/ - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 425

Added by bojilova over 23 years ago

storing user_owner and user_updated where needed
new function in DocumentImpl checking for "write" perm on UPDATE or DELETE
added delete from xml_index of the old version of docid on UPDATE

        private DBSAXNode    rootNode;
        private String       action = null;
        private String       docid = null;
        private String       user = null;
        private static final int MAXDATACHARS = 4000;
-...
        /** Construct an instance of the handler class
+        *
         * @param conn the JDBC connection to which information is written
         * @param action - "INSERT" or "UPDATE"
         * @param docid to be inserted or updated into JDBC connection
         * @param user the user connected to MetaCat servlet
         */
        public DBSAXHandler(Connection conn, String action, String docid) {
        public DBSAXHandler(Connection conn,String action,String docid,String user)
+       {
          this(conn);
          this.action = action;
          this.docid = docid;
          this.user = user;
+       }
        /** SAX Handler that receives notification of beginning of the document */
-...
            rootNode.writeNodename(docname);
            try {
              currentDocument = new DocumentImpl(conn, rootNode.getNodeID(),
                                                docname, doctype, docid, action);
                                            docname, doctype, docid, action, user);
            } catch (AccessionNumberException ane) {
              throw (new SAXException("Error with " + action, ane));
+           }

      */
     public class DocumentImpl {
       static final int ALL = 1;
       static final int WRITE = 2;
       static final int READ = 4;
       private Connection conn = null;
       private String docid = null;
       private String docname = null;
-...
+       *
        */
       public DocumentImpl(Connection conn, long rootnodeid, String docname,
                           String doctype, String docid, String action)
                           String doctype, String docid, String action, String user)
                           throws AccessionNumberException
+      {
         this.conn = conn;
-...
         this.docname = docname;
         this.doctype = doctype;
         this.docid = docid;
         writeDocumentToDB(action);
         writeDocumentToDB(action, user);
+      }
       /**
-...
        * @param docid the docid to use for the INSERT OR UPDATE
        */
       public static String write( Connection conn, String filename, String action,
                                   String docid )
                     throws Exception, IOException, SQLException,
                            ClassNotFoundException, SAXException, SAXParseException {
          return write(conn, new FileReader(new File(filename).toString()),
                       action, docid);
                                   String docid, String user, String group )
                     throws IOException, SQLException, ClassNotFoundException,
                            SAXException, SAXParseException, Exception {
         return write(conn, new FileReader(new File(filename).toString()),
                       action, docid, user, group);
+      }
       /**
-...
        * @param docid the docid to use for the INSERT OR UPDATE
        */
       public static String write( Connection conn, Reader xml, String action,
                                   String docid )
                     throws Exception, IOException, SQLException,
                            ClassNotFoundException, SAXException, SAXParseException {
                                   String docid, String user, String group )
                     throws IOException, SQLException, ClassNotFoundException,
                            SAXException, SAXParseException, Exception {
         if ( action.equals("UPDATE") ) {
           // Determine if the docid is OK for an UPDATE
           AccessionNumber ac = new AccessionNumber();
           String newdocid = ac.generate(docid, "UPDATE");
           // b' of the command line invocation
           if ( (user != null) &&  (group != null) ) {
             if ( !hasWritePermission(conn, docid, user, group) ) {
               throw new Exception("User " + user +
                     " does not have permission to update XML Document #" + docid);
+            }
+          }
+        }
         try {
             XMLReader parser = initializeParser(conn, action, docid);
             XMLReader parser = initializeParser(conn, action, docid, user);
             conn.setAutoCommit(false);
             parser.parse(new InputSource(xml));
             conn.commit();
-...
+       *
        * @param docid the ID of the document to be deleted from the database
        */
       public static void delete( Connection conn, String docid )
                       throws IOException, SQLException,
                              ClassNotFoundException, AccessionNumberException {
       public static void delete( Connection conn, String docid,
                                      String user, String group )
                     throws IOException, SQLException, ClassNotFoundException,
                            AccessionNumberException, Exception {
         AccessionNumber ac = new AccessionNumber();
         String newdocid = ac.generate(docid, "DELETE");
         if ( (user != null) &&  (group != null) ) {
           if ( !hasWritePermission(conn, docid, user, group) ) {
             throw new Exception("User " + user +
                     " does not have permission to delete XML Document #" + docid);
+          }
+        }
         conn.setAutoCommit(false);
         // Copy the record to the xml_revisions table
         DocumentImpl.archiveDocRevision( conn, docid );
         DocumentImpl.archiveDocRevision( conn, docid, user );
         // Now delete it from the xml_documents table
         Statement stmt = conn.createStatement();
         stmt.execute("DELETE FROM xml_index WHERE docid LIKE '" + docid + "'");
         stmt.execute("DELETE FROM xml_documents WHERE docid LIKE '" + docid + "'");
         stmt.execute("DELETE FROM xml_index WHERE docid = '" + docid + "'");
         stmt.execute("DELETE FROM xml_documents WHERE docid = '" + docid + "'");
         stmt.close();
         conn.commit();
+      }
       /** Check for "write" permissions from DB connection */
       private static boolean hasWritePermission(Connection conn, String docid,
                                          String user, String group)
                                          throws SQLException {
         PreparedStatement pstmt;
         // checking if user is owner of docid
         try {
           pstmt = conn.prepareStatement(
                        "SELECT docid FROM xml_documents " +
                        "WHERE docid LIKE ? AND user_owner LIKE ?");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           pstmt.close();
           if (hasRow) {
             return true;
+          }
         } catch (SQLException e) {
           throw new
             SQLException("Error getting document's owner: " + e.getMessage());
+        }
         // checking access type from xml_access table
         int accesstype = 0;
         try {
           pstmt = conn.prepareStatement(
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'user' " +
                        "AND sysdate BETWEEN begin_time AND end_time " +
                        "UNION " +
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'group' " +
                        "AND sysdate BETWEEN begin_time AND end_time");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.setString(3, docid);
           pstmt.setString(2, group);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRows = rs.next();
           if ( !hasRows ) {
             pstmt.close();
             return false;
+          }
           accesstype = rs.getInt(1);
           pstmt.close();
           accesstype = accesstype | WRITE;
           if ( (accesstype & WRITE) == WRITE ) {
             return true;
+          }
           return false;
         } catch (SQLException e) {
           throw new
           SQLException("Error getting document's permissions: " + e.getMessage());
+        }
+      }
       /** creates SQL code and inserts new document into DB connection */
       private void writeDocumentToDB(String action)
       private void writeDocumentToDB(String action, String user)
                    throws AccessionNumberException {
         try {
           PreparedStatement pstmt = null;
-...
             pstmt = conn.prepareStatement(
                 "INSERT INTO xml_documents " +
                 "(docid, rootnodeid, docname, doctype, " +
                 "date_created, date_updated) " +
                 "VALUES (?, ?, ?, ?, sysdate, sysdate)");
                 "user_owner, user_updated, date_created, date_updated) " +
                 "VALUES (?, ?, ?, ?, ?, ?, sysdate, sysdate)");
             // Bind the values to the query
             pstmt.setString(1, this.docid);
             pstmt.setLong(2, rootnodeid);
             pstmt.setString(3, docname);
             pstmt.setString(4, doctype);
             pstmt.setString(5, user);
             pstmt.setString(6, user);
           } else if (action.equals("UPDATE")) {
             // Determine if the docid is OK for an UPDATE
             AccessionNumber ac = new AccessionNumber();
             this.docid = ac.generate(docid, "UPDATE");
     //    moved the check earlier before start of parsing
     //        // Determine if the docid is OK for an UPDATE
     //        AccessionNumber ac = new AccessionNumber();
     //        this.docid = ac.generate(docid, "UPDATE");
             // Save the old document entry in a backup table
             DocumentImpl.archiveDocRevision( conn, docid );
             DocumentImpl.archiveDocRevision( conn, docid, user );
             // Delete index for the old version of docid
             // The new index is inserting on the next calls to DBSAXNode
             pstmt = conn.prepareStatement(
                     "DELETE FROM xml_index WHERE docid='" + this.docid + "'");
             pstmt.execute();
             pstmt.close();
             // Update the new document to reflect the new node tree
             pstmt = conn.prepareStatement(
                 "UPDATE xml_documents " +
                 "SET rootnodeid = ?, docname = ?, doctype = ?, " +
                 "date_updated = sysdate WHERE docid LIKE ?");
                 "user_updated = ?, date_updated = sysdate WHERE docid LIKE ?");
             // Bind the values to the query
             pstmt.setLong(1, rootnodeid);
             pstmt.setString(2, docname);
             pstmt.setString(3, doctype);
             pstmt.setString(4, this.docid);
             pstmt.setString(4, user);
             pstmt.setString(5, this.docid);
           } else {
             System.err.println("Action not supported: " + action);
+          }
-...
+      }
       /** Save a document entry in the xml_revisions table */
       private static void archiveDocRevision(Connection conn, String docid)
                           throws SQLException {
       private static void archiveDocRevision(Connection conn, String docid,
                                              String user) throws SQLException {
         // First get all of the values we need
         long rnodeid = -1;
         String docname = null;
         String doctype = null;
         String doctitle = null;
         String user_owner = null;
         Date date_created = null;
         PreparedStatement pstmt = conn.prepareStatement(
            "SELECT rootnodeid, docname, doctype, doctitle, date_created " +
            "FROM xml_documents " +
            "WHERE docid = ?");
           "SELECT rootnodeid,docname,doctype,doctitle,user_owner,date_created " +
           "FROM xml_documents " +
           "WHERE docid = ?");
         // Bind the values to the query and execute it
         pstmt.setString(1, docid);
         pstmt.execute();
-...
           docname      = rs.getString(2);
           doctype      = rs.getString(3);
           doctitle     = rs.getString(4);
           date_created = rs.getDate(5);
           user_owner   = rs.getString(5);
           date_created = rs.getDate(6);
+        }
         pstmt.close();
-...
         pstmt = conn.prepareStatement(
            "INSERT INTO xml_revisions " +
            "(revisionid, docid, rootnodeid, docname, doctype, doctitle, " +
            "date_created, date_updated) " +
            "VALUES (null, ?, ?, ?, ?, ?, sysdate, sysdate)");
            "user_owner, user_updated, date_created, date_updated) " +
            "VALUES (null, ?, ?, ?, ?, ?, ?, ?, sysdate, sysdate)");
         // Bind the values to the query and execute it
         pstmt.setString(1, docid);
         pstmt.setLong(2, rnodeid);
         pstmt.setString(3, docname);
         pstmt.setString(4, doctype);
         pstmt.setString(5, doctitle);
         pstmt.setString(6, user_owner);
         pstmt.setString(7, user);
         //pstmt.setDate(6, date_created);
         pstmt.execute();
         pstmt.close();
-...
        * Set up the parser handlers for writing the document to the database
        */
       private static XMLReader initializeParser(Connection conn,
                                String action, String docid) {
                                String action, String docid, String user) {
         XMLReader parser = null;
         //
         // Set up the SAX document handlers for parsing
         //
         try {
           ContentHandler chandler   = new DBSAXHandler(conn, action, docid);
           ContentHandler chandler   = new DBSAXHandler(conn, action, docid, user);
           EntityResolver dbresolver = new DBEntityResolver(conn,
                                           (DBSAXHandler)chandler);
           DTDHandler dtdhandler     = new DBDTDHandler(conn);
-...
               DocumentImpl xmldoc = new DocumentImpl( dbconn, docid );
               System.out.println(xmldoc.toString());
           } else if (action.equals("DELETE")) {
             DocumentImpl.delete(dbconn, docid);
             DocumentImpl.delete(dbconn, docid, null, null);
             System.out.println("Document deleted: " + docid);
           } else {
             String newdocid = DocumentImpl.write(dbconn, filename, action, docid);
             String newdocid = DocumentImpl.write(dbconn, filename, action, docid,
                                                                       null, null);
             if ((docid != null) && (!docid.equals(newdocid))) {
               if (action.equals("INSERT")) {
                 System.out.println("New document ID generated!!! ");

         // by looking up the current session information for all actions
         // other than "Login" and "Logout"
         // handle login action
         String username = null;
         String groupname = null;
         if (action.equals("Login") || action.equals("Login Client")) {
           handleLoginAction(out, params, request, response);
         // handle logout action
-...
             // redirect to default page for query only access
           //  response.sendRedirect(htmlpath + "/sexpire.html");
+          }
           } else {
             username = (String)sess.getAttribute("username");
             groupname = (String)sess.getAttribute("groupname");
+          }
+        }
         // Now that we know the session is valid, we can delegate the request
-...
             out.println(se.getMessage());
+          }
         } else if (action.equals("insert") || action.equals("update")) {
           handleInsertOrUpdateAction(out, params, response);
           if ( !username.equals("public") && (username != null) ) {
             handleInsertOrUpdateAction(out, params, response, username, groupname);
           } else {
             out.println("Permission denied for " + action);
+          }
         } else if (action.equals("delete")) {
           handleDeleteAction(out, params, response);
           if ( !username.equals("public") && (username != null) ) {
             handleDeleteAction(out, params, response, username, groupname);
           } else {
             out.println("Permission denied for " + action);
+          }
         } else if (action.equals("validate")) {
           handleValidateAction(out, params, response);
         } else if (action.equals("getdatadoc")) {
-...
         Hashtable doclist = runQuery(xmlquery);
         String qformat = ((String[])params.get("qformat"))[0];
         String resultdoc = createResultDocument(doclist, transformQuery(params));
         //format and transform the results
         if(qformat.equals("html")) {
           transformResultset(resultdoc, response, out);
-...
        * to the database connection
        */
       private void handleInsertOrUpdateAction(PrintWriter out, Hashtable params,
                    HttpServletResponse response) {
                    HttpServletResponse response, String user, String group) {
         Connection conn = null;
-...
                     if (accNumber.equals("")) {
                         accNumber = null;
+                    }
                     newdocid = DocumentImpl.write(conn, xml, doAction, accNumber);
                     newdocid = DocumentImpl.write(conn, xml, doAction, accNumber,
                                                                       user, group);
                 } catch (NullPointerException npe) {
                   newdocid = DocumentImpl.write(conn, xml, doAction, null);
                   newdocid = DocumentImpl.write(conn,xml,doAction,null,user,group);
+                }
             } catch (Exception e) {
               response.setContentType("text/html");
-...
        * from the database connection
        */
       private void handleDeleteAction(PrintWriter out, Hashtable params,
                    HttpServletResponse response) {
                    HttpServletResponse response, String user, String group) {
         String[] docid = (String[])params.get("docid");
         Connection conn = null;
-...
                                           // FOR EXISTENCE OF DOCID PARAM
                                           // BEFORE ACCESSING ARRAY
           try {
             DocumentImpl.delete(conn, docid[0]);
             DocumentImpl.delete(conn, docid[0], user, group);
             response.setContentType("text/xml");
             out.println("<?xml version=\"1.0\"?>");
             out.println("<success>");

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 425

Added by bojilova over 23 years ago