Changeset 33113 for main/trunk

Timestamp:

2019-05-27T22:12:33+12:00 (5 years ago)

Author:

ak19

Message:

Tentative fix to the first of 2 GS3 authentication related bugs identified by Diego Spano on the mailing list, email dated 23/05/(20)19 04:24. Bug 1: when there are multiple meta values for a metadata name, e.g. multiple assigned dc.Creator, authentication doesn't work if the documentSet's match field is set to dc.Creator (of any but the first author). Bug 2: document file access was not protected. Diego described this further as: Access to pdf is totally free, having URL to the file I have no need to provide any credentials. With the fix to the 1st bug in this commit, I was unable to reproduce the 2nd bug, so I'm not sure if the 2nd bug was a side-effect or related to the 1st bug and therefore got fixed by the same fix. I'll be asking Diego to test the nightly binary containing this fix, and if bug 2 still exists, to send me an example coll with the bug and instructions on reproducing it.

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/collection/Collection.java (modified) (7 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/collection/Collection.java

@@ -336 +336 @@
         else
         {
-            logger.warn("Default access for collection " + this.cluster_name + " is neither public or private, assuming public");
+            logger.warn("Default access for collection " + this.cluster_name + " is neither public nor private, assuming public");
         }
 
@@ -371 +371 @@
         else
         {
-            logger.warn("Security scope is neither collection or document, assuming collection");
+            logger.warn("Security scope is neither collection nor document, assuming collection");
         }
 
@@ -636 +636 @@
             }
 
-            String fieldValue = "";
+            //String fieldValue = "";
+            String[] fieldValues = null;
             if (!fieldName.equals("oid"))
             {
-                fieldValue = getFieldValue(oid, fieldName);
-                if (fieldValue == null)
+                //fieldValue = getFieldValue(oid, fieldName);
+                fieldValues = getFieldValues(oid, fieldName);
+                if (fieldValues == null)
                 {
                     return false;
@@ -647 +649 @@
             else
             {
-                fieldValue = oid;
+                //fieldValue = oid;
+                //fieldValues = new String[0]; 
+                //fieldValues[0] = oid;
+                fieldValues = new String[]{oid}; // not allowed to do fieldValues = {oid}; after SEPARATE declaration.
             }
 
@@ -653 +658 @@
             if (type.equals("match"))
             {
+
+                for(int i = 0; i < fieldValues.length; i++) {
+                String fieldValue = fieldValues[i];
                 if (matchValue.equals(fieldValue))
                 {
                     return true;
                 }
+                }
             }
             else if (type.equals("regex"))
             {
+                for(int i = 0; i < fieldValues.length; i++) {
+                String fieldValue = fieldValues[i];
                 if (fieldValue.matches(matchValue))
                 {
                     return true;
                 }
+                }
             }
             else
@@ -674 +686 @@
     }
 
-    protected String getFieldValue(String oid, String fieldName)
+    protected String old_getFieldValue(String oid, String fieldName)
     {
       Document msg_doc = XMLConverter.newDOM();
@@ -708 +720 @@
 
         return null;
+    }
+
+    protected String[] getFieldValues(String oid, String fieldName)
+    {
+      Document msg_doc = XMLConverter.newDOM();
+        Element metadataMessage = msg_doc.createElement(GSXML.MESSAGE_ELEM);
+        Element metadataRequest = GSXML.createBasicRequest(msg_doc, GSXML.REQUEST_TYPE_PROCESS, this.cluster_name + "/DocumentMetadataRetrieve", new UserContext());
+        metadataMessage.appendChild(metadataRequest);
+
+        Element paramList = msg_doc.createElement(GSXML.PARAM_ELEM + GSXML.LIST_MODIFIER);
+        metadataRequest.appendChild(paramList);
+
+        Element param = msg_doc.createElement(GSXML.PARAM_ELEM);
+        paramList.appendChild(param);
+
+        param.setAttribute(GSXML.NAME_ATT, "metadata");
+        param.setAttribute(GSXML.VALUE_ATT, fieldName);
+
+        Element docList = msg_doc.createElement(GSXML.DOC_NODE_ELEM + GSXML.LIST_MODIFIER);
+        metadataRequest.appendChild(docList);
+
+        Element doc = msg_doc.createElement(GSXML.DOC_NODE_ELEM);
+        docList.appendChild(doc);
+
+        doc.setAttribute(GSXML.NODE_ID_ATT, oid);
+
+        Element response = (Element) this.router.process(metadataMessage);
+        NodeList metadataElems = response.getElementsByTagName(GSXML.METADATA_ELEM);
+
+        if (metadataElems.getLength() <= 0) {
+            return null;
+        }
+        // else
+        String[] fieldValues = new String[metadataElems.getLength()];
+        for(int i = 0; i < metadataElems.getLength(); i++)
+        {
+            Element metadata = (Element) metadataElems.item(i);
+            fieldValues[i] = GSXML.getNodeText(metadata);
+        }
+
+        return fieldValues;
+
     }