You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lenya.apache.org by an...@apache.org on 2007/08/10 13:10:58 UTC
svn commit: r564551 - in /lenya/trunk/src:
modules-core/usecase/java/src/org/apache/lenya/cms/ac/usecase/impl/UsecaseAuthorizerImpl.java
pubs/default/config/access-control/usecase-policies.xml
Author: andreas
Date: Fri Aug 10 04:10:57 2007
New Revision: 564551
URL: http://svn.apache.org/viewvc?view=rev&rev=564551
Log:
Extend the UsecaseAuthorizerImpl to check the page access. This is done by a ac.visit pseudo-usecase. For more info, see bug 42952. Thanks a lot to Joern Nettingsmeier for the patch (I applied it because it depended on some changes to the role resolving).
Modified:
lenya/trunk/src/modules-core/usecase/java/src/org/apache/lenya/cms/ac/usecase/impl/UsecaseAuthorizerImpl.java
lenya/trunk/src/pubs/default/config/access-control/usecase-policies.xml
Modified: lenya/trunk/src/modules-core/usecase/java/src/org/apache/lenya/cms/ac/usecase/impl/UsecaseAuthorizerImpl.java
URL: http://svn.apache.org/viewvc/lenya/trunk/src/modules-core/usecase/java/src/org/apache/lenya/cms/ac/usecase/impl/UsecaseAuthorizerImpl.java?view=diff&rev=564551&r1=564550&r2=564551
==============================================================================
--- lenya/trunk/src/modules-core/usecase/java/src/org/apache/lenya/cms/ac/usecase/impl/UsecaseAuthorizerImpl.java (original)
+++ lenya/trunk/src/modules-core/usecase/java/src/org/apache/lenya/cms/ac/usecase/impl/UsecaseAuthorizerImpl.java Fri Aug 10 04:10:57 2007
@@ -52,44 +52,48 @@
* Supported parameters via {@link Parameterizable}:
* </p>
* <ul>
- * <li>
- * {@link #PARAMETER_CONFIGURATION} - location of the usecase policies file
- * (parameterizable for testing purposes)
- * </li>
+ * <li> {@link #PARAMETER_CONFIGURATION} - location of the usecase policies file
+ * (parameterizable for testing purposes) </li>
* </ul>
* @version $Id: UsecaseAuthorizer.java 392449 2006-04-07 23:20:38Z michi $
*/
public class UsecaseAuthorizerImpl extends AbstractLogEnabled implements UsecaseAuthorizer,
Serviceable, Disposable, Parameterizable {
+ /**
+ * The name of the pseudo-usecase that governs access to pages.
+ */
+ public static final String VISIT_USECASE = "ac.visit";
+
protected static final String PARAMETER_CONFIGURATION = "configuration";
protected static final String TYPE = "usecase";
protected static final String USECASE_PARAMETER = "lenya.usecase";
- private static final String AC_CONFIGURATION_FILE
- = "config/access-control/access-control.xml".replace('/', File.separatorChar);
+ private static final String AC_CONFIGURATION_FILE = "config/access-control/access-control.xml"
+ .replace('/', File.separatorChar);
private SourceCache cache;
- /**
- * the configuration URI for this component
- */
+ /**
+ * the configuration URI for this component
+ */
private String configurationUri;
private ServiceManager manager;
/**
- * Maps publication IDs to their configuration URIs.
- * This is a persistent map to avoid unnecessary publication lookups.
- * Whenever an authorization request for a new publication is dealt with,
- * the publication's configuration URI is stored, to be re-used on later
- * occasions (for the lifetime of the component).
+ * Maps publication IDs to their configuration URIs. This is a persistent
+ * map to avoid unnecessary publication lookups. Whenever an authorization
+ * request for a new publication is dealt with, the publication's
+ * configuration URI is stored, to be re-used on later occasions (for the
+ * lifetime of the component).
*/
private Map pubId2configUri = new HashMap();
-
/**
- * @see org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer#authorizeUsecase(java.lang.String, org.apache.lenya.ac.Role[], org.apache.lenya.cms.publication.Publication)
+ * @see org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer#authorizeUsecase(java.lang.String,
+ * org.apache.lenya.ac.Role[],
+ * org.apache.lenya.cms.publication.Publication)
*/
public boolean authorizeUsecase(String usecase, Role[] roles, Publication publication)
- throws AccessControlException {
+ throws AccessControlException {
return authorizeUsecase(usecase, roles, getConfigurationURI(publication));
}
@@ -126,8 +130,10 @@
}
/**
- * @see org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer#isPermitted(java.lang.String, org.apache.lenya.cms.publication.Publication, org.apache.lenya.ac.Role)
- */
+ * @see org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer#isPermitted(java.lang.String,
+ * org.apache.lenya.cms.publication.Publication,
+ * org.apache.lenya.ac.Role)
+ */
public boolean isPermitted(String usecase, Publication publication, Role role)
throws AccessControlException {
String configUri = getConfigurationURI(publication);
@@ -137,7 +143,9 @@
}
/**
- * @see org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer#setPermission(java.lang.String, org.apache.lenya.cms.publication.Publication, org.apache.lenya.ac.Role, boolean)
+ * @see org.apache.lenya.cms.ac.usecase.UsecaseAuthorizer#setPermission(java.lang.String,
+ * org.apache.lenya.cms.publication.Publication,
+ * org.apache.lenya.ac.Role, boolean)
*/
public void setPermission(String usecase, Publication publication, Role role, boolean granted)
throws AccessControlException {
@@ -166,31 +174,32 @@
}
/**
+ * This method will substitute VISIT_USECASE if no USECASE_PARAMETER is set,
+ * so that it can be used to authorize plain page access as well.
* @see org.apache.lenya.ac.Authorizer#authorize(org.apache.cocoon.environment.Request)
*/
public boolean authorize(Request request) throws AccessControlException {
String usecase = request.getParameter(USECASE_PARAMETER);
- boolean authorized = true;
-
- try {
- if (usecase != null) {
+ if (usecase == null || "".equals(usecase)) {
+ usecase = VISIT_USECASE;
+ }
- String _configurationUri;
- // Check if the service has been parameterized with a configuration URI. This
- // can be used for testing purposes etc.
- if (getConfigurationURI() != null) {
- _configurationUri = getConfigurationURI();
- } else {
- Publication publication = PublicationUtil.getPublication(this.manager, request);
- _configurationUri = getConfigurationURI(publication);
- }
+ boolean authorized = false;
- Role[] roles = PolicyUtil.getRoles(request);
- authorized = authorizeUsecase(usecase, roles, _configurationUri);
+ try {
+ String _configurationUri;
+ // Check if the service has been parameterized with a
+ // configuration URI. This can be used for testing purposes etc.
+ if (getConfigurationURI() != null) {
+ _configurationUri = getConfigurationURI();
} else {
- getLogger().debug("No usecase to authorize. Granting access.");
+ Publication publication = PublicationUtil.getPublication(this.manager, request);
+ _configurationUri = getConfigurationURI(publication);
}
+
+ Role[] roles = PolicyUtil.getRoles(request);
+ authorized = authorizeUsecase(usecase, roles, _configurationUri);
} catch (final PublicationException e) {
throw new AccessControlException(e);
} catch (final AccessControlException e) {
@@ -235,7 +244,6 @@
}
return configURI;
}
-
protected UsecaseRoles getUsecaseRoles(String _configurationUri) throws AccessControlException {
UsecaseRolesBuilder builder = new UsecaseRolesBuilder();
Modified: lenya/trunk/src/pubs/default/config/access-control/usecase-policies.xml
URL: http://svn.apache.org/viewvc/lenya/trunk/src/pubs/default/config/access-control/usecase-policies.xml?view=diff&rev=564551&r1=564550&r2=564551
==============================================================================
--- lenya/trunk/src/pubs/default/config/access-control/usecase-policies.xml (original)
+++ lenya/trunk/src/pubs/default/config/access-control/usecase-policies.xml Fri Aug 10 04:10:57 2007
@@ -21,6 +21,12 @@
<!--+++NOTE+++ The usecase list was initialized using modules/usecase-impl/xslt/initUsecasePolicies.xsl.-->
<usecases xmlns="http://apache.org/cocoon/lenya/ac/1.0">
+ <usecase id="ac.visit">
+ <role id="visit" method="grant"/>
+ <role id="admin" method="grant"/>
+ <role id="edit" method="grant"/>
+ <role id="review" method="grant"/>
+ </usecase>
<usecase id="ac.logout">
<role id="session" method="grant"/>
</usecase>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@lenya.apache.org
For additional commands, e-mail: commits-help@lenya.apache.org