eclipse-sailing-analytics/sailing-analytics
1
0
Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-09-27 07:56:38 +00:00
Code Activity

bug5051: added security checks for competitor and boat creation for competitor import

Browse Source 
Change-Id: I070e9c5a2cb5545c93c01ee31abbbb8f0584ee74
This commit is contained in:
Axel Uhl
2019-05-23 13:08:44 +02:00
parent 7fe97a2a59
commit d4cc0cd72c
1 changed files with 31 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java
+31 -24
View File
@@ -5945,18 +5945,13 @@ public class SailingServiceImpl extends ResultCachingProxiedRemoteServiceServlet
final DynamicBoat boat = (DynamicBoat) addOrUpdateBoatInternal(competitor.getBoat());
result = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError(
SecuredDomainType.COMPETITOR, CompetitorImpl.getTypeRelativeObjectIdentifier(competitorUUID),
competitor.getName(), new Callable<CompetitorWithBoat>() {
@Override
public CompetitorWithBoat call() throws Exception {
return getBaseDomainFactory().getCompetitorAndBoatStore().getOrCreateCompetitorWithBoat(
competitor.getName(), ()->getBaseDomainFactory().getCompetitorAndBoatStore().getOrCreateCompetitorWithBoat(
competitorUUID, competitor.getName(), competitor.getShortName(),
competitor.getColor(), competitor.getEmail(),
competitor.getFlagImageURL() == null ? null : new URI(competitor.getFlagImageURL()),
team, competitor.getTimeOnTimeFactor(),
competitor.getTimeOnDistanceAllowancePerNauticalMile(), competitor.getSearchTag(),
boat);
}
});
boat));
} else {
SecurityUtils.getSubject().checkPermission(SecuredDomainType.COMPETITOR.getStringPermissionForTypeRelativeIdentifier(
DefaultActions.UPDATE, CompetitorImpl.getTypeRelativeObjectIdentifier(competitor.getId())));
@@ -5989,17 +5984,11 @@ public class SailingServiceImpl extends ResultCachingProxiedRemoteServiceServlet
DynamicTeam team = new TeamImpl(competitor.getName() + " team", Collections.singleton(sailor), null);
result = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError(
SecuredDomainType.COMPETITOR, CompetitorImpl.getTypeRelativeObjectIdentifier(competitorUUID),
competitor.getName(), new Callable<Competitor>() {
@Override
public Competitor call() throws Exception {
return getBaseDomainFactory().getOrCreateCompetitor(competitorUUID, competitor.getName(),
competitor.getName(), ()->getBaseDomainFactory().getOrCreateCompetitor(competitorUUID, competitor.getName(),
competitor.getShortName(), competitor.getColor(), competitor.getEmail(),
competitor.getFlagImageURL() == null ? null : new URI(competitor.getFlagImageURL()),
team, competitor.getTimeOnTimeFactor(),
competitor.getTimeOnDistanceAllowancePerNauticalMile(), competitor.getSearchTag());
}
});
competitor.getTimeOnDistanceAllowancePerNauticalMile(), competitor.getSearchTag()));
} else {
SecurityUtils.getSubject().checkPermission(
SecuredDomainType.COMPETITOR.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE,
@@ -6030,7 +6019,31 @@ public class SailingServiceImpl extends ResultCachingProxiedRemoteServiceServlet
public List<CompetitorWithBoatDTO> addCompetitors(List<CompetitorDescriptor> competitorDescriptors, String searchTag) throws URISyntaxException {
List<DynamicCompetitorWithBoat> competitorsForSaving = new ArrayList<>();
for (final CompetitorDescriptor competitorDescriptor : competitorDescriptors) {
competitorsForSaving.add(getService().convertCompetitorDescriptorToCompetitorWithBoat(competitorDescriptor, searchTag));
final Action action = ()->competitorsForSaving.add(getService().convertCompetitorDescriptorToCompetitorWithBoat(competitorDescriptor, searchTag));
final Boat existingBoat = getService().getCompetitorAndBoatStore().getExistingBoatById(competitorDescriptor.getBoatUUID());
final Action actionIncludingBoatSecurityCheck;
if (existingBoat == null) {
actionIncludingBoatSecurityCheck = ()->getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError(
SecuredDomainType.BOAT, BoatImpl.getTypeRelativeObjectIdentifier(competitorDescriptor.getBoatUUID()), competitorDescriptor.getBoatName(),
action);
} else {
actionIncludingBoatSecurityCheck = action;
}
final Competitor existingCompetitor = getService().getCompetitorAndBoatStore().getExistingCompetitorById(competitorDescriptor.getCompetitorUUID());
final Action actionIncludingCompetitorAndBoatSecurityCheck;
if (existingCompetitor == null) {
actionIncludingCompetitorAndBoatSecurityCheck = ()->getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError(
SecuredDomainType.COMPETITOR,
CompetitorImpl.getTypeRelativeObjectIdentifier(competitorDescriptor.getCompetitorUUID()), competitorDescriptor.getName(),
actionIncludingBoatSecurityCheck);
} else {
actionIncludingCompetitorAndBoatSecurityCheck = actionIncludingBoatSecurityCheck;
}
try {
actionIncludingCompetitorAndBoatSecurityCheck.run();
} catch (Exception e) {
throw new RuntimeException(e); // this can onlyhave been a RuntimeException in the first place because nothing of the above throws a checked one
}
}
getBaseDomainFactory().getCompetitorAndBoatStore().addNewCompetitorsWithBoat(competitorsForSaving);
return convertToCompetitorWithBoatDTOs(competitorsForSaving);
@@ -6079,14 +6092,8 @@ public class SailingServiceImpl extends ResultCachingProxiedRemoteServiceServlet
UUID boatUUID = UUID.randomUUID();
BoatClass boatClass = getBaseDomainFactory().getOrCreateBoatClass(boat.getBoatClass().getName());
result = getSecurityService().setOwnershipCheckPermissionForObjectCreationAndRevertOnError(
SecuredDomainType.BOAT, BoatImpl.getTypeRelativeObjectIdentifier(boatUUID), boat.getName(), new Callable<Boat>() {
@Override
public Boat call() throws Exception {
return getBaseDomainFactory().getOrCreateBoat(boatUUID, boat.getName(), boatClass,
boat.getSailId(), boat.getColor());
}
});
SecuredDomainType.BOAT, BoatImpl.getTypeRelativeObjectIdentifier(boatUUID), boat.getName(),
() -> getBaseDomainFactory().getOrCreateBoat(boatUUID, boat.getName(), boatClass, boat.getSailId(), boat.getColor()));
} else {
SecurityUtils.getSubject().checkPermission(
SecuredDomainType.BOAT.getStringPermissionForTypeRelativeIdentifier(DefaultActions.UPDATE,