/ - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 441

Added by bojilova about 24 years ago

added check from "read" permission on "query" and "squery" actions
for connected user or for "public" connection

                            SAXException, SAXParseException, Exception {
         if ( action.equals("UPDATE") ) {
           // Determine if the docid is OK for an UPDATE
           // Determine if the docid is OK for UPDATE
           AccessionNumber ac = new AccessionNumber();
           String newdocid = ac.generate(docid, "UPDATE");
           // b' of the command line invocation
           if ( (user != null) &&  (group != null) ) {
             if ( !hasWritePermission(conn, docid, user, group) ) {
               throw new Exception("User " + user +
                     " does not have permission to update XML Document #" + docid);
+            }
           // check for 'write' permission for 'user' to update this document
           if ( !hasWritePermission(conn, docid, user, group) ) {
             throw new Exception("User " + user +
                   " does not have permission to update XML Document #" + docid);
+          }
+        }
-...
                     throws IOException, SQLException, ClassNotFoundException,
                            AccessionNumberException, Exception {
         // Determine if the docid is OK for DELETE
         AccessionNumber ac = new AccessionNumber();
         String newdocid = ac.generate(docid, "DELETE");
         if ( (user != null) &&  (group != null) ) {
           if ( !hasWritePermission(conn, docid, user, group) ) {
             throw new Exception("User " + user +
                     " does not have permission to delete XML Document #" + docid);
+          }
         // check for 'write' permission for 'user' to delete this document
         if ( !hasWritePermission(conn, docid, user, group) ) {
           throw new Exception("User " + user +
                   " does not have permission to delete XML Document #" + docid);
+        }
         conn.setAutoCommit(false);
-...
       private static boolean hasWritePermission(Connection conn, String docid,
                                          String user, String group)
                                          throws SQLException {
         // b' of the command line invocation
         if ( (user == null) && (group == null) ) {
           return true;
+        }
         PreparedStatement pstmt;
         // checking if user is owner of docid
         try {
           pstmt = conn.prepareStatement(
                        "SELECT docid FROM xml_documents " +
                        "SELECT 'x' FROM xml_documents " +
                        "WHERE docid LIKE ? AND user_owner LIKE ?");
           // Bind the values to the query
           pstmt.setString(1, docid);
-...
         } catch (SQLException e) {
           throw new
             SQLException("Error getting document's owner: " + e.getMessage());
             SQLException("Error checking document's owner: " + e.getMessage());
+        }
         // checking access type from xml_access table
-...
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'user' " +
                        "AND sysdate BETWEEN begin_time AND end_time " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate) " +
                        "UNION " +
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'group' " +
                        "AND sysdate BETWEEN begin_time AND end_time");
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate)");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);

      */
     public class DBQuery {
       static final int ALL = 1;
       static final int WRITE = 2;
       static final int READ = 4;
       private Connection	conn = null;
       private String	parserName = null;
-...
               DBQuery queryobj = new DBQuery(dbconn, util.getOption("saxparser"));
               FileReader xml = new FileReader(new File(xmlfile));
               Hashtable nodelist = null;
               nodelist = queryobj.findDocuments(xml);
               nodelist = queryobj.findDocuments(xml, null, null);
               // Print the reulting document listing
               StringBuffer result = new StringBuffer();
-...
+       *
        * @param xmlquery the xml serialization of the query (@see pathquery.dtd)
        */
       public Hashtable findDocuments(Reader xmlquery) {
       public Hashtable findDocuments(Reader xmlquery, String user, String group) {
           Hashtable	 docListResult = new Hashtable();
           PreparedStatement pstmt;
           String docid = null;
-...
             boolean tableHasRows = rs.next();
             while (tableHasRows) {
               docid = rs.getString(1);
               if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
               docname = rs.getString(2);
               doctype = rs.getString(3);
               doctitle = rs.getString(4);
-...
               while(tableHasRows)
+              {
                 docid = rs.getString(1);
                 if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
                 fieldname = rs.getString(2);
                 fielddata = rs.getString(3);
-...
        public static String createQuery(String value) {
          return createQuery(value, "any");
+       }
       /** Check for "read" permissions from DB connection */
       private boolean hasReadPermission(Connection conn, String docid,
                                          String user, String group)
                                          throws SQLException {
         // b' of the command line invocation
         if ( (user == null) && (group == null) ) {
           return true;
+        }
         PreparedStatement pstmt;
         // checking if user is owner of docid or if docid has public access
         try {
           pstmt = conn.prepareStatement(
                        "SELECT 'x' FROM xml_documents " +
                        "WHERE docid LIKE ? AND user_owner LIKE ? " +
                        "UNION " +
                        "SELECT 'x' FROM xml_documents " +
                        "WHERE docid LIKE ? AND public_access = 1");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.setString(3, docid);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           pstmt.close();
           if (hasRow) {
             return true;
+          }
         } catch (SQLException e) {
           throw new
             SQLException("Error checking document's owner or public access: "
                           + e.getMessage());
+        }
         // checking if docid has public access at this time
         try {
           pstmt = conn.prepareStatement(
                        "SELECT 'x' FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name = 'public' " +
                        "AND principal_type = 'user' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate)");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           pstmt.close();
           if (hasRow) {
             return true;
+          }
         } catch (SQLException e) {
           throw new
             SQLException("Error checking doc's public access: " + e.getMessage());
+        }
         // checking access type from xml_access table
         int accesstype = 0;
         try {
           pstmt = conn.prepareStatement(
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'user' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate) " +
                        "UNION " +
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'group' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate)");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.setString(3, docid);
           pstmt.setString(2, group);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRows = rs.next();
           while ( hasRows ) {
             accesstype = rs.getInt(1);
             if ( (accesstype & READ) == READ ) {
               pstmt.close();
               return true;
+            }
             hasRows = rs.next();
+          }
           pstmt.close();
           return false;
         } catch (SQLException e) {
           throw new
           SQLException("Error getting document's permissions: " + e.getMessage());
+        }
+      }
+    }
     /**
      * '$Log$
      * 'Revision 1.18  2000/09/05 20:50:56  berkley
      * 'Added a method called getNodeContent which retrieves the content of a node in a document.  If there are more than one nodes with the same name returned, it returns an array with all of the data.
      * '
      * 'Revision 1.17  2000/08/31 21:20:39  berkley
      * 'changed xslf for new returnfield scheme.  the returnfields are now returned as <param name="<returnfield>"> tags.
      * 'hThe sql for the returnfield query was redone to fix a previous problem with slow queries

           if (sess.isNew()) {
             // session expired or has not been stored b/w user requests
             // redirect to default page for query only access
           //  response.sendRedirect(htmlpath + "/sexpire.html");
             //  response.sendRedirect(htmlpath + "/sexpire.html");
             username = "public";
           } else {
             username = (String)sess.getAttribute("username");
             groupname = (String)sess.getAttribute("groupname");
-...
         // to a particular action handler
         if(action.equals("query"))
+        {
           handleQuery(out, params, response);
           handleQuery(out, params, response, username, groupname);
+        }
         else if(action.equals("squery"))
+        {
           if(params.containsKey("query"))
+          {
             handleSQuery(out, params, response);
             handleSQuery(out, params, response, username, groupname);
+          }
           else
+          {
-...
        * @param conn the database connection
        */
       protected void handleSQuery(PrintWriter out, Hashtable params,
                                   HttpServletResponse response)
                      HttpServletResponse response, String user, String group)
+      {
         String xmlquery = ((String[])params.get("query"))[0];
         String qformat = ((String[])params.get("qformat"))[0];
         Hashtable doclist = runQuery(xmlquery);
         Hashtable doclist = runQuery(xmlquery, user, group);
         String resultdoc = createResultDocument(doclist, xmlquery);
         //format and transform the results
-...
         * @param response the response object linked to the client
         */
       protected void handleQuery(PrintWriter out, Hashtable params,
                                HttpServletResponse response)
                      HttpServletResponse response, String user, String group)
+      {
         //create the query and run it
         String xmlquery = DBQuery.createSQuery(params);
         Hashtable doclist = runQuery(xmlquery);
         Hashtable doclist = runQuery(xmlquery, user, group);
         String qformat = ((String[])params.get("qformat"))[0];
         String resultdoc = createResultDocument(doclist, transformQuery(params));
-...
+       *
        * @param xmlquery the query to run
        */
       private Hashtable runQuery(String xmlquery)
       private Hashtable runQuery(String xmlquery, String user, String group)
+      {
         Hashtable doclist=null;
         Connection conn = null;
         try
+        {
             conn = util.getConnection();
             DBQuery queryobj = new DBQuery(conn, saxparser);
             doclist = queryobj.findDocuments(new StringReader(xmlquery));
             util.returnConnection(conn);
             return doclist;
           conn = util.getConnection();
           DBQuery queryobj = new DBQuery(conn, saxparser);
           doclist = queryobj.findDocuments(new StringReader(xmlquery),user,group);
           util.returnConnection(conn);
           return doclist;
+        }
         catch (Exception e)
+        {
           if (conn != null)
+          {
             util.returnConnection(conn);
+          }
           util.returnConnection(conn);
           util.debugMessage("Error in runQuery: " + e.getMessage());
           doclist = null;
           return doclist;
-...
+        }
         catch(Exception e)
+        {
           //if (conn != null)
+          {
             util.returnConnection(conn);
+          }
           util.returnConnection(conn);
+        }
+      }

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 441

Added by bojilova about 24 years ago