Author: chathura
Date: Mon Jan 7 00:56:48 2008
New Revision: 11922
Log:
Restricting delete and change persmissions action controls in the UI according
to the permissions of the logged in user.
Added:
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/utils/
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/utils/UserUtil.java
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/utils/Utils.java
- copied, changed from r11906,
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/Utils.java
Removed:
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/Utils.java
Modified:
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/RegistryServlet.java
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/ResourceRequestProcessor.java
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/ControllerServlet.java
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/actions/ResourceDetailsAction.java
trunk/registry/modules/webapps/src/main/webapp/admin/comments.jsp
trunk/registry/modules/webapps/src/main/webapp/admin/edit_resource.jsp
trunk/registry/modules/webapps/src/main/webapp/admin/registry-resources.jsp
trunk/registry/modules/webapps/src/main/webapp/admin/tags.jsp
Modified:
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/RegistryServlet.java
==============================================================================
---
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/RegistryServlet.java
(original)
+++
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/RegistryServlet.java
Mon Jan 7 00:56:48 2008
@@ -26,6 +26,7 @@
import org.wso2.registry.RegistryConstants;
import org.wso2.registry.RegistryException;
import org.wso2.registry.Resource;
+import org.wso2.registry.servlet.utils.Utils;
import org.wso2.registry.config.DataBaseConfiguration;
import org.wso2.registry.config.RegistryConfiguration;
import org.wso2.registry.i18n.Messages;
@@ -35,7 +36,6 @@
import org.wso2.registry.jdbc.realm.RegistryRealm;
import org.wso2.registry.jdbc.utils.RegistryDataSource;
import org.wso2.registry.secure.SecureRegistry;
-import org.wso2.registry.secure.AuthorizationFailedException;
import javax.naming.Context;
import javax.naming.InitialContext;
@@ -48,7 +48,6 @@
import javax.sql.DataSource;
import java.io.FileOutputStream;
import java.io.IOException;
-import java.util.Date;
/** Servlet for providing REST API for the registry. */
public class RegistryServlet extends HttpServlet {
Modified:
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/ResourceRequestProcessor.java
==============================================================================
---
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/ResourceRequestProcessor.java
(original)
+++
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/ResourceRequestProcessor.java
Mon Jan 7 00:56:48 2008
@@ -20,6 +20,7 @@
import org.wso2.registry.RegistryException;
import org.wso2.registry.Registry;
import org.wso2.registry.RegistryConstants;
+import org.wso2.registry.servlet.utils.Utils;
import org.wso2.registry.jdbc.realm.RegistryRealm;
import org.wso2.registry.secure.SecureRegistry;
import org.wso2.registry.secure.AuthorizationFailedException;
Added:
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/utils/UserUtil.java
==============================================================================
--- (empty file)
+++
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/utils/UserUtil.java
Mon Jan 7 00:56:48 2008
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2006, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wso2.registry.servlet.utils;
+
+import org.wso2.registry.secure.SecureRegistry;
+import org.wso2.registry.RegistryException;
+import org.wso2.registry.ActionConstants;
+import org.wso2.usermanager.Realm;
+import org.wso2.usermanager.UserManagerException;
+import org.wso2.usermanager.UserManagerConstants;
+
+import javax.servlet.http.HttpServletRequest;
+
+public class UserUtil {
+
+ public static boolean isPutAllowed(
+ String userName, String resourcePath, HttpServletRequest request)
+ throws RegistryException {
+
+ boolean putAllowed = false;
+
+ SecureRegistry secureRegistry = Utils.getSecureRegistry(request);
+ Realm userRealm = secureRegistry.getUserRealm();
+
+ try {
+ if (userRealm.getAuthorizer().isUserAuthorized(
+ userName, resourcePath, ActionConstants.PUT)) {
+ putAllowed = true;
+ }
+ } catch (UserManagerException e) {
+
+ String msg = "Could not the permission details for the user: " +
userName +
+ " for the resource: " + resourcePath + ". Caused by: " +
e.getMessage();
+ throw new RegistryException(msg);
+ }
+
+ return putAllowed;
+ }
+
+ public static boolean isDeleteAllowed(
+ String userName, String resourcePath, HttpServletRequest request)
+ throws RegistryException {
+
+ boolean putAllowed = false;
+
+ SecureRegistry secureRegistry = Utils.getSecureRegistry(request);
+ Realm userRealm = secureRegistry.getUserRealm();
+
+ try {
+ if (userRealm.getAuthorizer().isUserAuthorized(
+ userName, resourcePath, ActionConstants.DELETE)) {
+ putAllowed = true;
+ }
+ } catch (UserManagerException e) {
+
+ String msg = "Could not the permission details for the user: " +
userName +
+ " for the resource: " + resourcePath + ". Caused by: " +
e.getMessage();
+ throw new RegistryException(msg);
+ }
+
+ return putAllowed;
+ }
+
+ public static boolean isAuthorizeAllowed(
+ String userName, String resourcePath, HttpServletRequest request)
+ throws RegistryException {
+
+ boolean putAllowed = false;
+
+ SecureRegistry secureRegistry = Utils.getSecureRegistry(request);
+ Realm userRealm = secureRegistry.getUserRealm();
+
+ try {
+ if (userRealm.getAuthorizer().isUserAuthorized(
+ userName, resourcePath, UserManagerConstants.AUTHORIZE)) {
+ putAllowed = true;
+ }
+ } catch (UserManagerException e) {
+
+ String msg = "Could not the permission details for the user: " +
userName +
+ " for the resource: " + resourcePath + ". Caused by: " +
e.getMessage();
+ throw new RegistryException(msg);
+ }
+
+ return putAllowed;
+ }
+}
Copied:
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/utils/Utils.java
(from r11906,
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/Utils.java)
==============================================================================
---
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/Utils.java
(original)
+++
trunk/registry/modules/core/src/main/java/org/wso2/registry/servlet/utils/Utils.java
Mon Jan 7 00:56:48 2008
@@ -17,7 +17,7 @@
* under the License.
*/
-package org.wso2.registry.servlet;
+package org.wso2.registry.servlet.utils;
import org.wso2.registry.Registry;
import org.wso2.registry.RegistryConstants;
Modified:
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/ControllerServlet.java
==============================================================================
---
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/ControllerServlet.java
(original)
+++
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/ControllerServlet.java
Mon Jan 7 00:56:48 2008
@@ -23,7 +23,7 @@
import org.wso2.registry.secure.SecureRegistry;
import org.wso2.registry.secure.AuthorizationFailedException;
import org.wso2.registry.servlet.FileUploadUtil;
-import org.wso2.registry.servlet.Utils;
+import org.wso2.registry.servlet.utils.Utils;
import org.wso2.registry.web.actions.*;
import org.wso2.registry.web.beans.AdminBean;
import org.wso2.registry.web.beans.VersionsBean;
Modified:
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/actions/ResourceDetailsAction.java
==============================================================================
---
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/actions/ResourceDetailsAction.java
(original)
+++
trunk/registry/modules/webapps/src/main/java/org/wso2/registry/web/actions/ResourceDetailsAction.java
Mon Jan 7 00:56:48 2008
@@ -17,6 +17,7 @@
package org.wso2.registry.web.actions;
import org.wso2.registry.*;
+import org.wso2.registry.servlet.utils.UserUtil;
import org.wso2.registry.secure.SecureRegistry;
import org.wso2.registry.web.actions.utils.Permission;
import org.wso2.registry.web.actions.utils.ResourcePath;
@@ -41,6 +42,8 @@
private String mediaType;
private boolean collection;
private boolean putAllowed;
+ private boolean deleteAllowed;
+ private boolean authorizeAllowed;
private Properties properties;
private List tags = new ArrayList();
@@ -225,10 +228,18 @@
roleNames.add(rolesArray[i]);
}
- if (userRealm.getAuthorizer().isUserAuthorized(getUserName(),
path, ActionConstants.PUT)) {
+ if (UserUtil.isPutAllowed(getUserName(), path, request)) {
putAllowed = true;
}
+ if (UserUtil.isDeleteAllowed(getUserName(), path, request)) {
+ deleteAllowed = true;
+ }
+
+ if (UserUtil.isAuthorizeAllowed(getUserName(), path, request)) {
+ authorizeAllowed = true;
+ }
+
Map userPermissionMap = new HashMap();
String[] raUsers =
userRealm.getAuthorizer().getAllowedUsersForResource(path, ActionConstants.GET);
@@ -444,6 +455,22 @@
this.putAllowed = putAllowed;
}
+ public boolean isDeleteAllowed() {
+ return deleteAllowed;
+ }
+
+ public void setDeleteAllowed(boolean deleteAllowed) {
+ this.deleteAllowed = deleteAllowed;
+ }
+
+ public boolean isAuthorizeAllowed() {
+ return authorizeAllowed;
+ }
+
+ public void setAuthorizeAllowed(boolean authorizeAllowed) {
+ this.authorizeAllowed = authorizeAllowed;
+ }
+
public Properties getProperties() {
return properties;
}
Modified: trunk/registry/modules/webapps/src/main/webapp/admin/comments.jsp
==============================================================================
--- trunk/registry/modules/webapps/src/main/webapp/admin/comments.jsp
(original)
+++ trunk/registry/modules/webapps/src/main/webapp/admin/comments.jsp Mon Jan
7 00:56:48 2008
@@ -4,7 +4,7 @@
<%@ page import="org.wso2.registry.rest.RestUtil" %>
<%@ page import="org.wso2.registry.RegistryException" %>
<%@ page import="org.wso2.registry.Comment" %>
-<%@ page import="org.wso2.registry.servlet.Utils" %>
+<%@ page import="org.wso2.registry.servlet.utils.Utils" %>
<html>
<head>
<title>WSO2 Registry</title>
@@ -20,7 +20,7 @@
<div id="banner"><img src="/wso2registry/admin/images/logo.gif"
width="320" height="64" /></div>
<%
- Registry registry = Utils.getSecureRegistry(request);
+ Registry registry =
org.wso2.registry.servlet.utils.Utils.getSecureRegistry(request);
String path = (String)
request.getSession().getAttribute(RegistryConstants.PATH);
if (registry != null) {
%>
Modified: trunk/registry/modules/webapps/src/main/webapp/admin/edit_resource.jsp
==============================================================================
--- trunk/registry/modules/webapps/src/main/webapp/admin/edit_resource.jsp
(original)
+++ trunk/registry/modules/webapps/src/main/webapp/admin/edit_resource.jsp
Mon Jan 7 00:56:48 2008
@@ -3,7 +3,7 @@
<%@ page import="org.wso2.registry.RegistryConstants" %>
<%@ page import="org.wso2.registry.rest.RestUtil" %>
<%@ page import="org.wso2.registry.RegistryException" %>
-<%@ page import="org.wso2.registry.servlet.Utils" %>
+<%@ page import="org.wso2.registry.servlet.utils.Utils" %>
<%@ page import="org.wso2.registry.secure.SecureRegistry" %>
<html>
<head>
@@ -39,7 +39,7 @@
<%
String userMessage;
boolean signedIn = false;
- SecureRegistry secureRegistry = Utils.getSecureRegistry(request);
+ SecureRegistry secureRegistry =
org.wso2.registry.servlet.utils.Utils.getSecureRegistry(request);
String currentUser = secureRegistry.getUserID();
if (!currentUser.equals(RegistryConstants.ANONYMOUS_USER)) {
userMessage = "You are signed in as " + currentUser;
Modified:
trunk/registry/modules/webapps/src/main/webapp/admin/registry-resources.jsp
==============================================================================
--- trunk/registry/modules/webapps/src/main/webapp/admin/registry-resources.jsp
(original)
+++ trunk/registry/modules/webapps/src/main/webapp/admin/registry-resources.jsp
Mon Jan 7 00:56:48 2008
@@ -340,7 +340,7 @@
(<%=resourceData.getAverageRating()%>)
</td>
<td>
- <a
href="/wso2registry/system/deleteResource?resourcePath=<%=resourceData.getResourcePath()%>"
title="Delete" style="margin-left:5px;"><img
src="/wso2registry/admin/images/icon-trash.gif" border="0" /></a>
+ <% if (details.isDeleteAllowed()) { %><a
href="/wso2registry/system/deleteResource?resourcePath=<%=resourceData.getResourcePath()%>"
title="Delete" style="margin-left:5px;"><img
src="/wso2registry/admin/images/icon-trash.gif" border="0" /></a> <% } %>
</td>
</tr>
@@ -379,6 +379,7 @@
<!-- Start Permisions -->
<!-- Hear comes the box1 table -->
+<% if (details.isAuthorizeAllowed()) { %>
<div class="box1-head">
<table cellspacing="0" cellpadding="0" border="0" style="width:100%">
<tr>
@@ -415,6 +416,8 @@
</table>
</div>
+<% } %>
+
</td>
<td style="padding-left:10px;" valign="top">
Modified: trunk/registry/modules/webapps/src/main/webapp/admin/tags.jsp
==============================================================================
--- trunk/registry/modules/webapps/src/main/webapp/admin/tags.jsp
(original)
+++ trunk/registry/modules/webapps/src/main/webapp/admin/tags.jsp Mon Jan
7 00:56:48 2008
@@ -1,5 +1,5 @@
<%@ page import="org.wso2.registry.rest.RestUtil" %>
-<%@ page import="org.wso2.registry.servlet.Utils" %>
+<%@ page import="org.wso2.registry.servlet.utils.Utils" %>
<%@ page import="org.wso2.registry.*" %>
<html>
<head>
_______________________________________________
Registry-dev mailing list
[email protected]
http://wso2.org/cgi-bin/mailman/listinfo/registry-dev
