Changeset 105:7417f5915181 in AnnotationManagerN4J for src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java

Timestamp:

Feb 10, 2017, 2:45:35 PM (7 years ago)

Author:

casties

Branch:

default

Tags:

tip

Message:

check admin permission before changing permissions.
Enum for typesafe actions.

File:

• src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java (modified) (2 diffs)

src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java

@@ -57 +57 @@
 import de.mpiwg.itgroup.annotations.Actor;
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Annotation.FragmentTypes;
 import de.mpiwg.itgroup.annotations.Group;
@@ -680 +681 @@
          * permissions
          */
-        if (jo.has("permissions")) {
-            JSONObject permissions = jo.getJSONObject("permissions");
-            if (permissions.has("admin")) {
-                JSONArray perms = permissions.getJSONArray("admin");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setAdminPermission(actor);
-            }
-            if (permissions.has("delete")) {
-                JSONArray perms = permissions.getJSONArray("delete");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setDeletePermission(actor);
-            }
-            if (permissions.has("update")) {
-                JSONArray perms = permissions.getJSONArray("update");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setUpdatePermission(actor);
-            }
-            if (permissions.has("read")) {
-                JSONArray perms = permissions.getJSONArray("read");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setReadPermission(actor);
-            }
-        }
+                if (jo.has("permissions")) {
+                        // change permissions only if user has admin permission
+                        if (annot.isActionAllowed(Action.admin, authUser, getAnnotationStore())) {
+                                JSONObject permissions = jo.getJSONObject("permissions");
+                                if (permissions.has("admin")) {
+                                        JSONArray perms = permissions.getJSONArray("admin");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setAdminPermission(actor);
+                                }
+                                if (permissions.has("delete")) {
+                                        JSONArray perms = permissions.getJSONArray("delete");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setDeletePermission(actor);
+                                }
+                                if (permissions.has("update")) {
+                                        JSONArray perms = permissions.getJSONArray("update");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setUpdatePermission(actor);
+                                }
+                                if (permissions.has("read")) {
+                                        JSONArray perms = permissions.getJSONArray("read");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setReadPermission(actor);
+                                }
+                        }
+                }
 
         /*