View Javadoc

    1   package org.apache.turbine.util;
    2
    3
    4   /*
    5    * Licensed to the Apache Software Foundation (ASF) under one
    6    * or more contributor license agreements.  See the NOTICE file
    7    * distributed with this work for additional information
    8    * regarding copyright ownership.  The ASF licenses this file
    9    * to you under the Apache License, Version 2.0 (the
    10   * "License"); you may not use this file except in compliance
    11   * with the License.  You may obtain a copy of the License at
    12   *
    13   *   http://www.apache.org/licenses/LICENSE-2.0
    14   *
    15   * Unless required by applicable law or agreed to in writing,
    16   * software distributed under the License is distributed on an
    17   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    18   * KIND, either express or implied.  See the License for the
    19   * specific language governing permissions and limitations
    20   * under the License.
    21   */
    22
    23
    24  import org.apache.fulcrum.security.SecurityService;
    25  import org.apache.fulcrum.security.entity.Permission;
    26  import org.apache.fulcrum.security.entity.Role;
    27  import org.apache.fulcrum.security.model.turbine.TurbineAccessControlList;
    28  import org.apache.fulcrum.security.model.turbine.TurbineModelManager;
    29  import org.apache.fulcrum.security.util.RoleSet;
    30  import org.apache.fulcrum.security.util.UnknownEntityException;
    31  import org.apache.turbine.services.TurbineServices;
    32
    33  /**
    34   * Utility for doing security checks in Screens and Actions.
    35   *
    36   * Sample usage:<br>
    37   *
    38   * <pre>
    39   * SecurityCheck mycheck =
    40   *   new SecurityCheck(data, "Unauthorized to do this!", "WrongPermission");
    41   * if (!mycheck.hasPermission("add_user");
    42   *   return;
    43   *</pre>
    44   *
    45   * @author <a href="mailto:mbryson@mindspring.com">Dave Bryson</a>
    46   * @author <a href="jh@byteaction.de">J&#252;rgen Hoffmann</a>
    47   * @version $Id: SecurityCheck.java 1819127 2017-12-23 09:32:08Z gk $
    48   */
    49  public class SecurityCheck
    50  {
    51      private String message;
    52
    53      private String failScreen;
    54
    55      private RunData data = null;
    56
    57      private SecurityService securityService = null;
    58
    59      /**
    60       * Holds information if a missing Permission or Role should be created and granted on-the-fly.
    61       * This is good behavior, if these change a lot.
    62       */
    63      private boolean initialize;
    64
    65      /**
    66       * Constructor.
    67       *
    68       * @param data A Turbine RunData object.
    69       * @param message The message to display upon failure.
    70       * @param failedScreen The screen to redirect to upon failure.
    71       */
    72      public SecurityCheck(RunData data,
    73                           String message,
    74                           String failedScreen)
    75      {
    76          this(data, message, failedScreen, false);
    77      }
    78
    79      /**
    80       * Constructor.
    81       *
    82       * @param data
    83       *            A Turbine RunData object.
    84       * @param message
    85       *            The message to display upon failure.
    86       * @param failedScreen
    87       *            The screen to redirect to upon failure.
    88       * @param initialize
    89       *            if a non-existing Permission or Role should be created.
    90       */
    91      public SecurityCheck(RunData data, String message, String failedScreen, boolean initialize)
    92      {
    93          this.data = data;
    94          this.message = message;
    95          this.failScreen = failedScreen;
    96          this.initialize = initialize;
    97          this.securityService = (SecurityService)TurbineServices
    98      		.getInstance()
    99      		.getService(SecurityService.ROLE);
    100     }
    101
    102     /**
    103      * Does the user have this role?
    104      *
    105      * @param role A Role.
    106      * @return True if the user has this role.
    107      * @throws Exception a generic exception.
    108      */
    109     public boolean hasRole(Role role)
    110             throws Exception
    111     {
    112         boolean value = false;
    113         TurbineAccessControlList acl = data.getACL();
    114         if (acl == null ||
    115             !acl.hasRole(role))
    116         {
    117             data.setScreen(failScreen);
    118             data.setMessage(message);
    119         }
    120         else
    121         {
    122             value = true;
    123         }
    124         return value;
    125     }
    126
    127     /**
    128      * Does the user have this role?
    129      *
    130      * @param role
    131      *            A String.
    132      * @return True if the user has this role.
    133      * @throws Exception
    134      *                a generic exception.
    135      */
    136     public boolean hasRole(String role) throws Exception
    137     {
    138         Role roleObject = null;
    139
    140         try
    141         {
    142             roleObject = securityService.getRoleManager().getRoleByName(role);
    143         }
    144         catch (UnknownEntityException e)
    145         {
    146             if(initialize)
    147             {
    148                 roleObject = securityService.getRoleManager().getRoleInstance(role);
    149                 securityService.getRoleManager().addRole(roleObject);
    150                 TurbineModelManager modelManager = (TurbineModelManager)securityService.getModelManager();
    151                 if (data.getUser() == null) {
    152                   throw new UnknownEntityException("user is null");
    153                 }
    154                 modelManager.grant(data.getUser().getUserDelegate(), modelManager.getGlobalGroup(), roleObject);
    155             }
    156             else
    157             {
    158                 throw(e);
    159             }
    160         }
    161
    162         return hasRole(roleObject);
    163     }
    164
    165     /**
    166      * Does the user have this permission?
    167      *
    168      * @param permission A Permission.
    169      * @return True if the user has this permission.
    170      * @throws Exception a generic exception.
    171      */
    172     public boolean hasPermission(Permission permission)
    173             throws Exception
    174     {
    175         boolean value = false;
    176         TurbineAccessControlList acl = data.getACL();
    177         if (acl == null ||
    178             !acl.hasPermission(permission))
    179         {
    180             data.setScreen(failScreen);
    181             data.setMessage(message);
    182         }
    183         else
    184         {
    185             value = true;
    186         }
    187         return value;
    188     }
    189
    190     /**
    191      * Does the user have this permission? If initialize is set to <code>true</code>
    192      * The permission will be created and granted to the first available Role of
    193      * the user, that the SecurityCheck is running against.
    194      *
    195      * If the User has no Roles, the first Role via SecurityService is granted the
    196      * permission.
    197      *
    198      * @param permission
    199      *            A String.
    200      * @return True if the user has this permission.
    201      * @throws Exception
    202      *                a generic exception.
    203      */
    204     public boolean hasPermission(String permission)
    205             throws Exception
    206     {
    207         Permission permissionObject = null;
    208         try
    209         {
    210             permissionObject = securityService.getPermissionManager().getPermissionByName(permission);
    211         }
    212         catch (UnknownEntityException e)
    213         {
    214             if(initialize)
    215             {
    216                 permissionObject = securityService.getPermissionManager().getPermissionInstance(permission);
    217                 securityService.getPermissionManager().addPermission(permissionObject);
    218
    219                 Role role = null;
    220                 TurbineAccessControlList acl = data.getACL();
    221                 RoleSet roles = acl.getRoles();
    222                 if(roles.size() > 0)
    223                 {
    224 					role = roles.toArray(new Role[0])[0];
    225 				}
    226
    227                 if(role == null)
    228                 {
    229                     /*
    230                      * The User within data has no roles yet, let us grant the permission
    231                      * to the first role available through SecurityService.
    232                      */
    233                     roles = securityService.getRoleManager().getAllRoles();
    234                     if(roles.size() > 0)
    235                     {
    236 						role = roles.toArray(new Role[0])[0];
    237 					}
    238                 }
    239
    240                 if(role != null)
    241                 {
    242                     /*
    243                      * If we have no role, there is nothing we can do about it. So only grant it,
    244                      * if we have a role to grant it to.
    245                      */
    246                     TurbineModelManager modelManager = (TurbineModelManager)securityService.getModelManager();
    247                     modelManager.grant(role, permissionObject);
    248                 }
    249             }
    250             else
    251             {
    252                 throw(e);
    253             }
    254         }
    255
    256         return hasPermission(permissionObject);
    257     }
    258
    259     /**
    260      * Get the message that should be displayed.  This is initialized
    261      * in the constructor.
    262      *
    263      * @return A String.
    264      */
    265     public String getMessage()
    266     {
    267         return message;
    268     }
    269
    270     /**
    271      * Get the screen that should be displayed.  This is initialized
    272      * in the constructor.
    273      *
    274      * @return A String.
    275      */
    276     public String getFailScreen()
    277     {
    278         return failScreen;
    279     }
    280 }