Skip to content

MCR-3856 Check create-derivate permission on parent object #3191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sebhofmann wants to merge 1 commit into
base: main
Choose a base branch
from
Open

MCR-3856 Check create-derivate permission on parent object #3191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions mycore-base/src/main/java/org/mycore/access/MCRAccessManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ public class MCRAccessManager {

public static final String PERMISSION_DELETE = "deletedb";

public static final String PERMISSION_CREATE_DERIVATE = "create-derivate";

public static final String PERMISSION_PREVIEW = "preview";

public static final String PERMISSION_VIEW = "view";
Expand Down
13 changes: 11 additions & 2 deletions mycore-base/src/main/java/org/mycore/datamodel/metadata/MCRMetadataManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@

package org.mycore.datamodel.metadata;

import static org.mycore.access.MCRAccessManager.PERMISSION_CREATE_DERIVATE;
import static org.mycore.access.MCRAccessManager.PERMISSION_DELETE;
import static org.mycore.access.MCRAccessManager.PERMISSION_WRITE;
import static org.mycore.datamodel.metadata.MCRObjectService.DATE_TYPE_CREATEDATE;
Expand Down Expand Up @@ -125,11 +126,10 @@ private static void recordIDIfTracking(MCRObjectID id) {
* @throws MCRPersistenceException
* if a persistence problem is occurred
* @throws MCRAccessException
* if write permission to object is missing or create permission to derivate is missing
* if write permission or "create-derivate" permission to object is missing
*/
public static void create(final MCRDerivate mcrDerivate) throws MCRPersistenceException, MCRAccessException {
MCRObjectID derivateId = mcrDerivate.getId();
checkCreatePrivilege(derivateId);
throwPersistenceExceptionIfExists(derivateId, MCRDerivate.OBJECT_TYPE);

derivateId = assignNewIdIfNecessary(mcrDerivate);
Expand All @@ -139,6 +139,7 @@ public static void create(final MCRDerivate mcrDerivate) throws MCRPersistenceEx

final MCRObjectID objectId = getObjectIDFromDerivate(mcrDerivate);
checkWritePermission(objectId, derivateId);
checkCreateDerivatePermission(objectId, derivateId);

byte[] objectBackup = retrieveObjectBackup(objectId);

Expand Down Expand Up @@ -184,6 +185,14 @@ private static void checkWritePermission(MCRObjectID objectId, MCRObjectID deriv
}
}

private static void checkCreateDerivatePermission(MCRObjectID objectId, MCRObjectID derivateId)
throws MCRAccessException {
if (!MCRAccessManager.checkPermission(objectId, PERMISSION_CREATE_DERIVATE)) {
throw new MCRMissingPermissionException("Add derivate " + derivateId + " to object.",
objectId.toString(), PERMISSION_CREATE_DERIVATE);
}
}

private static byte[] retrieveObjectBackup(MCRObjectID objectId) throws MCRPersistenceException {
byte[] objectBackup;
try {
Expand Down
4 changes: 4 additions & 0 deletions ...base/src/main/java/org/mycore/frontend/servlets/persistence/MCRCreateDerivateServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@

package org.mycore.frontend.servlets.persistence;

import static org.mycore.access.MCRAccessManager.PERMISSION_CREATE_DERIVATE;
import static org.mycore.access.MCRAccessManager.PERMISSION_WRITE;

import java.io.IOException;
Expand Down Expand Up @@ -48,6 +49,9 @@ void handlePersistenceOperation(HttpServletRequest request, HttpServletResponse
if (!MCRAccessManager.checkPermission(objectID, PERMISSION_WRITE)) {
throw new MCRMissingPermissionException("Add derivate.", objectID, PERMISSION_WRITE);
}
if (!MCRAccessManager.checkPermission(objectID, PERMISSION_CREATE_DERIVATE)) {
throw new MCRMissingPermissionException("Add derivate.", objectID, PERMISSION_CREATE_DERIVATE);
}
}

/**
Expand Down
2 changes: 1 addition & 1 deletion mycore-base/src/main/resources/config/mycore.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ MCR.Access.StorePermissions=read,writedb,deletedb
MCR.Access.AddUserPermissions=read,writewf,deletewf,writedb,deletedb

MCR.Access.Strategy.CreatorAnyStatePermissions=
MCR.Access.Strategy.CreatorPermissions=writedb
MCR.Access.Strategy.CreatorPermissions=writedb,create-derivate
MCR.Access.Strategy.CreatorSubmittedPermissions=%MCR.Access.Strategy.CreatorPermissions%
MCR.Access.Strategy.CreatorReviewPermissions=%MCR.Access.Strategy.CreatorPermissions%
MCR.Access.Cache.Size=200
Expand Down
13 changes: 3 additions & 10 deletions mycore-webtools/src/main/java/org/mycore/webtools/upload/MCRDefaultUploadHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,16 +154,9 @@ private static void checkPermissions(MCRObjectID oid) throws MCRInvalidUploadPar
OBJECT_DOES_NOT_EXIST_TRANSLATION_KEY, true);
}

if (!oid.getTypeId().equals(MCRDerivate.OBJECT_TYPE)) {
try {
String derivateId = MCRObjectID.formatID(oid.getProjectId(), MCRDerivate.OBJECT_TYPE, 0);
MCRObjectID mcrDerivateId = MCRObjectID.getInstance(derivateId);
MCRMetadataManager.checkCreatePrivilege(mcrDerivateId);
} catch (MCRAccessException e) {
MCRUploadForbiddenException uploadForbiddenException = new MCRUploadForbiddenException(e.getMessage());
uploadForbiddenException.initCause(e);
throw uploadForbiddenException;
}
if (!oid.getTypeId().equals(MCRDerivate.OBJECT_TYPE)
&& !MCRAccessManager.checkPermission(oid, MCRAccessManager.PERMISSION_CREATE_DERIVATE)) {
throw new MCRUploadForbiddenException();
}

if (!MCRAccessManager.checkPermission(oid, MCRAccessManager.PERMISSION_WRITE)) {
Expand Down