Project

General

Profile

« Previous | Next » 

Revision 2259

Added by sgarg over 20 years ago

Fixed a bug in upload function. For online data updates, access was not checked.

View differences:

src/edu/ucsb/nceas/metacat/MetaCatServlet.java
2308 2308
                        //if the docid is not acceptable or other untoward
2309 2309
                        // things happen
2310 2310
                        DocumentImpl.registerDocument(fileName, "BIN", docid,
2311
                                username);
2311
                                username, groupnames);
2312 2312

  
2313 2313
                        // Save the data file to disk using "docid" as the name
2314 2314
                        dataDirectory.mkdirs();
src/edu/ucsb/nceas/metacat/DocumentImpl.java
231 231
     * This method will be call in handleUploadRequest in MetacatServlet class
232 232
     */
233 233
    public static void registerDocument(String docname, String doctype,
234
            String accnum, String user) throws SQLException,
234
            String accnum, String user, String[] groupnames) throws SQLException,
235 235
            AccessionNumberException, Exception
236 236
    {
237 237
        try {
238 238
            // get server location for this doc
239 239
            int serverLocation = getServerLocationNumber(accnum);
240
            registerDocument(docname, doctype, accnum, user, serverLocation);
240
            registerDocument(docname, doctype, accnum, user, groupnames,
241
                             serverLocation);
241 242
        } catch (Exception e) {
242 243
            throw e;
243 244
        }
......
267 268
     *            (e.g., knb.1.1)
268 269
     * @param user
269 270
     *            the user that owns the document
271
     * @param groupnames
272
     *            the groups that owns the document
270 273
     * @param serverCode
271 274
     *            the serverid from xml_replication on which this document
272 275
     *            resides.
273 276
     */
274 277
    public static void registerDocument(String docname, String doctype,
275
            String accnum, String user, int serverCode) throws SQLException,
276
            AccessionNumberException, Exception
278
            String accnum, String user, String[] groups, int serverCode)
279
            throws SQLException, AccessionNumberException, Exception
277 280
    {
281

  
278 282
        DBConnection dbconn = null;
279 283
        int serialNumber = -1;
280 284
        PreparedStatement pstmt = null;
......
301 305
            // it is a updated data file
302 306
            else if (userSpecifyRev > revInDataBase && revInDataBase > 0) {
303 307

  
308
                if (!hasWritePermission(user, groups, accnum)) { throw new Exception(
309
                   "User " + user
310
                   + " does not have permission to update the document"
311
                   + accnum); }
312

  
304 313
                //archive the old entry
305 314
                archiveDocRevision(docIdWithoutRev, user);
306 315
                //delete the old entry in xml_documents
......
362 371
            //dbconn.close();
363 372
        } finally {
364 373
            try {
365
                pstmt.close();
374
                if(pstmt != null){
375
                    pstmt.close();
376
                }
366 377
            } finally {
367 378
                DBConnectionPool.returnDBConnection(dbconn, serialNumber);
368 379
            }
......
1240 1251
            sql.append(" FROM ").append(table);
1241 1252
            sql.append(" WHERE docid LIKE '").append(docid.getIdentifier());
1242 1253
            sql.append("' and rev like '").append(docid.getRev()).append("'");
1254

  
1243 1255
            pstmt = dbconn.prepareStatement(sql.toString());
1244 1256

  
1245 1257
            pstmt.execute();

Also available in: Unified diff