/src/edu/ucsb/nceas/metacat/AccessControlList.java - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 1214

Added by Jing Tao about 22 years ago

Merge branch to head.

      * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
      */
     package edu.ucsb.nceas.metacat;
     import java.io.*;
-...
       private static String sysdate = MetaCatUtil.dbAdapter.getDateTimeFunction();
       private static String isnull = MetaCatUtil.dbAdapter.getIsNULLFunction();
       private Connection conn;
       private DBConnection connection;
       private String parserName;
       private Stack elementStack;
       private String server;
-...
+       *
        * @param conn the JDBC connection where acl info is get
        */
       public AccessControlList(Connection conn) throws SQLException
       public AccessControlList(DBConnection conn) throws SQLException
+      {
         this.conn = conn;
         this.connection = conn;
+      }
       /**
        * Construct an instance of the AccessControlList class.
        * It parse acl file and loads acl data into db connection.
-...
        * @param serverCode the serverid from xml_replication on which this document
        *        resides.
        */
       public AccessControlList(Connection conn, String aclid, //Reader acl,
       public AccessControlList(DBConnection conn, String aclid, //Reader acl,
                                String user, String[] groups, int serverCode)
                       throws SAXException, IOException, McdbException
+      {
-...
         this.server = MetaCatUtil.getOption("server");
         this.sep = MetaCatUtil.getOption("accNumSeparator");
         this.conn = conn;
         this.connection = conn;
         this.parserName = parserName;
         this.processingDTD = false;
         this.elementStack = new Stack();
-...
         this.serverCode = serverCode;
         // read the access file from db connection
         DocumentImpl acldoc = new DocumentImpl(conn, aclid);
         DocumentImpl acldoc = new DocumentImpl(aclid);
         String acl = acldoc.toString();
         this.rev = acldoc.getRev();
-...
         // make a DBEntityResolver instance
         // Set the EntityReslover to DBEntityResolver instance
         EntityResolver eresolver = new DBEntityResolver(conn,this,null);
         EntityResolver eresolver = new DBEntityResolver(connection,this,null);
         parser.setEntityResolver((EntityResolver)eresolver);
         // Set the ErrorHandler to this instance
-...
               throws SQLException
+      {
         Vector aclObjects = new Vector();
         // delete all acl records for resources related to @aclid if any
         PreparedStatement pstmt = conn.prepareStatement(
         DBConnection conn = null;
         int serialNumber = -1;
         PreparedStatement pstmt = null;
         try
+        {
           //get connection from DBConnectionPool
           conn=DBConnectionPool.getDBConnection("AccessControlList.getACLObject");
           serialNumber=conn.getCheckOutSerialNumber();
           // delete all acl records for resources related to @aclid if any
           pstmt = conn.prepareStatement(
                                  "SELECT object FROM xml_relation " +
                                  "WHERE subject = ? ");
         pstmt.setString(1,aclid);
         pstmt.execute();
         ResultSet rs = pstmt.getResultSet();
         boolean hasRows = rs.next();
         while (hasRows) {
           aclObjects.addElement(rs.getString(1));
           hasRows = rs.next();
           pstmt.setString(1,aclid);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRows = rs.next();
           while (hasRows) {
             aclObjects.addElement(rs.getString(1));
             hasRows = rs.next();
           }//whil
+        }
         catch (SQLException e)
+        {
           throw e;
+        }
         finally
+        {
           try
+          {
             pstmt.close();
+          }
           finally
+          {
             //retrun DBConnection
             DBConnectionPool.returnDBConnection(conn,serialNumber);
+          }
+        }
         pstmt.close();
         return aclObjects;
+      }
-...
       private void deletePermissionsForRelatedResources(String aclid)
               throws SQLException
+      {
         // delete all acl records for resources related to @aclid if any
         Statement stmt = conn.createStatement();
         stmt.execute("DELETE FROM xml_access WHERE accessfileid = '" + aclid + "'");
         stmt.close();
         //DBConnection conn = null;
         //int serialNumber = -1;
         Statement stmt = null;
         try
+        {
           //check out DBConenction
           //conn=DBConnectionPool.getDBConnection("AccessControlList.deltePerm");
           //serialNumber=conn.getCheckOutSerialNumber();
           // delete all acl records for resources related to @aclid if any
           stmt = connection.createStatement();
           // Increase DBConnection usage count
           connection.increaseUsageCount(1);
           stmt.execute("DELETE FROM xml_access WHERE accessfileid = '" + aclid
                                                                           + "'");
           //increase usageCount!!!!!!
           //conn.increaseUsageCount(1);
+        }
         catch (SQLException e)
+        {
           throw e;
+        }
         finally
+        {
           stmt.close();
           //retrun DBConnection
           //DBConnectionPool.returnDBConnection(conn,serialNumber);
+        }
+      }
       /* Insert into db calculated permission for the list of principals */
       /* Insert into db calculated permission for the list of principals
        * The DBConnection it is use is class field. Because we want to keep rollback
        * features and it need use same connection
       */
       private void insertPermissions(String docid, String permType )
               throws SQLException
                                                 throws SQLException
+      {
         PreparedStatement pstmt;
         PreparedStatement pstmt = null;
         //DBConnection conn = null;
         //int serialNumber = -1;
         try {
           pstmt = conn.prepareStatement(
           //Check out DBConnection
           //conn=DBConnectionPool.getDBConnection("AccessControlList.insertPerm");
           //serialNumber=conn.getCheckOutSerialNumber();
           pstmt = connection.prepareStatement(
                   "INSERT INTO xml_access " +
                   "(docid, principal_name, permission, perm_type, perm_order," +
                   "begin_time,end_time,ticket_count, accessfileid) VALUES " +
                   "(?,?,?,?,?,to_date(?,'mm/dd/yy'),to_date(?,'mm/dd/yy'),?,?)");
           // Increase DBConnection usage count
           connection.increaseUsageCount(1);
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setInt(3, permission);
-...
           } else {
             pstmt.setString(8, null);
+          }
           //incrase usagecount for DBConnection
           //conn.increaseUsageCount(1);
           String prName;
           for ( int j = 0; j < principal.size(); j++ ) {
             prName = (String)principal.elementAt(j);
-...
           throw new
           SQLException("AccessControlList.insertPermissions(): " + e.getMessage());
+        }
         finally
+        {
           pstmt.close();
           //return the DBConnection
           //DBConnectionPool.returnDBConnection(conn, serialNumber);
+        }
+      }
       /* Get permissions with permission order different than @permOrder. */
-...
                                  String docid, String permOrder)
               throws SQLException
+      {
         PreparedStatement pstmt;
         pstmt = conn.prepareStatement(
         PreparedStatement pstmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.getPermissions");
           serialNumber=conn.getCheckOutSerialNumber();
           pstmt = conn.prepareStatement(
                 "SELECT permission FROM xml_access " +
                 "WHERE docid = ? " +
                 "AND principal_name = ? " +
                 "AND perm_order NOT = ?");
         pstmt.setString(1, docid);
         pstmt.setString(2, principal);
         pstmt.setString(3, permOrder);
         pstmt.execute();
         ResultSet rs = pstmt.getResultSet();
         boolean hasRow = rs.next();
         int perm = 0;
         while ( hasRow ) {
           perm = rs.getInt(1);
           perm = permission & perm;
           if ( perm != 0 ) {
           pstmt.setString(1, docid);
           pstmt.setString(2, principal);
           pstmt.setString(3, permOrder);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           int perm = 0;
           while ( hasRow ) {
             perm = rs.getInt(1);
             perm = permission & perm;
             if ( perm != 0 ) {
               pstmt.close();
               return perm;
+            }
             hasRow = rs.next();
+          }
         }//try
         catch (SQLException e)
+        {
           throw e;
+        }
         finally
+        {
           try
+          {
             pstmt.close();
             return perm;
+          }
           hasRow = rs.next();
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
+        }
         pstmt.close();
         return 0;
+      }
       /* Get the int value of READ, WRITE or ALL. */
       private int intValue ( String permission )
       private static int intValue ( String permission )
+      {
         if ( permission.equals("READ") ) {
           return READ;
-...
         * has "all" permission to access it.
         * @param docId, the document id need to be checked
         */
         private boolean isAccessDocument(String docId) throws SQLException
         private static boolean isAccessDocument(String docId) throws SQLException
+        {
           //detele the rev number if docid contains it
           docId=MetaCatUtil.getDocIdFromString(docId);
           PreparedStatement pStmt=null;
           DBConnection conn = null;
           int serialNumber = -1;
           try
+          {
             //check out DBConnection
             conn=DBConnectionPool.getDBConnection("AccessControlList.isAccessDoc");
             serialNumber=conn.getCheckOutSerialNumber();
             pStmt = conn.prepareStatement("select 'x' from xml_access where " +
                                           "accessfileid like '" + docId +  "'");
             pStmt.execute();
-...
+          }
           catch(SQLException e)
+          {
             pStmt.close();
             throw new SQLException("AccessControlList.hasPermission():2 " +
                          "Error checking ownership for " + principal +
                          " on document #" + docId + ". " + e.getMessage());
             throw new SQLException("AccessControlList.isAccessDocument " +
                          "Error checking" +
                          " on document " + docId + ". " + e.getMessage());
+          }
           finally
+          {
             try
+            {
                pStmt.close();
+            }
             finally
+            {
               DBConnectionPool.returnDBConnection(conn, serialNumber);
+            }
+          }
           return false;
         }//isAccessDocument
-...
         * public.
         * @param docid, the id of given documents
         */
       private boolean containDocumentOwner( String [] principals, String docId)
       private static boolean containDocumentOwner( String [] principals,
                                                                   String docId)
                         throws SQLException
+      {
         int lengthOfArray=principals.length;
         boolean hasRow;
         PreparedStatement pStmt=null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
          conn=DBConnectionPool.getDBConnection("AccessControlList.containDocOnwer");
           serialNumber=conn.getCheckOutSerialNumber();
           pStmt = conn.prepareStatement(
                     "SELECT 'x' FROM xml_documents " +
                     "WHERE docid = ? AND user_owner = ?");
-...
                          "Error checking ownership for " + principals[0] +
                          " on document #" + docId + ". " + e.getMessage());
         }//catch
         pStmt.close();
         finally
+        {
           try
+          {
             pStmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
+        }
         return false;
       }//containDocumentOwner
-...
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         */
       private boolean isAllowFirst(String [] principals, String docId)
       private static boolean isAllowFirst(String [] principals, String docId)
                       throws SQLException, Exception
+      {
         int lengthOfArray=principals.length;
         boolean hasRow;
         PreparedStatement pStmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.isAllowFirst");
           serialNumber=conn.getCheckOutSerialNumber();
         //select permission order from database
         PreparedStatement pStmt = conn.prepareStatement(
           //select permission order from database
           pStmt = conn.prepareStatement(
                     "SELECT perm_order FROM xml_access " +
                     "WHERE principal_name= ? AND docid = ?");
        //check every name in the array
         for (int i=0; i<lengthOfArray;i++)
           //check every name in the array
           for (int i=0; i<lengthOfArray;i++)
+          {
             //bind value
             pStmt.setString(1, principals[i]);//user name
             pStmt.setString(2, docId);//docid
             pStmt.execute();
             ResultSet rs = pStmt.getResultSet();
             hasRow=rs.next();
             if (hasRow)
+            {
               //get the permission order from data base
               String permissionOrder=rs.getString(1);
               //if the permission order is "allowFirst
               if (permissionOrder.equalsIgnoreCase(ALLOWFIRST))
+              {
                 pStmt.close();
                 return true;
+              }
               else
+              {
                 pStmt.close();
                 return false;
+              }
             }//if
           }//for
         }//try
         catch (SQLException e)
+        {
           //bind value
           pStmt.setString(1, principals[i]);//user name
           pStmt.setString(2, docId);//docid
           pStmt.execute();
           ResultSet rs = pStmt.getResultSet();
           hasRow=rs.next();
           if (hasRow)
           throw e;
+        }
         finally
+        {
           try
+          {
             //get the permission order from data base
             String permissionOrder=rs.getString(1);
             //if the permission order is "allowFirst
             if (permissionOrder.equalsIgnoreCase(ALLOWFIRST))
+            {
               pStmt.close();
               return true;
+            }
             else
+            {
               pStmt.close();
               return false;
+            }
           }//if
         }//for
             pStmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
+        }
         //if reach here, means there is no permssion record for given names and
         //docid. So throw a exception.
         pStmt.close();
         throw new Exception("There is no permission record for user"+principals[0]+
                             "at document "+docId);
-...
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasAllowRule(String [] principals, String docId,
       private static boolean hasAllowRule(String [] principals, String docId,
                                       String permission)
                       throws SQLException, Exception
+     {
        int lengthOfArray=principals.length;
        boolean allow=false;//initial value is no allow rule
        ResultSet rs;
        PreparedStatement pStmt;
        PreparedStatement pStmt = null;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        int ticketCount;
        //This sql statement will select entry with
        //begin_time<=currentTime<=end_time in xml_access table
        //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
        //function will assign begin_time=sysdate
        pStmt = conn.prepareStatement(
        DBConnection conn = null;
        int serialNumber = -1;
        try
+       {
          //check out DBConnection
          conn=DBConnectionPool.getDBConnection("AccessControlList.hasAllowRule");
          serialNumber=conn.getCheckOutSerialNumber();
         //This sql statement will select entry with
         //begin_time<=currentTime<=end_time in xml_access table
         //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
         //function will assign begin_time=sysdate
         pStmt = conn.prepareStatement(
                     "SELECT permission, ticket_count " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
-...
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
        //bind docid, perm_type
        pStmt.setString(1, docId);
        pStmt.setString(3, ALLOW);
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, ALLOW);
        //bind every elenment in user name array
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
-...
              }//if
           }//while
         }//for
         pStmt.close();
        }//try
        catch (SQLException sqlE)
+       {
          throw sqlE;
+       }
        catch (Exception e)
+       {
          throw e;
+       }
        finally
+       {
          try
+         {
            pStmt.close();
+         }
          finally
+         {
            DBConnectionPool.returnDBConnection(conn, serialNumber);
+         }
+       }
         return allow;
      }//hasAllowRule
       /**
         * Check if the users array has allow rules for given users, docid and
         * permission.
         * If it has permission rule and ticket count is greater than 0, the ticket
         * number will decrease one
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasAllowRuleBackup(String [] principals, String docId,
                                       String permission)
                       throws SQLException, Exception
+     {
        int lengthOfArray=principals.length;
        ResultSet rs;
        PreparedStatement pStmt;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        int ticketCount;
        //This sql statement will select entry with
        //begin_time<=currentTime<=end_time in xml_access table
        //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
        //function will assign begin_time=sysdate
        pStmt = conn.prepareStatement(
                     "SELECT permission, ticket_count " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
        //bind docid, perm_type
        pStmt.setString(1, docId);
        pStmt.setString(3, ALLOW);
        //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
           pStmt.execute();
           rs=pStmt.getResultSet();
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             ticketCount=rs.getInt(2);
             //permission is ok and ticketcount geat than 0 or ticket is null,
             //the user have a permission to access the file
             if ((( permissionValueInTable & permissionValue )== permissionValue )
                   && (rs.wasNull()||ticketCount > 0))
+            {
                //ticket count should minus one
                //ticketCount isnot null and greater than 0, order is allowfirst
                if (!rs.wasNull() && ticketCount>0 && isAllowFirst(principals,docId))
+               {
                   decreaseNumberOfAccess(permissionValueInTable, principals[i],
                                                   docId, ALLOW, ALLOWFIRST);
+                }
                //ticketCount isnot null and greater than 0, order is not allowfirst
                if (!rs.wasNull() &&ticketCount>0 && !isAllowFirst(principals,docId))
+               {
                   decreaseNumberOfAccess(permissionValueInTable, principals[i],
                                                   docId, ALLOW, DENYFIRST);
+               }
                pStmt.close();
                return true;
              }//if
           }//while
         }//for
         pStmt.close();
         return false;//no allow rule
      }//hasAllowRule
        /**
         * Check if the users array has explicit deny rules for given users, docid
         * and permission. That means the perm_type is deny and current time is
-...
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasExplicitDenyRule(String [] principals, String docId,
       private static boolean hasExplicitDenyRule(String [] principals, String docId,
                                       String permission)
                       throws SQLException
+     {
        int lengthOfArray=principals.length;
        ResultSet rs;
        PreparedStatement pStmt;
        PreparedStatement pStmt = null;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        DBConnection conn = null;
        int serialNumber = -1;
        //This sql statement will select entry with
        //begin_time<=currentTime<=end_time in xml_access table
        //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
        //function will assign begin_time=sysdate
        pStmt = conn.prepareStatement(
        try
+       {
          //check out DBConnection
          conn=DBConnectionPool.getDBConnection("AccessControlList.hasExplicitDeny");
          serialNumber=conn.getCheckOutSerialNumber();
         //This sql statement will select entry with
         //begin_time<=currentTime<=end_time in xml_access table
         //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
         //function will assign begin_time=sysdate
         pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
-...
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
        //bind docid, perm_type
        pStmt.setString(1, docId);
        pStmt.setString(3, DENY);
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, DENY);
        //bind every elenment in user name array
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
-...
              }//if
           }//while
         }//for
         pStmt.close();
         return false;//no deny rule
        }//try
        catch (SQLException e)
+       {
          throw e;
        }//catch
        finally
+       {
          try
+         {
            pStmt.close();
+         }
          finally
+         {
            DBConnectionPool.returnDBConnection(conn, serialNumber);
+         }
        }//finally
        return false;//no deny rule
       }//hasExplicitDenyRule
        /**
-...
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasImplicitDenyRule(String [] principals, String docId,
       private static boolean hasImplicitDenyRule(String [] principals, String docId,
                                       String permission)
                       throws SQLException
+     {
        int lengthOfArray=principals.length;
        ResultSet rs;
        PreparedStatement pStmt;
        PreparedStatement pStmt = null;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        DBConnection conn = null;
        int serialNumber = -1;
        //This sql statement will select entry with  perm_type =allow and
        //currentTime is less than begin_time or greater than end time
        //in xml_access table. This is an implicit deny rule (allow is out of date)
        pStmt = conn.prepareStatement(
        try
+       {
         //check out DBConnection
         conn=DBConnectionPool.getDBConnection("AccessControlList.hasImplicitDeny");
         serialNumber=conn.getCheckOutSerialNumber();
         //This sql statement will select entry with  perm_type =allow and
         //currentTime is less than begin_time or greater than end time
         //in xml_access table. This is an implicit deny rule (allow is out of date)
         pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
-...
                     "AND " + sysdate +
                     " < " + isnull + "(begin_time," + sysdate + ") " +
                     "OR " + sysdate + " > "+ isnull + "(end_time," + sysdate + ")");
        //bind docid, perm_type
        pStmt.setString(1, docId);
        pStmt.setString(3, ALLOW);//It is allow
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, ALLOW);//It is allow
        //bind every elenment in user name array
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
-...
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND ticket_count = ?");
        //bind docid, perm_type, ticket_count
        pStmt.setString(1, docId);
        pStmt.setString(3, ALLOW);//It is allow!
        pStmt.setInt(4,0);
        //bind every elenment in user name array
         //bind docid, perm_type, ticket_count
         pStmt.setString(1, docId);
         pStmt.setString(3, ALLOW);//It is allow!
         pStmt.setInt(4,0);
         //Because this DBConnection used twice in this method. But we only count one
         //when it checked out. So we should increase another one
         conn.increaseUsageCount(1);
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
-...
              }//if
           }//while
         }//for
         pStmt.close();
        }//try
        finally
+       {
          try
+         {
            pStmt.close();
+         }
          finally
+         {
            DBConnectionPool.returnDBConnection(conn, serialNumber);
+         }
        }//finally
         return false;//no implicit deny rule
       }//hasImplicitDenyRule
-...
         * @param user, the name of user
         * @param groups, the string array of the groups that user belong to
         */
       private String [] createUsersPackage(String user, String [] groups)
       private static String [] createUsersPackage(String user, String [] groups)
+      {
         String [] usersPackage=null;
         int lengthOfPackage;
-...
         * This method will return a data set id for given access id.
         * @param accessDocId, the accessDocId which need to be found data set id
        */
       private String getDataSetId(String accessDocId)
       private static String getDataSetId(String accessDocId)
                                   throws SQLException
+      {
         String dataSetId=null;
         PreparedStatement pStmt;
         PreparedStatement pStmt=null;
         ResultSet rs=null;
         DBConnection conn=null;
         int serialNumber=-1;
         String query="SELECT docId from xml_relation where subject = ? or "
                                                     +"object = ?";
         pStmt=conn.prepareStatement(query);
         //bind the value to query
         pStmt.setString(1, accessDocId);
         pStmt.setString(2, accessDocId);
         //execute the query
         pStmt.execute();
         rs=pStmt.getResultSet();
         //process the result
         if (rs.next()) //There are some records for the data set id for access id
         try
+        {
           dataSetId=rs.getString(1);
+        }
         else //No data set id for the given access id in xml_relation table
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.getDataSetId");
           serialNumber=conn.getCheckOutSerialNumber();
           pStmt=conn.prepareStatement(query);
           //bind the value to query
           pStmt.setString(1, accessDocId);
           pStmt.setString(2, accessDocId);
           //execute the query
           pStmt.execute();
           rs=pStmt.getResultSet();
           //process the result
           if (rs.next()) //There are some records for the data set id for access id
+          {
             dataSetId=rs.getString(1);
+          }
           else //No data set id for the given access id in xml_relation table
+          {
             dataSetId=null;
+          }
         }//try
         finally
+        {
           dataSetId=null;
           try
+          {
             pStmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
+        }
         pStmt.close();
         return dataSetId;
       }//getDataPackageId()
-...
         * @param principals list of names of principals to check for @permission
         * @param docid document identifier to check on
         */
       public boolean hasPermission(String permission, String user,
       public static boolean hasPermission(String permission, String user,
                                    String[] groups, String docId )
                      throws SQLException, Exception
+      {
-...
         * @param docid, document identifier to check on
         * @param permission, permission (write or all...) to check for
         */
       private boolean hasPermission(String [] principals, String docId,
       private static boolean hasPermission(String [] principals, String docId,
                                                 String permission)
                              throws SQLException
+      {
-...
         return false;
       }//hasPermission
       private boolean hasValidDenyEntry(String persmission, String principal,
                                           String docId)
                       throws SQLException
+      {
       //detele the rev number if docid contains it
           docId=MetaCatUtil.getDocIdFromString(docId);
           PreparedStatement pStmt;
           String permissionType;
           int accessValue;
           try
+          {
             pStmt = conn.prepareStatement("select perm_type, permission, begin_time"
                                         + ", end_time from xml_access where " +
                                           "docid like '" + docId +  "' and "
                                         + "principal_name like '"+principal+"'");
             pStmt.execute();
             ResultSet rs = pStmt.getResultSet();
             boolean hasRow = rs.next();
             pStmt.close();
             if(hasRow)
+            {
               return true;
+            }
+          }
           catch(SQLException e)
+          {
             throw new SQLException("AccessControlList.hasPermission():2 " +
                          "Error checking ownership for " + principal +
                          " on document #" + docId + ". " + e.getMessage());
+          }
           return false;
+      }
       /* Decrease the number of access to @docid for @principal in db. */
       private void decreaseNumberOfAccess(int permission, String principal,
       private static void decreaseNumberOfAccess(int permission, String principal,
                                           String docid, String permType,
                                           String permOrder)
                    throws SQLException
+      {
         PreparedStatement pstmt;
         pstmt = conn.prepareStatement(
         PreparedStatement pstmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.decreaseNumOfA");
           serialNumber=conn.getCheckOutSerialNumber();
           pstmt = conn.prepareStatement(
                 "UPDATE xml_access SET ticket_count = ticket_count - 1 " +
                 "WHERE docid = ? " +
                 "AND principal_name = ? " +
-...
                 "AND " + sysdate +
                 " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                      "AND " + isnull + "(end_time," + sysdate + ")");
         // Bind the values to the query
         pstmt.setString(1, docid);
         pstmt.setString(2, principal);
         pstmt.setInt(3, permission);
         pstmt.setString(4, permType);
         pstmt.setString(5, permOrder);
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, principal);
           pstmt.setInt(3, permission);
           pstmt.setString(4, permType);
           pstmt.setString(5, permOrder);
         pstmt.execute();
         pstmt.close();
           pstmt.execute();
         }//try
         finally
+        {
           try
+          {
             pstmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
         }//finally
+      }
-...
         String end_prev = "";
         int ticketCount = -1;
         int ticket_prev = -1;
         DBConnection conn = null;
         int serialNumber = -1;
         PreparedStatement pstmt = null;
         try {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.getACL");
           serialNumber=conn.getCheckOutSerialNumber();
           isOwned = isOwned(docid, user);
           systemID = getSystemID((String)MetaCatUtil.
                                           getOptionList(accDoctype).elementAt(0));
-...
                         systemID + "\">\n");
           output.append("<acl authSystem=\"\">\n");
           PreparedStatement pstmt;
           pstmt = conn.prepareStatement(
                   "SELECT distinct accessfileid, principal_name, permission, " +
                   "perm_type, perm_order, to_char(begin_time,'mm/dd/yyyy'), " +
-...
           throw new
           SQLException("AccessControlList.getACL(). " + e.getMessage());
+        }
         finally
+        {
           try
+          {
             pstmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
+        }
+      }
       /* Check if @user is owner of @docid from db conn. */
       private boolean isOwned(String docid, String user) throws SQLException {
         PreparedStatement pstmt;
         pstmt = conn.prepareStatement("SELECT 'x' FROM xml_documents " +
         PreparedStatement pstmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.isOwned");
           serialNumber=conn.getCheckOutSerialNumber();
           pstmt = conn.prepareStatement("SELECT 'x' FROM xml_documents " +
                                       "WHERE docid = ? " +
                                       "AND user_owner = ?");
         pstmt.setString(1, docid);
         pstmt.setString(2, user);
         pstmt.execute();
         ResultSet rs = pstmt.getResultSet();
         boolean hasRow = rs.next();
         return hasRow;
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           return hasRow;
+        }
         finally
+        {
           try
+          {
             pstmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
+        }
+      }
       /* Get the flag for public "read" access for @docid from db conn. */
       private String getPublicAccess(String docid) throws SQLException {
         int publicAcc = 0;
         PreparedStatement pstmt;
         pstmt = conn.prepareStatement("SELECT public_access FROM xml_documents " +
         PreparedStatement pstmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.getPublicAcces");
           serialNumber=conn.getCheckOutSerialNumber();
           pstmt = conn.prepareStatement("SELECT public_access FROM xml_documents " +
                                       "WHERE docid = ?");
         pstmt.setString(1, docid);
         pstmt.execute();
         ResultSet rs = pstmt.getResultSet();
         boolean hasRow = rs.next();
         if ( hasRow ) {
           publicAcc = rs.getInt(1);
           pstmt.setString(1, docid);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           if ( hasRow ) {
             publicAcc = rs.getInt(1);
+          }
           return (publicAcc == 1) ? "yes" : "no";
+        }
         return (publicAcc == 1) ? "yes" : "no";
         finally
+        {
           try
+          {
             pstmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
+        }
+      }
       /* Get SystemID for @publicID from Metacat DB Catalog. */
       private String getSystemID(String publicID) throws SQLException {
         String systemID = "";
         PreparedStatement pstmt;
         pstmt = conn.prepareStatement("SELECT system_id FROM xml_catalog " +
         PreparedStatement pstmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.getSystemID");
           serialNumber=conn.getCheckOutSerialNumber();
           pstmt = conn.prepareStatement("SELECT system_id FROM xml_catalog " +
                                       "WHERE entry_type = 'DTD' " +
                                       "AND public_id = ?");
         pstmt.setString(1, publicID);
         pstmt.execute();
         ResultSet rs = pstmt.getResultSet();
         boolean hasRow = rs.next();
         if ( hasRow ) {
           systemID = rs.getString(1);
+        }
           pstmt.setString(1, publicID);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           if ( hasRow ) {
             systemID = rs.getString(1);
+          }
         return systemID;
           return systemID;
         }//try
         finally
+        {
           try
+          {
             pstmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
         }//finally
+      }
+    }

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 1214

Added by Jing Tao about 22 years ago