Changeset 27076 for main

Timestamp:

2013-03-13T14:14:41+13:00 (11 years ago)

Author:

sjm84

Message:

Debug service calls now require the user to be an administrator

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/DebugService.java (modified) (4 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/DebugService.java

@@ -13 +13 @@
 import org.apache.log4j.Logger;
 import org.greenstone.gsdl3.util.GSXML;
+import org.greenstone.gsdl3.util.UserContext;
 import org.greenstone.gsdl3.util.XMLConverter;
 import org.greenstone.util.GlobalProperties;
@@ -82 +83 @@
         }
 
-        String lang = request.getAttribute(GSXML.LANG_ATT);
-        String uid = request.getAttribute(GSXML.USER_ID_ATT);
+        UserContext context = new UserContext(request);
+        boolean found = false;
+        for (String group : context.getGroups())
+        {
+            if (group.equals("administrator"))
+            {
+                found = true;
+            }
+        }
+
+        if (!found)
+        {
+            GSXML.addError(this.doc, result, "This user does not have the required permissions to perform this action.");
+            return result;
+        }
 
         // Get the parameters of the request
@@ -190 +204 @@
         }
 
-        String lang = request.getAttribute(GSXML.LANG_ATT);
-        String uid = request.getAttribute(GSXML.USER_ID_ATT);
+        UserContext context = new UserContext(request);
+        boolean foundGroup = false;
+        for (String group : context.getGroups())
+        {
+            if (group.equals("administrator"))
+            {
+                foundGroup = true;
+            }
+        }
+
+        if (!foundGroup)
+        {
+            GSXML.addError(this.doc, result, "This user does not have the required permissions to perform this action.");
+            return result;
+        }
 
         // Get the parameters of the request
@@ -307 +334 @@
         }
 
-        String lang = request.getAttribute(GSXML.LANG_ATT);
-        String uid = request.getAttribute(GSXML.USER_ID_ATT);
+        UserContext context = new UserContext(request);
+        boolean found = false;
+        for (String group : context.getGroups())
+        {
+            if (group.equals("administrator"))
+            {
+                found = true;
+            }
+        }
+
+        if (!found)
+        {
+            GSXML.addError(this.doc, result, "This user does not have the required permissions to perform this action.");
+            return result;
+        }
 
         // Get the parameters of the request