Author: solomax
Date: Tue Jul 26 05:34:05 2016
New Revision: 1754069
URL: http://svn.apache.org/viewvc?rev=1754069&view=rev
Log:
[OPENMEETINGS-1438] recording rights are being checked correctly
Modified:
openmeetings/application/branches/3.1.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/RecordingResourceReference.java
openmeetings/application/branches/3.2.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
openmeetings/application/trunk/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
Modified:
openmeetings/application/branches/3.1.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/RecordingResourceReference.java
URL:
http://svn.apache.org/viewvc/openmeetings/application/branches/3.1.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/RecordingResourceReference.java?rev=1754069&r1=1754068&r2=1754069&view=diff
==============================================================================
---
openmeetings/application/branches/3.1.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/RecordingResourceReference.java
(original)
+++
openmeetings/application/branches/3.1.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/RecordingResourceReference.java
Tue Jul 26 05:34:05 2016
@@ -33,6 +33,7 @@ import javax.servlet.http.HttpServletRes
import org.apache.openmeetings.db.dao.record.RecordingDao;
import org.apache.openmeetings.db.dao.user.GroupUserDao;
import org.apache.openmeetings.db.dao.user.UserDao;
+import org.apache.openmeetings.db.entity.file.FileItem.Type;
import org.apache.openmeetings.db.entity.record.Recording;
import org.apache.openmeetings.db.entity.user.User;
import org.apache.openmeetings.web.app.WebSession;
@@ -84,19 +85,24 @@ public abstract class RecordingResourceR
abstract File getFile(Recording r);
private static Recording getRecording(Long id) {
+ log.debug("Recording with id {} is requested", id);
Recording r = getBean(RecordingDao.class).get(id);
- // TODO should we process public?
- // || r.getOwnerId() == 0 || r.getParentFileExplorerItemId() ==
null || r.getParentFileExplorerItemId() == 0
- if (r == null) {
+ if (r == null || r.getType() == Type.Folder || r.isDeleted()) {
+ return null;
+ }
+ //TODO should we check parentId here
+ if (r.getOwnerId() == null && r.getGroupId() == null) {
+ //public
return r;
}
- if (r.getOwnerId() == null ||
getUserId().equals(r.getOwnerId())) {
+ if (r.getOwnerId() != null &&
getUserId().equals(r.getOwnerId())) {
+ //own
return r;
}
- if (r.getGroupId() == null ||
getBean(GroupUserDao.class).isUserInGroup(r.getGroupId(), getUserId())) {
+ if (r.getGroupId() != null &&
getBean(GroupUserDao.class).isUserInGroup(r.getGroupId(), getUserId())) {
return r;
}
- //TODO external group check was added for plugin recording
download
+ //external group check was added for plugin recording download
String extType = getExternalType();
if (extType != null) {
User creator =
getBean(UserDao.class).get(r.getInsertedBy());
Modified:
openmeetings/application/branches/3.2.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
URL:
http://svn.apache.org/viewvc/openmeetings/application/branches/3.2.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java?rev=1754069&r1=1754068&r2=1754069&view=diff
==============================================================================
---
openmeetings/application/branches/3.2.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
(original)
+++
openmeetings/application/branches/3.2.x/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
Tue Jul 26 05:34:05 2016
@@ -28,6 +28,7 @@ import static org.red5.logging.Red5Logge
import org.apache.openmeetings.db.dao.record.RecordingDao;
import org.apache.openmeetings.db.dao.user.GroupUserDao;
import org.apache.openmeetings.db.dao.user.UserDao;
+import org.apache.openmeetings.db.entity.file.FileItem.Type;
import org.apache.openmeetings.db.entity.record.Recording;
import org.apache.openmeetings.db.entity.user.User;
import org.apache.openmeetings.web.app.WebSession;
@@ -75,22 +76,26 @@ public abstract class RecordingResourceR
}
private static Recording getRecording(Long id) {
+ log.debug("Recording with id {} is requested", id);
Recording r = getBean(RecordingDao.class).get(id);
- // TODO should we process public?
- // || r.getOwnerId() == 0 || r.getParentFileExplorerItemId() ==
null || r.getParentFileExplorerItemId() == 0
- if (r == null) {
+ if (r == null || r.getType() == Type.Folder || r.isDeleted()) {
+ return null;
+ }
+ //TODO should we check parentId here
+ if (r.getOwnerId() == null && r.getGroupId() == null) {
+ //public
return r;
}
- if (r.getOwnerId() == null ||
getUserId().equals(r.getOwnerId())) {
+ if (r.getOwnerId() != null &&
getUserId().equals(r.getOwnerId())) {
+ //own
return r;
}
- if (r.getGroupId() == null ||
getBean(GroupUserDao.class).isUserInGroup(r.getGroupId(), getUserId())) {
+ if (r.getGroupId() != null &&
getBean(GroupUserDao.class).isUserInGroup(r.getGroupId(), getUserId())) {
return r;
}
- //TODO external group check was added for plugin recording
download
+ //external group check was added for plugin recording download
String extType = getExternalType();
if (extType != null) {
- log.debug("External recording requested: " + extType);
User creator =
getBean(UserDao.class).get(r.getInsertedBy());
if (extType.equals(creator.getExternalType())) {
return r;
Modified:
openmeetings/application/trunk/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
URL:
http://svn.apache.org/viewvc/openmeetings/application/trunk/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java?rev=1754069&r1=1754068&r2=1754069&view=diff
==============================================================================
---
openmeetings/application/trunk/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
(original)
+++
openmeetings/application/trunk/openmeetings-web/src/main/java/org/apache/openmeetings/web/user/record/RecordingResourceReference.java
Tue Jul 26 05:34:05 2016
@@ -28,6 +28,7 @@ import static org.red5.logging.Red5Logge
import org.apache.openmeetings.db.dao.record.RecordingDao;
import org.apache.openmeetings.db.dao.user.GroupUserDao;
import org.apache.openmeetings.db.dao.user.UserDao;
+import org.apache.openmeetings.db.entity.file.FileItem.Type;
import org.apache.openmeetings.db.entity.record.Recording;
import org.apache.openmeetings.db.entity.user.User;
import org.apache.openmeetings.web.app.WebSession;
@@ -75,22 +76,26 @@ public abstract class RecordingResourceR
}
private static Recording getRecording(Long id) {
+ log.debug("Recording with id {} is requested", id);
Recording r = getBean(RecordingDao.class).get(id);
- // TODO should we process public?
- // || r.getOwnerId() == 0 || r.getParentFileExplorerItemId() ==
null || r.getParentFileExplorerItemId() == 0
- if (r == null) {
+ if (r == null || r.getType() == Type.Folder || r.isDeleted()) {
+ return null;
+ }
+ //TODO should we check parentId here
+ if (r.getOwnerId() == null && r.getGroupId() == null) {
+ //public
return r;
}
- if (r.getOwnerId() == null ||
getUserId().equals(r.getOwnerId())) {
+ if (r.getOwnerId() != null &&
getUserId().equals(r.getOwnerId())) {
+ //own
return r;
}
- if (r.getGroupId() == null ||
getBean(GroupUserDao.class).isUserInGroup(r.getGroupId(), getUserId())) {
+ if (r.getGroupId() != null &&
getBean(GroupUserDao.class).isUserInGroup(r.getGroupId(), getUserId())) {
return r;
}
- //TODO external group check was added for plugin recording
download
+ //external group check was added for plugin recording download
String extType = getExternalType();
if (extType != null) {
- log.debug("External recording requested: " + extType);
User creator =
getBean(UserDao.class).get(r.getInsertedBy());
if (extType.equals(creator.getExternalType())) {
return r;
