eclipse-sailing-analytics/sailing-analytics
1
0 Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-11-07 19:42:17 +00:00
Code Activity

Bug 5080: added meta permission check if the current user has all roles

Browse Source 
implicated by a user group before allowing him to add a user (possibly
himself) to a user group
This commit is contained in:
Steffen Jacobs authored and Steffen Schaefer committed 2019-06-27 14:19:08 +02:00
1 parent 02b59ca833
commit aa56707ba6
1 file changed
+7 -2
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/UserGroupResource.java
+7 -2
View File
@@ -198,8 +198,13 @@ public class UserGroupResource extends AbstractSecurityResource {
.build();
} else {
if (getService().hasCurrentUserUpdatePermission(usergroup)) {
getService().addUserToUserGroup(usergroup, user);
response = Response.ok().build();
if (!getService().hasCurrentUserMetaPermissionsOfRoleDefinitionsWithQualification(
usergroup.getRoleDefinitionMap().keySet(), new Ownership(null, usergroup))) {
response = Response.status(Status.UNAUTHORIZED).build();
} else {
getService().addUserToUserGroup(usergroup, user);
response = Response.ok().build();
}
} else {
response = Response.status(Status.UNAUTHORIZED).build();
}