snoopdave opened a new pull request, #162: URL: https://github.com/apache/roller/pull/162
## Summary Authoring actions resolve the resource named by a request parameter by id alone, independently of the weblog the action is operating on. This adds weblog-scoped lookups beside the existing unscoped ones and points the authoring actions at them, so a lookup made on behalf of one weblog resolves only within that weblog. The pattern follows the existing `getTemplateByLink(Weblog, String)`. ## Manager methods added | Manager | Method | Named query | |---|---|---| | `WeblogManager` | `getTemplate(Weblog, String)` | `WeblogTemplate.getByWeblog&Id` | | `WeblogEntryManager` | `getWeblogEntry(Weblog, String)` | `WeblogEntry.getByWebsite&Id` | | `WeblogEntryManager` | `getWeblogCategory(Weblog, String)` | `WeblogCategory.getByWeblog&Id` | | `WeblogEntryManager` | `getComment(Weblog, String)` | `WeblogEntryComment.getByWebsite&Id` | | `BookmarkManager` | `getBookmark(Weblog, String)` | `WeblogBookmark.getByWebsite&Id` | | `BookmarkManager` | `getFolderById(Weblog, String)` | `WeblogBookmarkFolder.getByWebsite&Id` | | `MediaFileManager` | `getMediaFile(Weblog, String)` | `MediaFile.getByWeblogAndId` | | `MediaFileManager` | `getMediaFileDirectory(Weblog, String)` | `MediaFileDirectory.getByWeblogAndId` | Each returns null when the id does not belong to the given weblog, the same result as for an id that does not exist. The folder lookup is named `getFolderById` rather than being an overload: `getFolder(Weblog, String)` already exists as the by-name lookup, and the two would otherwise share an erasure. ## Call sites Updated across templates, entries, categories, comments, bookmarks, folders and media files, in `ui/struts2/editor/`. The action weblog is already resolved and authorized by the interceptor stack (`params` -> `UIActionInterceptor` -> `UISecurityInterceptor` -> `UIActionPrepareInterceptor`) before `myPrepare()` runs, so `getActionWeblog()` is available at every one of these call sites without reordering anything. The two comment loops in `Comments` already compared the weblog after loading. They now use the scoped lookup instead, which also removes an NPE on ids that do not exist. ## Deliberately unchanged `EntryBean`, `StylesheetEdit`, `CommentDataServlet`, and the XML-RPC and Atom handlers resolve correctly by other means -- they derive the weblog from the entity itself, or already compare ownership explicitly. `RollerResourceLoader` and `GlobalCommentManagement` legitimately have no single weblog in context. ## Tests - `business/WeblogScopedLookupTest` -- 16 tests at the manager layer, two weblogs owned by two users, own and foreign case for each lookup - `ui/struts2/editor/TemplateEditScopingTest` -- 2 tests at the action layer - `ui/struts2/editor/AuthoringActionScopingTest` -- 6 tests at the action layer covering `EntryRemove`, `EntryEdit`, `CategoryRemove`, `BookmarkEdit` Each was watched failing before the corresponding change and passing after. The action-layer tests were additionally verified by reverting the call sites and confirming all four cross-weblog assertions fail. Full suite on JDK 11: **182 run, 0 failures, 0 errors, 1 skipped**. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
