eventId, new LeaderboardCallback() { + public static void forRacesOfEventWithReadPermissions(final SailingDispatchContext context, UUID eventId, final RaceCallback callback) { + forLeaderboardsOfEventWithReadPermissions(context, eventId, new LeaderboardCallback() { @Override public void doForLeaderboard(LeaderboardContext leaderboardContext) { - leaderboardContext.forRaces(callback); + leaderboardContext.forRacesWithReadPermissions(callback); } }); } - public static void forRacesOfRegatta(SailingDispatchContext context, UUID eventId, String regattaName, RaceCallback callback) { - getLeaderboardContext(context, eventId, regattaName).forRaces(callback); + public static void forRacesOfRegattaWithReadPermissions(SailingDispatchContext context, UUID eventId, String regattaName, RaceCallback callback) { + getLeaderboardContextWithReadPermissions(context, eventId, regattaName).forRacesWithReadPermissions(callback); } } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/LeaderboardContext.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/LeaderboardContext.java index 6a37680f76c..8516a95c80e 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/LeaderboardContext.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/LeaderboardContext.java @@ -23,6 +23,7 @@ import com.sap.sailing.domain.leaderboard.FlexibleLeaderboard; import com.sap.sailing.domain.leaderboard.Leaderboard; import com.sap.sailing.domain.leaderboard.LeaderboardGroup; import com.sap.sailing.domain.leaderboard.RegattaLeaderboard; +import com.sap.sailing.domain.tracking.TrackedRace; import com.sap.sailing.gwt.home.communication.SailingDispatchContext; import com.sap.sailing.gwt.home.communication.event.EventSeriesReferenceDTO; import com.sap.sailing.gwt.home.communication.event.EventState; @@ -44,6 +45,7 @@ import com.sap.sse.common.impl.MillisecondsTimePoint; import com.sap.sse.gwt.dispatch.shared.commands.DTO; import com.sap.sse.gwt.dispatch.shared.commands.ResultWithTTL; import com.sap.sse.gwt.dispatch.shared.exceptions.DispatchException; +import com.sap.sse.security.SecurityService; /** * This class aggregates {@link Leaderboard} information by preparing {@link DTO}s for different components representing @@ -57,20 +59,26 @@ public class LeaderboardContext { private final Iterable leaderboardGroups; private final Leaderboard leaderboard; private final RacingEventService service; + private SecurityService securityService; private Boolean hasMultipleFleets = null; + public LeaderboardContext(SailingDispatchContext dispatchContext, Event event, Iterable leaderboardGroup, Leaderboard leaderboard) { this.service = dispatchContext.getRacingEventService(); + this.securityService = dispatchContext.getSecurityService(); this.event = event; this.leaderboardGroups = leaderboardGroup; this.leaderboard = leaderboard; } - public void forRaces(RaceCallback callback) { + public void forRacesWithReadPermissions(RaceCallback callback) { for (RaceColumn raceColumn : leaderboard.getRaceColumns()) { if (!raceColumn.isCarryForward()) { for (Fleet fleet : raceColumn.getFleets()) { - callback.doForRace(new RaceContext(service, event, this, raceColumn, fleet, service)); + TrackedRace tRaceOrNull = raceColumn.getTrackedRace(fleet); + if (tRaceOrNull == null || securityService.hasCurrentUserReadPermission(tRaceOrNull)) { + callback.doForRace(new RaceContext(service, event, this, raceColumn, fleet, service)); + } } } } @@ -78,7 +86,7 @@ public class LeaderboardContext { public RegattaWithProgressDTO getRegattaWithProgress() { RegattaProgressCalculator regattaProgressCalculator = new RegattaProgressCalculator(); - forRaces(regattaProgressCalculator); + forRacesWithReadPermissions(regattaProgressCalculator); RegattaWithProgressDTO regattaDTO = new RegattaWithProgressDTO(regattaProgressCalculator.getResult()); fillRegattaFields(regattaDTO); return regattaDTO; @@ -86,8 +94,6 @@ public class LeaderboardContext { public ResultWithTTL calculateMiniLeaderboard(RacingEventService service, int limit) { GetMiniLeaderboardDTO result = new GetMiniLeaderboardDTO(); - if (leaderboard == null) { - } try { LeaderboardDTO leaderboardDTO = leaderboard.getLeaderboardDTO(null, Collections. emptyList(), true, service, service.getBaseDomainFactory(), false); @@ -122,7 +128,7 @@ public class LeaderboardContext { private boolean hasLiveRace() { OverallRacesStateCalculator racesStateCalculator = new OverallRacesStateCalculator(); - forRaces(racesStateCalculator); + forRacesWithReadPermissions(racesStateCalculator); return racesStateCalculator.hasLiveRace(); } @@ -149,7 +155,7 @@ public class LeaderboardContext { // Using the race states to calculate the real state for running events/regattas OverallRacesStateCalculator racesStateCalculator = new OverallRacesStateCalculator(); - forRaces(racesStateCalculator); + forRacesWithReadPermissions(racesStateCalculator); if(racesStateCalculator.hasLiveRace()) { return RegattaState.RUNNING; } @@ -268,7 +274,7 @@ public class LeaderboardContext { regattaDTO.setFlexibleLeaderboard(leaderboard instanceof FlexibleLeaderboard); RegattaRaceDataInfoCalculator regattaRaceDataInfoCalculator = new RegattaRaceDataInfoCalculator(); - forRaces(regattaRaceDataInfoCalculator); + forRacesWithReadPermissions(regattaRaceDataInfoCalculator); regattaDTO.setRaceDataInfo(regattaRaceDataInfoCalculator.getRaceDataInfo()); regattaDTO.setBuoyZoneRadius(getRegattaBuoyZoneRadius()); } diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/SailingDispatchContextImpl.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/SailingDispatchContextImpl.java index f4babfb52bc..ba78057ed03 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/SailingDispatchContextImpl.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/SailingDispatchContextImpl.java @@ -87,6 +87,11 @@ public class SailingDispatchContextImpl implements SailingDispatchContext { return request; } + @Override + public SecurityService getSecurityService() { + return securityService; + } + @Override public URL getRequestBaseURL() throws DispatchException { return HomeServiceUtil.getRequestBaseURL(request); diff --git a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/server/HomeServiceUtil.java b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/server/HomeServiceUtil.java index b0fab03a670..fd374101de2 100644 --- a/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/server/HomeServiceUtil.java +++ b/java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/server/HomeServiceUtil.java @@ -52,6 +52,7 @@ import com.sap.sse.gwt.client.media.ImageDTO; import com.sap.sse.gwt.client.media.VideoDTO; import com.sap.sse.gwt.dispatch.shared.exceptions.DispatchException; import com.sap.sse.gwt.dispatch.shared.exceptions.ServerDispatchException; +import com.sap.sse.security.SecurityService; import com.sap.sse.shared.media.ImageDescriptor; import com.sap.sse.shared.media.MediaDescriptor; import com.sap.sse.shared.media.VideoDescriptor; @@ -454,11 +455,12 @@ public final class HomeServiceUtil { return courseArea == null ? null : courseArea.getId().toString(); } - public static void forAllPublicEvents(RacingEventService service, HttpServletRequest request, + public static void forAllPublicEventsWithReadPermission(RacingEventService service, HttpServletRequest request, + SecurityService securityService, EventVisitor... visitors) throws DispatchException { URL requestedBaseURL = getRequestBaseURL(request); for (Event event : service.getAllEvents()) { - if(event.isPublic()) { + if (event.isPublic() && securityService.hasCurrentUserReadPermission(event)) { for(EventVisitor visitor : visitors) { visitor.visit(event, false, requestedBaseURL); } @@ -472,7 +474,7 @@ public final class HomeServiceUtil { URL baseURL = getBaseURL(serverRef.getURL()); if (remoteEvents != null) { for (EventBase remoteEvent : remoteEvents) { - if(remoteEvent.isPublic()) { + if (remoteEvent.isPublic() && securityService.hasCurrentUserReadPermission(remoteEvent)) { for(EventVisitor visitor : visitors) { visitor.visit(remoteEvent, true, baseURL); } diff --git a/java/com.sap.sailing.server.testsupport/META-INF/MANIFEST.MF b/java/com.sap.sailing.server.testsupport/META-INF/MANIFEST.MF index 52f6bc63145..b50ee5f75a7 100644 --- a/java/com.sap.sailing.server.testsupport/META-INF/MANIFEST.MF +++ b/java/com.sap.sailing.server.testsupport/META-INF/MANIFEST.MF @@ -34,5 +34,6 @@ Require-Bundle: com.sap.sailing.server, com.sap.sse.security, org.apache.shiro.web;bundle-version="1.2.2", org.apache.shiro.core;bundle-version="1.2.2", - javax.servlet;bundle-version="3.1.0" + javax.servlet;bundle-version="3.1.0", + com.sap.sse.security.common Automatic-Module-Name: com.sap.sailing.server.testsupport diff --git a/java/com.sap.sse.gwt/META-INF/MANIFEST.MF b/java/com.sap.sse.gwt/META-INF/MANIFEST.MF index 38cf03ddfe8..f6edd8bc179 100644 --- a/java/com.sap.sse.gwt/META-INF/MANIFEST.MF +++ b/java/com.sap.sse.gwt/META-INF/MANIFEST.MF @@ -12,7 +12,8 @@ Require-Bundle: com.google.gwt.user;bundle-version="2.8.2";resolution:=optional, com.sap.sse.common, com.sap.sse.filestorage Bundle-ActivationPolicy: lazy -Import-Package: javax.servlet;version="3.1.0", +Import-Package: com.sap.sse.security, + javax.servlet;version="3.1.0", javax.servlet.descriptor;version="3.1.0", javax.servlet.http;version="3.1.0", org.apache.commons.io, diff --git a/mobile/com.sap.sailing.android.shared/.classpath b/mobile/com.sap.sailing.android.shared/.classpath index e1ea8ed81dc..a6dd4c3bc9c 100755 --- a/mobile/com.sap.sailing.android.shared/.classpath +++ b/mobile/com.sap.sailing.android.shared/.classpath @@ -13,5 +13,6 @@ +