Repository: openmeetings Updated Branches: refs/heads/3.3.x 7ceac1f24 -> 5ad76092d
no jira: group logo ACL check is fixed Project: http://git-wip-us.apache.org/repos/asf/openmeetings/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings/commit/5ad76092 Tree: http://git-wip-us.apache.org/repos/asf/openmeetings/tree/5ad76092 Diff: http://git-wip-us.apache.org/repos/asf/openmeetings/diff/5ad76092 Branch: refs/heads/3.3.x Commit: 5ad76092d1a10a4aeedd2fbfab1cd7e8b60f1720 Parents: 7ceac1f Author: Maxim Solodovnik <[email protected]> Authored: Fri Jun 16 15:41:44 2017 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Fri Jun 16 15:41:44 2017 +0700 ---------------------------------------------------------------------- .../openmeetings/db/dao/user/GroupUserDao.java | 16 ++++++++-------- .../web/util/GroupLogoResourceReference.java | 9 ++++++--- 2 files changed, 14 insertions(+), 11 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings/blob/5ad76092/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/user/GroupUserDao.java ---------------------------------------------------------------------- diff --git a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/user/GroupUserDao.java b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/user/GroupUserDao.java index bcc6d5c..036c519 100644 --- a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/user/GroupUserDao.java +++ b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/user/GroupUserDao.java @@ -39,7 +39,7 @@ public class GroupUserDao implements IDataProviderDao<GroupUser> { public GroupUser get(long id) { return get(Long.valueOf(id)); } - + @Override public GroupUser get(Long id) { TypedQuery<GroupUser> q = em.createNamedQuery("getGroupUsersById", GroupUser.class); @@ -56,7 +56,7 @@ public class GroupUserDao implements IDataProviderDao<GroupUser> { public List<GroupUser> get(String search, int start, int count, String sort) { throw new RuntimeException("Should not be used"); } - + public List<GroupUser> get(long groupId, String search, int start, int count, String sort) { TypedQuery<GroupUser> q = em.createQuery(DaoHelper.getSearchQuery(GroupUser.class.getSimpleName(), "ou", null, search, false, false, "ou.group.id = :groupId", sort, searchFields), GroupUser.class); q.setParameter("groupId", groupId); @@ -64,7 +64,7 @@ public class GroupUserDao implements IDataProviderDao<GroupUser> { q.setMaxResults(count); return q.getResultList(); } - + public List<GroupUser> get(long groupId, int start, int count) { TypedQuery<GroupUser> q = em.createNamedQuery("getGroupUsersByGroupId", GroupUser.class); q.setParameter("id", groupId); @@ -73,7 +73,7 @@ public class GroupUserDao implements IDataProviderDao<GroupUser> { return q.getResultList(); } - public GroupUser getByGroupAndUser(long groupId, long userId) { + public GroupUser getByGroupAndUser(Long groupId, Long userId) { try { List<GroupUser> list = em.createNamedQuery("isUserInGroup", GroupUser.class) .setParameter("groupId", groupId).setParameter("userId", userId).getResultList(); @@ -85,12 +85,12 @@ public class GroupUserDao implements IDataProviderDao<GroupUser> { } return null; } - + public boolean isUserInGroup(long groupId, long userId) { return em.createNamedQuery("isUserInGroup", GroupUser.class) .setParameter("groupId", groupId).setParameter("userId", userId).getResultList().size() > 0; } - + @Override public long count() { throw new RuntimeException("Should not be used"); @@ -100,12 +100,12 @@ public class GroupUserDao implements IDataProviderDao<GroupUser> { public long count(String search) { throw new RuntimeException("Should not be used"); } - + public long count(long groupId, String search) { TypedQuery<Long> q = em.createQuery(DaoHelper.getSearchQuery(GroupUser.class.getSimpleName(), "ou", search, false, true, null, searchFields), Long.class); return q.getSingleResult(); } - + public long count(long groupId) { TypedQuery<Long> q = em.createNamedQuery("countGroupUsers", Long.class); q.setParameter("id", groupId); http://git-wip-us.apache.org/repos/asf/openmeetings/blob/5ad76092/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java ---------------------------------------------------------------------- diff --git a/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java b/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java index 96d9977..7da7b7e 100644 --- a/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java +++ b/openmeetings-web/src/main/java/org/apache/openmeetings/web/util/GroupLogoResourceReference.java @@ -18,10 +18,12 @@ */ package org.apache.openmeetings.web.util; +import static org.apache.openmeetings.db.util.AuthLevelUtil.hasAdminLevel; import static org.apache.openmeetings.util.OmFileHelper.PNG_MIME_TYPE; import static org.apache.openmeetings.util.OmFileHelper.getGroupLogo; import static org.apache.openmeetings.util.OpenmeetingsVariables.webAppRootKey; import static org.apache.openmeetings.web.app.Application.getBean; +import static org.apache.openmeetings.web.app.WebSession.getRights; import static org.apache.openmeetings.web.app.WebSession.getUserId; import static org.red5.logging.Red5LoggerFactory.getLogger; @@ -61,6 +63,7 @@ public class GroupLogoResourceReference extends FileSystemResourceReference { @Override protected ResourceResponse newResourceResponse(Attributes attrs) { Long id = null; + boolean allowed = false; if (WebSession.get().isSignedIn()) { PageParameters params = attrs.getParameters(); StringValue _id = params.get("id"); @@ -69,11 +72,11 @@ public class GroupLogoResourceReference extends FileSystemResourceReference { } catch (Exception e) { //no-op expected } - if (null == getBean(GroupUserDao.class).getByGroupAndUser(id, getUserId())) { - id = null; + if (hasAdminLevel(getRights()) || null != getBean(GroupUserDao.class).getByGroupAndUser(id, getUserId())) { + allowed = true; } } - if (id != null) { + if (allowed) { return createResourceResponse(attrs, getGroupLogo(id, true).toPath()); } else { log.debug("Not authorized");
