Repository: rave Updated Branches: refs/heads/master 096dcf196 -> cba342cff
RAVE-1274 | Recursively check parent page permissions when checking for region and region widget editor rights Project: http://git-wip-us.apache.org/repos/asf/rave/repo Commit: http://git-wip-us.apache.org/repos/asf/rave/commit/22e16c6a Tree: http://git-wip-us.apache.org/repos/asf/rave/tree/22e16c6a Diff: http://git-wip-us.apache.org/repos/asf/rave/diff/22e16c6a Branch: refs/heads/master Commit: 22e16c6aeafc7c3101bca3749fc074ebc60a23e6 Parents: aab1719 Author: Stanton Sievers <[email protected]> Authored: Mon Aug 11 11:36:21 2014 -0400 Committer: Stanton Sievers <[email protected]> Committed: Mon Aug 11 11:36:21 2014 -0400 ---------------------------------------------------------------------- .../impl/DefaultRegionPermissionEvaluator.java | 19 +++++++++++-------- .../DefaultRegionWidgetPermissionEvaluator.java | 17 ++++++++++------- 2 files changed, 21 insertions(+), 15 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/rave/blob/22e16c6a/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionPermissionEvaluator.java ---------------------------------------------------------------------- diff --git a/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionPermissionEvaluator.java b/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionPermissionEvaluator.java index 0d1be72..41f5d48 100644 --- a/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionPermissionEvaluator.java +++ b/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionPermissionEvaluator.java @@ -196,18 +196,21 @@ public class DefaultRegionPermissionEvaluator extends AbstractModelPermissionEva } // // Check that the viewer is a member + // Make sure we check parent page permissions as well // String viewer = ((User)authentication.getPrincipal()).getUsername(); - for (PageUser pageUser:containerPage.getMembers()){ - if (userRepository.get(pageUser.getUserId()).getUsername().equals(viewer)){ - log.info("User "+viewer+" is a member of page "+containerPage.getId()); - if(checkEditorStatus){ - return pageUser.isEditor(); + do { + for (PageUser pageUser:containerPage.getMembers()){ + if (userRepository.get(pageUser.getUserId()).getUsername().equals(viewer)){ + log.info("User "+viewer+" is a member of page "+containerPage.getId()); + if(checkEditorStatus){ + return pageUser.isEditor(); + } + return true; } - return true; } - } + } while((containerPage = containerPage.getParentPage()) != null); return false; } -} \ No newline at end of file +} http://git-wip-us.apache.org/repos/asf/rave/blob/22e16c6a/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionWidgetPermissionEvaluator.java ---------------------------------------------------------------------- diff --git a/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionWidgetPermissionEvaluator.java b/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionWidgetPermissionEvaluator.java index 7ec533f..61ea4b6 100644 --- a/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionWidgetPermissionEvaluator.java +++ b/rave-components/rave-core/src/main/java/org/apache/rave/portal/security/impl/DefaultRegionWidgetPermissionEvaluator.java @@ -201,17 +201,20 @@ public class DefaultRegionWidgetPermissionEvaluator extends AbstractModelPermiss } // // Check that the viewer is a member + // Make sure we check parent page permissions as well // String viewer = ((User)authentication.getPrincipal()).getUsername(); - for (PageUser pageUser:containerPage.getMembers()){ - if (userRepository.get(pageUser.getUserId()).getUsername().equals(viewer)){ - log.info("User "+viewer+" is a member of page "+containerPage.getId()); - if(checkEditorStatus){ - return pageUser.isEditor(); + do { + for (PageUser pageUser:containerPage.getMembers()){ + if (userRepository.get(pageUser.getUserId()).getUsername().equals(viewer)){ + log.info("User "+viewer+" is a member of page "+containerPage.getId()); + if(checkEditorStatus){ + return pageUser.isEditor(); + } + return true; } - return true; } - } + } while((containerPage = containerPage.getParentPage()) != null); return false; } }
