Changeset 33699

Timestamp:

2019-11-19T13:53:59+13:00 (4 years ago)

Author:

kjdon

Message:

first stab at requiring a user to be logged in to use the depositor, and they must have the correct permissions to access a collection. TODO - for the collection list, only display the collections the user has access to??

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/action/DepositorAction.java (modified) (4 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/action/DepositorAction.java

@@ -25 +25 @@
 import org.greenstone.gsdl3.util.GSXSLT;
 import org.greenstone.gsdl3.util.UserContext;
+import org.greenstone.gsdl3.util.XMLConverter;
 import org.greenstone.util.GlobalProperties;
 import org.w3c.dom.Document;
@@ -50 +51 @@
         Element request = (Element) GSXML.getChildByTagName(message, GSXML.REQUEST_ELEM);
         Document doc = request.getOwnerDocument();
+
+        UserContext uc = new UserContext((Element) request);
         
-        UserContext uc = new UserContext((Element) request);
-        String currentUsername = uc.getUsername();
-
         Element responseMessage = doc.createElement(GSXML.MESSAGE_ELEM);
         Element response = GSXML.createBasicResponse(doc, this.getClass().getSimpleName());
         responseMessage.appendChild(response);
 
+        addSiteMetadata(response, uc);
+        addInterfaceOptions(response);
+
+        // currently uc might have the wrong username.
+        // TODO - fix this once that is fixed
+        Element userInformation = (Element) GSXML.getChildByTagName(request, GSXML.USER_INFORMATION_ELEM);      
+        if (userInformation != null)
+         {
+            String username = userInformation.getAttribute(GSXML.USERNAME_ATT);
+            if (!username.equals("")) {
+              uc.setUsername(username);
+            }
+            String groups = userInformation.getAttribute(GSXML.GROUPS_ATT);
+            if (!groups.equals("")) {
+              uc.setGroups(groups.split(","));
+            }
+         }
+
+        String currentUsername = uc.getUsername();
+        
+        // logger.debug("username="+username+", groups = "+groups);
+        if (currentUsername == null || currentUsername.equals("")) 
+        {
+        
+          // TODO if user is not logged in, push to login page
+          request.setAttribute("subaction", "");
+          GSXML.addError(response, "You need to be logged in to use the depositor");
+          return responseMessage;
+        }
+        
         Element param_list = (Element) GSXML.getChildByTagName(request, GSXML.PARAM_ELEM + GSXML.LIST_MODIFIER);
         HashMap<String, Serializable> params = GSXML.extractParams(param_list, false);
@@ -63 +93 @@
         String collection = (String) params.get(GSParams.COLLECTION);
 
+        if (collection !=null && !collection.equals("")) {
+          if (!userHasCollectionEditPermissions(collection, uc)) {
+            // we need to reset back to empty subaction here            
+            request.setAttribute("subaction", "");
+            logger.error("found collection "+collection+", need to check user groups");
+            GSXML.addError(response, "You are not in the right group to access this collection. Please log in as a different user.");
+          return responseMessage;
+          
+          }
+        }
         int pageNum = -1;
         boolean pageNumParseFail = false;
@@ -393 +433 @@
         return collectionList;
     }
+
+  // collection must be non-null and non-empty
+  protected boolean userHasCollectionEditPermissions(String collection, UserContext user_context) {
+
+    for (String group : user_context.getGroups()) {
+      // administrator always has permission
+      if (group.equals("administrator")) {
+    return true;
+      }
+      // all-collections-editor can edit any collection
+      
+      if (group.equals("all-collections-editor")) {
+    return true;
+      }
+      if (group.equals(collection+"-collection-editor")) {
+      return true;
+      }
+    }
+    
+    // haven't found a group with edit permissions
+    return false;
+    
+  }
 }