eclipse-sailing-analytics/sailing-analytics
1
0
Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-09-23 14:08:40 +00:00
Code Activity

bug5782: fixed permission check for event media upload; release notes

Browse Source
This commit is contained in:
Axel Uhl
2023-01-09 18:24:20 +01:00
parent 39c0e38068
commit e05f6b4687
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceWriteImpl.java
+9
View File
@@ -1482,6 +1482,15 @@ public class SailingServiceWriteImpl extends SailingServiceImpl implements Saili
|| !Util.isOnlyAdding(images, currentEventState.getImages(), (a, b)->a.compareTo(b) == 0)
|| !Util.isOnlyAdding(videos, currentEventState.getVideos(), (a, b)->a.compareTo(b) == 0)) {
throw new UnauthorizedException("You are not permitted to edit event " + eventId + " other than by adding images and videos");
} else {
final Set<String> sourceRefsOfImagesAdded = new HashSet<>();
Util.addAll(Util.map(images, ImageDTO::getSourceRef), sourceRefsOfImagesAdded);
Util.removeAll(Util.map(currentEventState.getImages(), ImageDTO::getSourceRef), sourceRefsOfImagesAdded);
final Set<String> sourceRefsOfVideosAdded = new HashSet<>();
Util.addAll(Util.map(videos, VideoDTO::getSourceRef), sourceRefsOfVideosAdded);
Util.removeAll(Util.map(currentEventState.getVideos(), VideoDTO::getSourceRef), sourceRefsOfVideosAdded);
logger.info("User "+SecurityUtils.getSubject().getPrincipal()+" is adding the following media to event "+currentEventState.getName()+
" with ID "+currentEventState.getId()+": images: "+sourceRefsOfVideosAdded+", videos: "+sourceRefsOfVideosAdded);
}
} else {
throw new UnauthorizedException("You are not permitted to edit event " + eventId);
java/com.sap.sailing.www/release_notes_admin.html
+6
View File
@@ -40,6 +40,12 @@
re-calculation times for live events with parallel live races in several classes and tens of
competitors per leaderboard.
</li>
<li>Introduced new permission <tt>EVENT:UPLOAD_MEDIA</tt>. With this special permission, a user who does
not have the full <tt>EVENT:UPDATE</tt> permission can still add (not remove or edit) media to an
event, in particular images and videos. In our production environment the role <tt>event_manager</tt>
grants this permission now, too, so users having that role can grant <tt>EVENT:UPLOAD_MEDIA</tt>
to other users or the general public at their likings.
</li>
</ul>
<h2 class="articleSubheadline">December 2022</h2>
<ul class="bulletList">