/ - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 1434

Added by Jing Tao over 21 years ago

Add the code to handle subtree access control.

     package edu.ucsb.nceas.metacat;
     import java.sql.*;
     import java.util.Hashtable;
     import java.util.Stack;
     import java.util.Vector;
-...
         * Constructor for PermissionController
         * @param myDocid      the docid need to access
         */
        public PermissionController(String myDocid) throws SQLException
        public PermissionController(String myDocid) throws McdbException
+       {
          // Get rid of rev number
          docId = MetaCatUtil.getDocIdFromString(myDocid);
-...
         * if has, store the subtree into list and return true. Otherwise,
         * return false
         */
       private boolean checkSubTreeAccessControl() throws SQLException
       private boolean checkSubTreeAccessControl() throws McdbException
+      {
         boolean flag = false;
         PreparedStatement pStmt=null;
-...
+             }
+          }
         }//try
         catch (SQLException e)
+        {
           throw new McdbException(e);
+        }
         finally
+        {
           try
+          {
             pStmt.close();
+          }
           catch(SQLException ee)
+          {
             throw new McdbException(ee);
+          }
           finally
+          {
             DBConnectionPool.returnDBConnection(conn, serialNumber);
-...
         * @param user  the user name
         * @param groups  the groups which the use is in
         * @param myPermission  permission type to check for
         * @param principals list of names of principals to check for @permission
         */
       public boolean hasPermission(String user, String[]groups, String myPermission)
                                   throws SQLException, Exception
-...
         boolean hasPermission=false;
         String [] userPackage=null;
         int permission =AccessControlList.intValue(myPermission);
         //for the commnad line invocation
         if ((user==null) && (groups==null || groups.length==0))
+        {
-...
                                                int permission)
                              throws SQLException
+      {
         String subTreeId = null;// this is for top level, so subtree id is null
         try
+        {
           //first, if there is a docid owner in user package, return true
-...
           //If there is no owner in user package, checking the table
           //check perm_order
           if (isAllowFirst(principals, docId))
           if (isAllowFirst(principals, docId, subTreeId))
+          {
             if (hasExplicitDenyRule(principals, docId, permission))
             if (hasExplicitDenyRule(principals, docId, permission, subTreeId))
+            {
               //if it is allowfirst and has deny rule(either explicit )
               //deny access
               return false;
             }//if
             else if ( hasAllowRule(principals, docId, permission))
             else if ( hasAllowRule(principals, docId, permission, subTreeId))
+            {
               //if it is allowfirst and hasn't deny rule and has allow rule
               //allow access
-...
          }//if isAllowFirst
          else //denyFirst
+         {
            if (hasAllowRule(principals, docId, permission))
            if (hasAllowRule(principals, docId, permission, subTreeId))
+           {
              //if it is denyFirst and has allow rule, allow access
              return true;
-...
       }//hasPermission
       /**
        * This method will return a hasTable of subtree which user doesn't has the
        * permssion to access
        * @param user  the user name
        * @param groups  the groups which the use is in
        * @param myPermission  permission type to check for
        */
       public Hashtable hasUnaccessableSubTree(String user, String[] groups,
                                            String myPermission) throws McdbException
+      {
         Hashtable resultUnaccessableSubTree = new Hashtable();
         String [] principals=null;
         int permission =AccessControlList.intValue(myPermission);
         //for the commnad line invocation return null(no unaccessable subtree)
         if ((user==null) && (groups==null || groups.length==0))
+        {
           return resultUnaccessableSubTree;
+        }
         //create a userpackage including user, public and group member
         principals=createUsersPackage(user, groups);
         //for the document owner return null(no unaccessable subtree)
         try
+        {
           if (containDocumentOwner(principals, docId))
+          {
            return resultUnaccessableSubTree;
+          }
+        }
         catch (SQLException ee)
+        {
           throw new McdbException(ee);
+        }
         // go through every subtree which has access control
         for (int i = 0; i< subTreeList.size(); i++)
+        {
           SubTree tree = (SubTree)subTreeList.elementAt(i);
           String subTreeId = (String)(tree.getSubTreeId());
           if (subTreeId != null)
+          {
             try
+            {
               if (isAllowFirst(principals, docId, subTreeId))
+              {
                 if (hasExplicitDenyRule(principals, docId, permission, subTreeId))
+                {
                  //if it is allowfirst and has deny rule
                   // put the subtree into unaccessable vector
                   if (!resultUnaccessableSubTree.containsKey(subTreeId))
+                  {
                     resultUnaccessableSubTree.put(subTreeId, tree);
+                  }
                 }//if
                 else if ( hasAllowRule(principals, docId, permission, subTreeId))
+                {
                   //if it is allowfirst and hasn't deny rule and has allow rule
                   //allow access do nothing
                 }//else if
                 else
+                {
                   //other situation deny access
                   if (!resultUnaccessableSubTree.containsKey(subTreeId))
+                  {
                     resultUnaccessableSubTree.put(subTreeId, tree);
+                  }
                 }//else
               }//if isAllowFirst
               else //denyFirst
+              {
                 if (hasAllowRule(principals, docId, permission,subTreeId))
+                {
                   //if it is denyFirst and has allow rule, allow access, do nothing
+                }
                 else
+                {
                   //if it is denyfirst but no allow rule, deny access
                   // add into vector
                   if (!resultUnaccessableSubTree.containsKey(subTreeId))
+                  {
                     resultUnaccessableSubTree.put(subTreeId, tree);
+                  }
+                }
               }//else denyfirst
             }//try
             catch( Exception e)
+            {
               MetaCatUtil.debugMessage("error in PermissionControl.has" +
                                        "UnaccessableSubTree "+e.getMessage(), 30);
               throw new McdbException(e);
+            }
           }//if
         }//for
         return resultUnaccessableSubTree;
       }//hasUnaccessableSubtree
       /**
         * Check if a document id is a access document. Access document need user
         * has "all" permission to access it.
         * @param docId, the document id need to be checked
-...
           try
+          {
             //check out DBConnection
             conn=DBConnectionPool.getDBConnection("AccessControlList.isAccessDoc");
             conn=DBConnectionPool.getDBConnection("PermissionControl.isAccessDoc");
             serialNumber=conn.getCheckOutSerialNumber();
             pStmt = conn.prepareStatement("select 'x' from xml_access where " +
                                           "accessfileid like '" + docId +  "'");
-...
           catch(SQLException e)
+          {
             throw new SQLException("AccessControlList.isAccessDocument " +
             throw new SQLException("PermissionControl.isAccessDocument " +
                          "Error checking" +
                          " on document " + docId + ". " + e.getMessage());
+          }
-...
         * public.
         * @param docid, the id of given documents
         */
       private boolean containDocumentOwner( String [] principals,
                                                                   String docId)
       private boolean containDocumentOwner( String[] principals, String docId)
                         throws SQLException
+      {
         int lengthOfArray=principals.length;
-...
         try
+        {
           //check out DBConnection
          conn=DBConnectionPool.getDBConnection("AccessControlList.containDocOnwer");
          conn=DBConnectionPool.getDBConnection("PermissionControl.containDocOnwer");
           serialNumber=conn.getCheckOutSerialNumber();
           pStmt = conn.prepareStatement(
                     "SELECT 'x' FROM xml_documents " +
-...
             pStmt.close();
             throw new
             SQLException("AccessControlList.hasPermission(). " +
             SQLException("PermissionControl.hasPermission(). " +
                          "Error checking ownership for " + principals[0] +
                          " on document #" + docId + ". " + e.getMessage());
         }//catch
-...
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         */
       private boolean isAllowFirst(String [] principals, String docId)
       private boolean isAllowFirst(String [] principals, String docId,
                                    String subTreeId)
                       throws SQLException, Exception
+      {
         int lengthOfArray=principals.length;
-...
         PreparedStatement pStmt = null;
         DBConnection conn = null;
         int serialNumber = -1;
         String sql = null;
         boolean topLever =false;
         if (subTreeId == null)
+        {
           //top level
           topLever = true;
           sql = "SELECT perm_order FROM xml_access " +
                 "WHERE principal_name= ? AND docid = ? AND subtreeid is NULL";
+        }
         else
+        {
           //sub tree level
           sql = "SELECT perm_order FROM xml_access " +
                 "WHERE principal_name= ? AND docid = ? AND subtreeid = ?";
+        }
         try
+        {
           //check out DBConnection
-...
           serialNumber=conn.getCheckOutSerialNumber();
           //select permission order from database
           pStmt = conn.prepareStatement(
                     "SELECT perm_order FROM xml_access " +
                     "WHERE principal_name= ? AND docid = ?");
           pStmt = conn.prepareStatement(sql);
           //check every name in the array
           for (int i=0; i<lengthOfArray;i++)
-...
             //bind value
             pStmt.setString(1, principals[i]);//user name
             pStmt.setString(2, docId);//docid
             // if subtree, we need set subtree id
             if (!topLever)
+            {
               pStmt.setString(3, subTreeId);
+            }
             pStmt.execute();
             ResultSet rs = pStmt.getResultSet();
-...
         * @param permission, the permssion need to check
         */
       private boolean hasAllowRule(String [] principals, String docId,
                                       int permission)
                                       int permission, String subTreeId)
                       throws SQLException, Exception
+     {
        int lengthOfArray=principals.length;
-...
        int ticketCount;
        DBConnection conn = null;
        int serialNumber = -1;
        boolean topLever = false;
        String sql = null;
        if (subTreeId == null)
+       {
          // for toplevel
          topLever = true;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
                "AND principal_name = ? AND perm_type = ? AND subtreeid is NULL";
+       }
        else
+       {
          topLever =false;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
                "AND principal_name = ? AND perm_type = ? AND subtreeid= ?";
+       }
        try
+       {
          //check out DBConnection
-...
         //begin_time<=currentTime<=end_time in xml_access table
         //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
         //function will assign begin_time=sysdate
         pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? ");
         pStmt = conn.prepareStatement(sql);
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, AccessControlInterface.ALLOW);
         // if subtree lever, need to set subTreeId
         if (!topLever)
+        {
           pStmt.setString(4, subTreeId);
+        }
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
-...
         * @param permission, the permssion need to check
         */
       private boolean hasExplicitDenyRule(String [] principals, String docId,
                                                 int permission)
                                           int permission, String subTreeId)
                       throws SQLException
+     {
        int lengthOfArray=principals.length;
-...
        int permissionValueInTable;
        DBConnection conn = null;
        int serialNumber = -1;
        String sql = null;
        boolean topLevel = false;
        // decide top level or subtree level
        if (subTreeId == null)
+       {
          topLevel = true;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
                 "AND principal_name = ? AND perm_type = ? AND subtreeid is NULL";
+       }
        else
+       {
          topLevel = false;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
                 "AND principal_name = ? AND perm_type = ? AND subtreeid = ?";
+       }
        try
+       {
          //check out DBConnection
          conn=DBConnectionPool.getDBConnection("AccessControlList.hasExplicitDeny");
          conn=DBConnectionPool.getDBConnection("PermissionControl.hasExplicitDeny");
          serialNumber=conn.getCheckOutSerialNumber();
          pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? ");
          pStmt = conn.prepareStatement(sql);
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(3, AccessControlInterface.DENY);
         // subtree level need to set up subtreeid
         if (!topLevel)
+        {
           pStmt.setString(4, subTreeId);
+        }
         //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
-...
         try
+        {
           //check out DBConnection
           conn=DBConnectionPool.getDBConnection("AccessControlList.getDataSetId");
           conn=DBConnectionPool.getDBConnection("PermissionControl.getDataSetId");
           serialNumber=conn.getCheckOutSerialNumber();
           pStmt=conn.prepareStatement(query);

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 1434

Added by Jing Tao over 21 years ago