/src/edu/ucsb/nceas/metacat/AccessControlList.java - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 1424

Added by Jing Tao about 21 years ago

Get rid of the permission code to handle ticket count and duration.

         //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
         //function will assign begin_time=sysdate
         pStmt = conn.prepareStatement(
                     "SELECT permission, ticket_count " +
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
                     "AND perm_type = ? ");
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, ALLOW);
-...
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             ticketCount=rs.getInt(2);
             //permission is ok and ticketcount geat than 0 or ticket is null,
             //permission is ok
             //the user have a permission to access the file
             if ((( permissionValueInTable & permissionValue )== permissionValue )
                   && (rs.wasNull()||ticketCount > 0))
             if (( permissionValueInTable & permissionValue )== permissionValue )
+            {
                //ticket count should minus one
                //ticketCount isnot null and greater than 0, order is allowfirst
                if (!rs.wasNull() && ticketCount>0 && isAllowFirst(principals,docId))
+               {
                   decreaseNumberOfAccess(permissionValueInTable, principals[i],
                                                   docId, ALLOW, ALLOWFIRST);
+                }
                //ticketCount isnot null and greater than 0, order is not allowfirst
                if (!rs.wasNull() &&ticketCount>0 && !isAllowFirst(principals,docId))
+               {
                   decreaseNumberOfAccess(permissionValueInTable, principals[i],
                                                   docId, ALLOW, DENYFIRST);
+               }
                allow=true;//has allow rule entry
              }//if
             }//if
           }//while
         }//for
        }//try
-...
          conn=DBConnectionPool.getDBConnection("AccessControlList.hasExplicitDeny");
          serialNumber=conn.getCheckOutSerialNumber();
         //This sql statement will select entry with
         //begin_time<=currentTime<=end_time in xml_access table
         //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
         //function will assign begin_time=sysdate
         pStmt = conn.prepareStatement(
          pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
                     "AND perm_type = ? ");
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, DENY);
-...
        return false;//no deny rule
       }//hasExplicitDenyRule
        /**
         * Check if the users array has implicit deny rules for given users, docid
         * and permission. That means the though perm_type is "allow" but current
         * time is less than begin_time or greater than end time, or ticket count
         * is 0.
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private static boolean hasImplicitDenyRule(String [] principals, String docId,
                                       String permission)
                       throws SQLException
+     {
        int lengthOfArray=principals.length;
        ResultSet rs;
        PreparedStatement pStmt = null;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        DBConnection conn = null;
        int serialNumber = -1;
        try
+       {
         //check out DBConnection
         conn=DBConnectionPool.getDBConnection("AccessControlList.hasImplicitDeny");
         serialNumber=conn.getCheckOutSerialNumber();
         //This sql statement will select entry with  perm_type =allow and
         //currentTime is less than begin_time or greater than end time
         //in xml_access table. This is an implicit deny rule (allow is out of date)
         pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " < " + isnull + "(begin_time," + sysdate + ") " +
                     "OR " + sysdate + " > "+ isnull + "(end_time," + sysdate + ")");
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, ALLOW);//It is allow
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
           pStmt.execute();
           rs=pStmt.getResultSet();
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             //permission is ok the user doesn't have permission to access the file
             if (( permissionValueInTable & permissionValue )== permissionValue )
+            {
                pStmt.close();
                //has a implicit deny rule: allow is out of date
                return true;
              }//if
           }//while
         }//for
         pStmt.close();
         //Now, there is no implicit deny rule which is allow is out of date
         //another implicit deny rule need to be check: allow is out of ticketCount
         //ticketCount=0
         pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND ticket_count = ?");
         //bind docid, perm_type, ticket_count
         pStmt.setString(1, docId);
         pStmt.setString(3, ALLOW);//It is allow!
         pStmt.setInt(4,0);
         //Because this DBConnection used twice in this method. But we only count one
         //when it checked out. So we should increase another one
         conn.increaseUsageCount(1);
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
           pStmt.execute();
           rs=pStmt.getResultSet();
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             //permission is ok the user doesn't have permission to access the file
             if (( permissionValueInTable & permissionValue )== permissionValue )
+            {
                pStmt.close();
                //has a implicit deny rule: allow is out of ticketCount
                return true;
              }//if
           }//while
         }//for
        }//try
        finally
+       {
          try
+         {
            pStmt.close();
+         }
          finally
+         {
            DBConnectionPool.returnDBConnection(conn, serialNumber);
+         }
        }//finally
         return false;//no implicit deny rule
       }//hasImplicitDenyRule
       /**
         * Creat a users pakages to check permssion rule, user itself, public and
         * the gourps the user belong will be include in this package
-...
           if (isAllowFirst(principals, docId))
+          {
             if (hasExplicitDenyRule(principals, docId, permission)||
                                 hasImplicitDenyRule(principals, docId, permission))
             if (hasExplicitDenyRule(principals, docId, permission))
+            {
               //if it is allowfirst and has deny rule(either explicit or implicit)
               //if it is allowfirst and has deny rule(either explicit )
               //deny access
               return false;
             }//if
-...
       }//hasPermission
       /* Decrease the number of access to @docid for @principal in db. */
       private static void decreaseNumberOfAccess(int permission, String principal,
                                           String docid, String permType,
                                           String permOrder)
                    throws SQLException
+      {
         PreparedStatement pstmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.decreaseNumOfA");
           serialNumber=conn.getCheckOutSerialNumber();
           pstmt = conn.prepareStatement(
                 "UPDATE xml_access SET ticket_count = ticket_count - 1 " +
                 "WHERE docid = ? " +
                 "AND principal_name = ? " +
                 "AND permission = ? " +
                 "AND perm_type = ? " +
                 "AND perm_order = ? " +
                 "AND " + sysdate +
                 " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                      "AND " + isnull + "(end_time," + sysdate + ")");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, principal);
           pstmt.setInt(3, permission);
           pstmt.setString(4, permType);
           pstmt.setString(5, permOrder);
           pstmt.execute();
         }//try
         finally
+        {
           try
+          {
             pstmt.close();
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
+          }
         }//finally
+      }
       /**

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 1424

Added by Jing Tao about 21 years ago