eclipse-sailing-analytics/sailing-analytics
1
0 Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-11-05 18:42:55 +00:00
Code Activity

added more checks and secret exceptions based on QRScanRequest document

Browse Source 
from dlabs
This commit is contained in:
Kai Börnert committed 2019-03-07 10:46:56 +01:00
1 parent 9aa7cdf798
commit c23d7afca2
7 files changed
+29 -26
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

java/com.sap.sailing.server.gateway.test/src/com/sap/sailing/server/gateway/test/jaxrs/BoatResourceTest.java
+1 -1
View File
@@ -28,7 +28,7 @@ public class BoatResourceTest extends AbstractJaxRsApiTest {
@Test
public void testGetBoatAsJson() throws Exception {
String jsonString = boatsResource.getBoat(id).getEntity().toString();
String jsonString = boatsResource.getBoat(id, null, null).getEntity().toString();
BoatJsonDeserializer boatJsonDeserializer = BoatJsonDeserializer.create(racingEventService.getBaseDomainFactory());
JSONObject jsonObject = Helpers.toJSONObjectSafe(JSONValue.parse(jsonString));
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/AbstractSailingServerResource.java
+5 -1
View File
@@ -2,6 +2,7 @@ package com.sap.sailing.server.gateway.jaxrs;
import java.math.BigDecimal;
import java.math.RoundingMode;
import java.util.logging.Logger;
import javax.servlet.ServletContext;
import javax.ws.rs.core.Context;
@@ -24,6 +25,7 @@ import com.sap.sse.util.DateParser;
import com.sun.jersey.api.core.ResourceContext;
public abstract class AbstractSailingServerResource {
private static final Logger logger = Logger.getLogger(AbstractSailingServerResource.class.getName());
private static final String SLASH_ENCODING = "__";
@Context ServletContext servletContext;
@Context ResourceContext resourceContext;
@@ -117,7 +119,9 @@ public abstract class AbstractSailingServerResource {
*/
protected boolean skipChecksDueToCorrectSecret(String leaderboardName, String secret) {
Regatta regatta = getService().getRegattaByName(leaderboardName);
if(regatta == null) {
if (regatta == null && secret != null) {
logger.warning("Attempt to skip security checks using regatta secret \"" + secret + "\" for leaderboard \""
+ leaderboardName + "\", but a regatta with the same name could not be resolved");
return false;
}
return Util.equalStringsWithEmptyIsNull(regatta.getRegistrationLinkSecret(), secret);
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/BoatsResource.java
+7 -1
View File
@@ -4,6 +4,7 @@ import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.Response.Status;
@@ -20,7 +21,8 @@ public class BoatsResource extends AbstractSailingServerResource {
@GET
@Produces("application/json;charset=UTF-8")
@Path("{boatId}")
public Response getBoat(@PathParam("boatId") String boatIdAsString) {
public Response getBoat(@PathParam("boatId") String boatIdAsString, @PathParam("secret") String regattaSecret,
@QueryParam("leaderboardname") String leaderboardName) {
Response response;
Boat boat = getService().getCompetitorAndBoatStore().getExistingBoatByIdAsString(boatIdAsString);
if (boat == null) {
@@ -28,6 +30,10 @@ public class BoatsResource extends AbstractSailingServerResource {
.entity("Could not find a boat with id '" + StringEscapeUtils.escapeHtml(boatIdAsString) + "'.")
.type(MediaType.TEXT_PLAIN).build();
} else {
boolean skip = skipChecksDueToCorrectSecret(leaderboardName, regattaSecret);
if (!skip) {
getSecurityService().checkCurrentUserReadPermission(boat);
}
BoatJsonSerializer boatJsonSerializer = BoatJsonSerializer.create();
String jsonString = boatJsonSerializer.serialize(boat).toJSONString();
response = Response.ok(jsonString).header("Content-Type", MediaType.APPLICATION_JSON + ";charset=UTF-8").build();
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/CompetitorsResource.java
+4 -2
View File
@@ -76,8 +76,6 @@ public class CompetitorsResource extends AbstractSailingServerResource {
@Path("{competitorId}")
public Response getCompetitor(@PathParam("competitorId") String competitorIdAsString,
@QueryParam("secret") String secret, @QueryParam("leaderboardname") String leaderboardName) {
boolean skip = skipChecksDueToCorrectSecret(leaderboardName, secret);
Response response;
Competitor competitor = getService().getCompetitorAndBoatStore().getExistingCompetitorByIdAsString(
competitorIdAsString);
@@ -86,6 +84,10 @@ public class CompetitorsResource extends AbstractSailingServerResource {
.entity("Could not find a competitor with id '" + StringEscapeUtils.escapeHtml(competitorIdAsString) + "'.")
.type(MediaType.TEXT_PLAIN).build();
} else {
boolean skip = skipChecksDueToCorrectSecret(leaderboardName, secret);
if (!skip) {
getSecurityService().checkCurrentUserReadPermission(competitor);
}
String jsonString = getCompetitorJSON(competitor).toJSONString();
response = Response.ok(jsonString).header("Content-Type", MediaType.APPLICATION_JSON + ";charset=UTF-8").build();
}
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResource.java
+1 -17
View File
@@ -299,25 +299,9 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
Long fromMillis = (Long) requestObject.get(DeviceMappingConstants.JSON_FROM_MILLIS);
boolean allowedViaPermission = getSecurityService().hasCurrentUserUpdatePermission(leaderboard);
boolean allowedViaSecret = false;
boolean allowedViaSecret = skipChecksDueToCorrectSecret(leaderboardName, regattaSecret);
HasRegattaLike hasRegattaLike = (HasRegattaLike) leaderboard;
Regatta correspondingRegatta = getService().getRegattaByName(leaderboard.getName());
if (regattaSecret != null && !regattaSecret.isEmpty()) {
if (correspondingRegatta == null) {
logger.warning(() -> "Attempt to checkin using regatta secret \"" + regattaSecret
+ "\" for leaderboard \"" + leaderboard.getName() + "\", but there is no associated regatta.");
} else {
final String secretOfRegatta = correspondingRegatta.getRegistrationLinkSecret();
if (secretOfRegatta == null) {
logger.warning(
() -> "Attempt to checkin using regatta secret \"" + regattaSecret + "\" for regatta \""
+ correspondingRegatta.getName() + "\", but there is no secret configured.");
} else {
allowedViaSecret = secretOfRegatta.equals(regattaSecret);
}
}
}
DomainFactory domainFactory = getService().getDomainObjectFactory().getBaseDomainFactory();
AbstractLogEventAuthor author = new LogEventAuthorImpl(AbstractLogEventAuthor.NAME_COMPATIBILITY,
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResourceV2.java
+6 -2
View File
@@ -82,7 +82,8 @@ public class LeaderboardsResourceV2 extends AbstractLeaderboardsResource {
@QueryParam("columnNames") final List<String> raceColumnNames,
@QueryParam("raceDetails") final List<String> raceDetails,
@QueryParam("time") String time, @QueryParam("timeasmillis") Long timeasmillis,
@QueryParam("maxCompetitorsCount") Integer maxCompetitorsCount) {
@QueryParam("maxCompetitorsCount") Integer maxCompetitorsCount,
@QueryParam("secret") String regattaSecret) {
ShardingContext.setShardingConstraint(ShardingType.LEADERBOARDNAME, leaderboardName);
try {
@@ -94,7 +95,10 @@ public class LeaderboardsResourceV2 extends AbstractLeaderboardsResource {
.type(MediaType.TEXT_PLAIN).build();
} else {
try {
getSecurityService().checkCurrentUserReadPermission(leaderboard);
boolean skip = skipChecksDueToCorrectSecret(leaderboardName, regattaSecret);
if (!skip) {
getSecurityService().checkCurrentUserReadPermission(leaderboard);
}
TimePoint timePoint;
try {
timePoint = parseTimePoint(time, timeasmillis, calculateTimePointForResultState(leaderboard, resultState));
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java
+5 -2
View File
@@ -1524,7 +1524,7 @@ public class RegattasResource extends AbstractSailingServerResource {
@GET
@Produces("application/json;charset=UTF-8")
@Path("{regattaname}/races")
public Response getRaces(@PathParam("regattaname") String regattaName) {
public Response getRaces(@PathParam("regattaname") String regattaName, @PathParam("secret") String regattaSecret) {
Response response;
Regatta regatta = findRegattaByName(regattaName);
if (regatta == null) {
@@ -1532,7 +1532,10 @@ public class RegattasResource extends AbstractSailingServerResource {
.entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN)
.build();
} else {
getSecurityService().checkCurrentUserReadPermission(regatta);
boolean skip = skipChecksDueToCorrectSecret(regattaName, regattaSecret);
if (!skip) {
getSecurityService().checkCurrentUserReadPermission(regatta);
}
JSONObject jsonRaceResults = new JSONObject();
jsonRaceResults.put("regatta", regatta.getName());
JSONArray jsonRaces = new JSONArray();