Repository: openmeetings Updated Branches: refs/heads/3.3.x eafb9b165 -> 0c92c5ba9
no jira: One time invitations are now expires as expected, auth checks are added to profile and group images Project: http://git-wip-us.apache.org/repos/asf/openmeetings/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings/commit/0c92c5ba Tree: http://git-wip-us.apache.org/repos/asf/openmeetings/tree/0c92c5ba Diff: http://git-wip-us.apache.org/repos/asf/openmeetings/diff/0c92c5ba Branch: refs/heads/3.3.x Commit: 0c92c5ba919851dbfc98c726d4ddbcaea820f718 Parents: eafb9b1 Author: Maxim Solodovnik <[email protected]> Authored: Thu Jun 15 22:45:44 2017 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Thu Jun 15 22:45:44 2017 +0700 ---------------------------------------------------------------------- .../openmeetings/db/dao/room/InvitationDao.java | 1 + .../web/util/GroupLogoResourceReference.java | 36 ++++++++++++++++---- .../web/util/ProfileImageResourceReference.java | 28 ++++++++++----- 3 files changed, 49 insertions(+), 16 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings/blob/0c92c5ba/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/room/InvitationDao.java ---------------------------------------------------------------------- diff --git a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/room/InvitationDao.java b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/room/InvitationDao.java index 9bd9fa2..fd7fea1 100644 --- a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/room/InvitationDao.java +++ b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/room/InvitationDao.java @@ -83,6 +83,7 @@ public class InvitationDao { if (markUsed) { i.setUsed(true); update(i); + em.flush(); // flash is required to eliminate 'detach' effect } break; case Period: http://git-wip-us.apache.org/repos/asf/openmeetings/blob/0c92c5ba/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java ---------------------------------------------------------------------- diff --git a/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java b/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java index c79c867..96d9977 100644 --- a/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java +++ b/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java @@ -20,19 +20,29 @@ package org.apache.openmeetings.web.util; import static org.apache.openmeetings.util.OmFileHelper.PNG_MIME_TYPE; import static org.apache.openmeetings.util.OmFileHelper.getGroupLogo; +import static org.apache.openmeetings.util.OpenmeetingsVariables.webAppRootKey; +import static org.apache.openmeetings.web.app.Application.getBean; +import static org.apache.openmeetings.web.app.WebSession.getUserId; +import static org.red5.logging.Red5LoggerFactory.getLogger; import java.io.File; import java.io.IOException; +import javax.servlet.http.HttpServletResponse; + +import org.apache.openmeetings.db.dao.user.GroupUserDao; +import org.apache.openmeetings.web.app.WebSession; import org.apache.wicket.request.cycle.RequestCycle; import org.apache.wicket.request.mapper.parameter.PageParameters; import org.apache.wicket.request.resource.IResource; import org.apache.wicket.resource.FileSystemResource; import org.apache.wicket.resource.FileSystemResourceReference; import org.apache.wicket.util.string.StringValue; +import org.slf4j.Logger; public class GroupLogoResourceReference extends FileSystemResourceReference { private static final long serialVersionUID = 1L; + private static final Logger log = getLogger(GroupLogoResourceReference.class, webAppRootKey); public GroupLogoResourceReference() { super(GroupLogoResourceReference.class, "grouplogo"); @@ -50,15 +60,27 @@ public class GroupLogoResourceReference extends FileSystemResourceReference { @Override protected ResourceResponse newResourceResponse(Attributes attrs) { - PageParameters params = attrs.getParameters(); - StringValue _id = params.get("id"); Long id = null; - try { - id = _id.toOptionalLong(); - } catch (Exception e) { - //no-op expected + if (WebSession.get().isSignedIn()) { + PageParameters params = attrs.getParameters(); + StringValue _id = params.get("id"); + try { + id = _id.toOptionalLong(); + } catch (Exception e) { + //no-op expected + } + if (null == getBean(GroupUserDao.class).getByGroupAndUser(id, getUserId())) { + id = null; + } + } + if (id != null) { + return createResourceResponse(attrs, getGroupLogo(id, true).toPath()); + } else { + log.debug("Not authorized"); + ResourceResponse rr = new ResourceResponse(); + rr.setError(HttpServletResponse.SC_FORBIDDEN); + return rr; } - return createResourceResponse(attrs, getGroupLogo(id, true).toPath()); } }; } http://git-wip-us.apache.org/repos/asf/openmeetings/blob/0c92c5ba/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/ProfileImageResourceReference.java ---------------------------------------------------------------------- diff --git a/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/ProfileImageResourceReference.java b/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/ProfileImageResourceReference.java index 664c0f0..8672f84 100644 --- a/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/ProfileImageResourceReference.java +++ b/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/ProfileImageResourceReference.java @@ -26,9 +26,12 @@ import java.io.FileInputStream; import java.io.InputStream; import java.net.URI; +import javax.servlet.http.HttpServletResponse; + import org.apache.openmeetings.db.dao.user.UserDao; import org.apache.openmeetings.db.entity.user.User; import org.apache.openmeetings.util.OmFileHelper; +import org.apache.openmeetings.web.app.WebSession; import org.apache.wicket.request.cycle.RequestCycle; import org.apache.wicket.request.mapper.parameter.PageParameters; import org.apache.wicket.request.resource.ByteArrayResource; @@ -45,11 +48,11 @@ public class ProfileImageResourceReference extends ResourceReference { public ProfileImageResourceReference() { super(ProfileImageResourceReference.class, "profile"); } - + public static String getUrl(RequestCycle rc, Long userId) { return getUrl(rc, getBean(UserDao.class).get(userId)); } - + public static String getUrl(RequestCycle rc, User u) { String uri = u.getPictureuri(); if (!isAbsolute(uri)) { @@ -69,7 +72,7 @@ public class ProfileImageResourceReference extends ResourceReference { } return absolute; } - + @Override public IResource getResource() { return new ByteArrayResource("image/jpeg") { @@ -79,14 +82,21 @@ public class ProfileImageResourceReference extends ResourceReference { @Override protected ResourceResponse newResourceResponse(Attributes attributes) { - PageParameters params = attributes.getParameters(); - userId = params.get("id").toOptionalLong(); - uri = getBean(UserDao.class).get(userId).getPictureuri(); - ResourceResponse rr = super.newResourceResponse(attributes); - rr.disableCaching(); + ResourceResponse rr; + if (WebSession.get().isSignedIn()) { + PageParameters params = attributes.getParameters(); + userId = params.get("id").toOptionalLong(); + uri = getBean(UserDao.class).get(userId).getPictureuri(); + rr = super.newResourceResponse(attributes); + rr.disableCaching(); + } else { + log.debug("Not authorized"); + rr = new ResourceResponse(); + rr.setError(HttpServletResponse.SC_FORBIDDEN); + } return rr; } - + @Override protected byte[] getData(Attributes attributes) { if (!isAbsolute(uri)) {
