bug4811: require valid user (non-anonymous) to ask users with permission; additionally require READ for those USERs returned

java/com.sap.sse.security/resources/shiro.ini

@@ -79,4 +79,5 @@ bearerTokenOrAnonymous = com.sap.sse.security.BearerTokenOrBasicOrFormOrAnonymou
 /api/restsecurity/role/** = bearerToken
 /api/restsecurity/ownership/** = bearerTokenOrAnonymous
 /api/restsecurity/has_permission = bearerTokenOrAnonymous
-/api/restsecurity/preferences/** = bearerToken
+/api/restsecurity/preferences/** = bearerToken
+/api/restsecurity/users_with_permission = bearerToken

java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java

@@ -63,7 +63,9 @@ public class SecurityResource extends AbstractSecurityResource {
             final Iterable<User> usersWithPermission = getService().getUsersWithPermissions(wildcardPermission);
             final JSONArray usernames = new JSONArray();
             for (final User userWithPermission : usersWithPermission) {
-                usernames.add(userWithPermission.getName());
+                if (getService().hasCurrentUserReadPermission(userWithPermission)) {
+                    usernames.add(userWithPermission.getName());
+                }
             }
             logger.info("Request for users with permission took "+start.until(TimePoint.now()));
             return Response.status(Status.OK).entity(streamingOutput(usernames)).build();