eclipse-sailing-analytics/sailing-analytics
1
0 Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-11-09 12:31:00 +00:00
Code Activity

Bug 4894: added permission check for trackedrace update in

Browse Source 
AbstractWindImporter
This commit is contained in:
Steffen Jacobs committed 2019-03-08 15:59:39 +01:00
1 parent e8165fa359
commit aa02ce9bc4
1 file changed
+9 -1
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/windimport/AbstractWindImporter.java
+9 -1
View File
@@ -9,6 +9,7 @@ import java.util.List;
import java.util.Map;
import org.apache.commons.fileupload.FileItem;
import org.apache.shiro.SecurityUtils;
import org.json.simple.JSONArray;
import org.json.simple.JSONObject;
@@ -22,6 +23,7 @@ import com.sap.sailing.domain.tracking.DynamicTrackedRace;
import com.sap.sailing.server.gateway.windimport.AbstractWindImporter.WindImportResult.RaceEntry;
import com.sap.sailing.server.interfaces.RacingEventService;
import com.sap.sse.common.Util;
import com.sap.sse.security.shared.HasPermissions.DefaultActions;
public abstract class AbstractWindImporter {
public static class UploadRequest {
@@ -138,6 +140,8 @@ public abstract class AbstractWindImporter {
if (uploadRequest.races.size() > 0) {
for (RegattaAndRaceIdentifier raceEntry : uploadRequest.races) {
DynamicTrackedRace trackedRace = service.getTrackedRace(raceEntry);
SecurityUtils.getSubject()
.checkPermission(trackedRace.getIdentifier().getStringPermission(DefaultActions.UPDATE));
if (trackedRace != null) {
trackedRaces.add(trackedRace);
}
@@ -145,7 +149,11 @@ public abstract class AbstractWindImporter {
} else {
for (Regatta regatta : service.getAllRegattas()) {
for (RaceDefinition raceDefinition : regatta.getAllRaces()) {
trackedRaces.add(service.getTrackedRegatta(regatta).getTrackedRace(raceDefinition));
final DynamicTrackedRace trackedRace = service.getTrackedRegatta(regatta).getTrackedRace(raceDefinition);
if (SecurityUtils.getSubject()
.isPermitted(trackedRace.getIdentifier().getStringPermission(DefaultActions.UPDATE))) {
trackedRaces.add(trackedRace);
}
}
}
}