mbien commented on code in PR #164:
URL: https://github.com/apache/roller/pull/164#discussion_r3940822960
##########
app/src/main/java/org/apache/roller/weblogger/webservices/xmlrpc/BaseAPIHandler.java:
##########
@@ -102,97 +105,133 @@ public BaseAPIHandler() {
//------------------------------------------------------------------------
/**
- * Returns website, but only if user authenticates and is authorized to
edit.
- * @param blogid Blogid sent in request (used as website's handle)
+ * Returns a weblog only when the authenticated user has the requested
+ * permission and XML-RPC access is enabled for that weblog.
+ */
+ protected Weblog validate(String blogid, String username, String password,
+ String requiredAction) throws Exception {
+ User user = validateUser(username, password);
+ return validateWeblog(blogid, user, requiredAction);
+ }
+
+ /**
+ * Validate a weblog for an already authenticated user.
+ */
+ protected Weblog validateWeblog(String blogid, User user,
+ String requiredAction) throws Exception {
+ try {
+ WeblogManager weblogMgr = WebloggerFactory.getWeblogger()
+ .getWeblogManager();
+ Weblog website = weblogMgr.getWeblogByHandle(blogid);
+
+ // Use one response for missing, unavailable, and inaccessible
weblogs.
+ if (!isWeblogAvailable(website)
+ || !website.hasUserPermission(user, requiredAction)) {
+ throw new XmlRpcNotAuthorizedException(WEBLOG_DISABLED_MSG);
+ }
+ return website;
+ } catch (XmlRpcNotAuthorizedException e) {
+ throw e;
+ } catch (Exception e) {
+ mLogger.error("ERROR internal error validating weblog", e);
+ throw new XmlRpcNotAuthorizedException(WEBLOG_DISABLED_MSG);
+ }
+ }
+
+ //------------------------------------------------------------------------
+ /**
+ * Returns the authenticated user if username/password are valid and the
+ * user is not disabled.
* @param username Username sent in request
* @param password Password sent in request
*/
- protected Weblog validate(String blogid, String username, String password)
- throws Exception {
+ protected User validateUser(String username, String password)
+ throws Exception {
+ User user = null;
boolean authenticated = false;
- boolean userEnabled = false;
- boolean weblogEnabled = false;
- boolean apiEnabled = false;
- boolean weblogFound = false;
- Weblog website = null;
try {
UserManager userMgr =
WebloggerFactory.getWeblogger().getUserManager();
- WeblogManager weblogMgr =
WebloggerFactory.getWeblogger().getWeblogManager();
- User user = userMgr.getUserByUserName(username);
-
- website = weblogMgr.getWeblogByHandle(blogid);
- if (website != null) {
- weblogFound = true;
- weblogEnabled = website.getVisible();
- apiEnabled = website.getEnableBloggerApi()
- &&
WebloggerRuntimeConfig.getBooleanProperty("webservices.enableXmlRpc");
- }
-
- if (user != null) {
- userEnabled = user.getEnabled();
- authenticated =
RollerContext.getPasswordEncoder().matches(password, user.getPassword());
+ user = userMgr.getUserByUserName(username);
+ if (user != null && RollerContext.getPasswordEncoder() != null) {
+ authenticated = RollerContext.getPasswordEncoder().matches(
+ password, user.getPassword());
}
} catch (Exception e) {
mLogger.error("ERROR internal error validating user", e);
}
-
- if ( !authenticated ) {
+
+ if (!authenticated) {
throw new
XmlRpcNotAuthorizedException(AUTHORIZATION_EXCEPTION_MSG);
}
- if ( !userEnabled ) {
+
+ if (!Boolean.TRUE.equals(user.getEnabled())) {
throw new XmlRpcNotAuthorizedException(USER_DISABLED_MSG);
}
- if ( !weblogEnabled ) {
- throw new XmlRpcNotAuthorizedException(WEBLOG_DISABLED_MSG);
+
+ if
(!WebloggerRuntimeConfig.getBooleanProperty("webservices.enableXmlRpc")) {
+ throw new XmlRpcNotAuthorizedException(BLOGGERAPI_DISABLED_MSG);
}
Review Comment:
fail-fast: should this check be moved before the try-block? The user enabled
check could be also moved before the authentication query
(`getPasswordEncoder().matche()`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
