Index: src/edu/ucsb/nceas/metacat/DocumentImpl.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 440)
+++ src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 441)
@@ -468,16 +468,14 @@
                        SAXException, SAXParseException, Exception {
 
     if ( action.equals("UPDATE") ) {
-      // Determine if the docid is OK for an UPDATE
+      // Determine if the docid is OK for UPDATE
       AccessionNumber ac = new AccessionNumber();
       String newdocid = ac.generate(docid, "UPDATE");
 
-      // b' of the command line invocation
-      if ( (user != null) &&  (group != null) ) { 
-        if ( !hasWritePermission(conn, docid, user, group) ) {
-          throw new Exception("User " + user + 
-                " does not have permission to update XML Document #" + docid);
-        }        
+      // check for 'write' permission for 'user' to update this document
+      if ( !hasWritePermission(conn, docid, user, group) ) {
+        throw new Exception("User " + user + 
+              " does not have permission to update XML Document #" + docid);
       }          
     }
 
@@ -530,14 +528,14 @@
                 throws IOException, SQLException, ClassNotFoundException, 
                        AccessionNumberException, Exception {
 
+    // Determine if the docid is OK for DELETE
     AccessionNumber ac = new AccessionNumber();
     String newdocid = ac.generate(docid, "DELETE");
 
-    if ( (user != null) &&  (group != null) ) {
-      if ( !hasWritePermission(conn, docid, user, group) ) {
-        throw new Exception("User " + user + 
-                " does not have permission to delete XML Document #" + docid);
-      }          
+    // check for 'write' permission for 'user' to delete this document
+    if ( !hasWritePermission(conn, docid, user, group) ) {
+      throw new Exception("User " + user + 
+              " does not have permission to delete XML Document #" + docid);
     }
 
     conn.setAutoCommit(false);
@@ -556,11 +554,16 @@
   private static boolean hasWritePermission(Connection conn, String docid, 
                                      String user, String group) 
                                      throws SQLException {
+    // b' of the command line invocation
+    if ( (user == null) && (group == null) ) {
+      return true;
+    }
+
     PreparedStatement pstmt;
     // checking if user is owner of docid
     try {
       pstmt = conn.prepareStatement(
-                   "SELECT docid FROM xml_documents " +
+                   "SELECT 'x' FROM xml_documents " +
                    "WHERE docid LIKE ? AND user_owner LIKE ?");
       // Bind the values to the query
       pstmt.setString(1, docid);
@@ -576,7 +579,7 @@
       
     } catch (SQLException e) {
       throw new 
-        SQLException("Error getting document's owner: " + e.getMessage());
+        SQLException("Error checking document's owner: " + e.getMessage());
     }
 
     // checking access type from xml_access table
@@ -587,13 +590,15 @@
                    "WHERE docid LIKE ? " + 
                    "AND principal_name LIKE ? " +
                    "AND principal_type = 'user' " +
-                   "AND sysdate BETWEEN begin_time AND end_time " +
+                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
+                                   "AND nvl(end_time,sysdate) " +
                    "UNION " +
                    "SELECT access_type FROM xml_access " +
                    "WHERE docid LIKE ? " + 
                    "AND principal_name LIKE ? " +
                    "AND principal_type = 'group' " +
-                   "AND sysdate BETWEEN begin_time AND end_time");
+                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
+                                   "AND nvl(end_time,sysdate)");
       // Bind the values to the query
       pstmt.setString(1, docid);
       pstmt.setString(2, user);
Index: src/edu/ucsb/nceas/metacat/DBQuery.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBQuery.java	(revision 440)
+++ src/edu/ucsb/nceas/metacat/DBQuery.java	(revision 441)
@@ -35,6 +35,10 @@
  */
 public class DBQuery {
 
+  static final int ALL = 1;
+  static final int WRITE = 2;
+  static final int READ = 4;
+
   private Connection	conn = null;
   private String	parserName = null;
 
@@ -65,7 +69,7 @@
           DBQuery queryobj = new DBQuery(dbconn, util.getOption("saxparser"));
           FileReader xml = new FileReader(new File(xmlfile));
           Hashtable nodelist = null;
-          nodelist = queryobj.findDocuments(xml);
+          nodelist = queryobj.findDocuments(xml, null, null);
 
           // Print the reulting document listing
           StringBuffer result = new StringBuffer();
@@ -117,7 +121,7 @@
    *
    * @param xmlquery the xml serialization of the query (@see pathquery.dtd)
    */
-  public Hashtable findDocuments(Reader xmlquery) {
+  public Hashtable findDocuments(Reader xmlquery, String user, String group) {
       Hashtable	 docListResult = new Hashtable();
       PreparedStatement pstmt;
       String docid = null;
@@ -143,6 +147,7 @@
         boolean tableHasRows = rs.next();
         while (tableHasRows) {
           docid = rs.getString(1);
+          if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
           docname = rs.getString(2);
           doctype = rs.getString(3);
           doctitle = rs.getString(4);
@@ -186,6 +191,7 @@
           while(tableHasRows) 
           {
             docid = rs.getString(1);
+            if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
             fieldname = rs.getString(2);
             fielddata = rs.getString(3);
             
@@ -478,10 +484,120 @@
    public static String createQuery(String value) {
      return createQuery(value, "any");
    }
+   
+  /** Check for "read" permissions from DB connection */
+  private boolean hasReadPermission(Connection conn, String docid, 
+                                     String user, String group) 
+                                     throws SQLException {
+    // b' of the command line invocation
+    if ( (user == null) && (group == null) ) {
+      return true;
+    }
+    
+    PreparedStatement pstmt;
+    // checking if user is owner of docid or if docid has public access
+    try {
+      pstmt = conn.prepareStatement(
+                   "SELECT 'x' FROM xml_documents " +
+                   "WHERE docid LIKE ? AND user_owner LIKE ? " + 
+                   "UNION " +
+                   "SELECT 'x' FROM xml_documents " +
+                   "WHERE docid LIKE ? AND public_access = 1");
+      // Bind the values to the query
+      pstmt.setString(1, docid);
+      pstmt.setString(2, user);
+      pstmt.setString(3, docid);
+
+      pstmt.execute();
+      ResultSet rs = pstmt.getResultSet();
+      boolean hasRow = rs.next();
+      pstmt.close();
+      if (hasRow) {
+        return true;
+      }
+      
+    } catch (SQLException e) {
+      throw new 
+        SQLException("Error checking document's owner or public access: "
+                      + e.getMessage());
+    }
+
+    // checking if docid has public access at this time
+    try {
+      pstmt = conn.prepareStatement(
+                   "SELECT 'x' FROM xml_access " +
+                   "WHERE docid LIKE ? " +
+                   "AND principal_name = 'public' " +
+                   "AND principal_type = 'user' " +
+                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
+                                   "AND nvl(end_time,sysdate)");
+      // Bind the values to the query
+      pstmt.setString(1, docid);
+
+      pstmt.execute();
+      ResultSet rs = pstmt.getResultSet();
+      boolean hasRow = rs.next();
+      pstmt.close();
+      if (hasRow) {
+        return true;
+      }
+      
+    } catch (SQLException e) {
+      throw new 
+        SQLException("Error checking doc's public access: " + e.getMessage());
+    }
+
+    // checking access type from xml_access table
+    int accesstype = 0;
+    try {
+      pstmt = conn.prepareStatement(
+                   "SELECT access_type FROM xml_access " +
+                   "WHERE docid LIKE ? " + 
+                   "AND principal_name LIKE ? " +
+                   "AND principal_type = 'user' " +
+                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
+                                   "AND nvl(end_time,sysdate) " +
+                   "UNION " +
+                   "SELECT access_type FROM xml_access " +
+                   "WHERE docid LIKE ? " + 
+                   "AND principal_name LIKE ? " +
+                   "AND principal_type = 'group' " +
+                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
+                                   "AND nvl(end_time,sysdate)");
+      // Bind the values to the query
+      pstmt.setString(1, docid);
+      pstmt.setString(2, user);
+      pstmt.setString(3, docid);
+      pstmt.setString(2, group);
+
+      pstmt.execute();
+      ResultSet rs = pstmt.getResultSet();
+      boolean hasRows = rs.next();
+      while ( hasRows ) {
+        accesstype = rs.getInt(1);
+        if ( (accesstype & READ) == READ ) {
+          pstmt.close();
+          return true;
+        }
+        hasRows = rs.next();
+      }
+
+      pstmt.close();
+      return false;
+      
+    } catch (SQLException e) {
+      throw new 
+      SQLException("Error getting document's permissions: " + e.getMessage());
+    }
+  }
+   
 }
 
 /**
  * '$Log$
+ * 'Revision 1.18  2000/09/05 20:50:56  berkley
+ * 'Added a method called getNodeContent which retrieves the content of a node in a document.  If there are more than one nodes with the same name returned, it returns an array with all of the data.
+ * '
  * 'Revision 1.17  2000/08/31 21:20:39  berkley
  * 'changed xslf for new returnfield scheme.  the returnfields are now returned as <param name="<returnfield>"> tags.
  * 'hThe sql for the returnfield query was redone to fix a previous problem with slow queries
Index: src/edu/ucsb/nceas/metacat/MetaCatServlet.java
===================================================================
--- src/edu/ucsb/nceas/metacat/MetaCatServlet.java	(revision 440)
+++ src/edu/ucsb/nceas/metacat/MetaCatServlet.java	(revision 441)
@@ -241,8 +241,8 @@
       if (sess.isNew()) { 
         // session expired or has not been stored b/w user requests
         // redirect to default page for query only access
-
-      //  response.sendRedirect(htmlpath + "/sexpire.html");
+        //  response.sendRedirect(htmlpath + "/sexpire.html");
+        username = "public";
       } else {
         username = (String)sess.getAttribute("username");
         groupname = (String)sess.getAttribute("groupname");
@@ -253,13 +253,13 @@
     // to a particular action handler
     if(action.equals("query"))
     {
-      handleQuery(out, params, response); 
+      handleQuery(out, params, response, username, groupname); 
     } 
     else if(action.equals("squery"))
     {
       if(params.containsKey("query"))
       {
-        handleSQuery(out, params, response); 
+        handleSQuery(out, params, response, username, groupname); 
       }
       else
       {
@@ -381,11 +381,11 @@
    * @param conn the database connection 
    */
   protected void handleSQuery(PrintWriter out, Hashtable params, 
-                              HttpServletResponse response)
+                 HttpServletResponse response, String user, String group)
   { 
     String xmlquery = ((String[])params.get("query"))[0];
     String qformat = ((String[])params.get("qformat"))[0];
-    Hashtable doclist = runQuery(xmlquery);
+    Hashtable doclist = runQuery(xmlquery, user, group);
     String resultdoc = createResultDocument(doclist, xmlquery);
 
     //format and transform the results                                        
@@ -408,11 +408,11 @@
     * @param response the response object linked to the client
     */ 
   protected void handleQuery(PrintWriter out, Hashtable params, 
-                           HttpServletResponse response)
+                 HttpServletResponse response, String user, String group)
   {
     //create the query and run it
     String xmlquery = DBQuery.createSQuery(params);
-    Hashtable doclist = runQuery(xmlquery);
+    Hashtable doclist = runQuery(xmlquery, user, group);
     String qformat = ((String[])params.get("qformat"))[0]; 
     String resultdoc = createResultDocument(doclist, transformQuery(params));
 
@@ -452,24 +452,21 @@
    *
    * @param xmlquery the query to run
    */
-  private Hashtable runQuery(String xmlquery)
+  private Hashtable runQuery(String xmlquery, String user, String group)
   {
     Hashtable doclist=null;
     Connection conn = null;
     try
     {
-        conn = util.getConnection();
-        DBQuery queryobj = new DBQuery(conn, saxparser);
-        doclist = queryobj.findDocuments(new StringReader(xmlquery));
-        util.returnConnection(conn);
-        return doclist;
+      conn = util.getConnection();
+      DBQuery queryobj = new DBQuery(conn, saxparser);
+      doclist = queryobj.findDocuments(new StringReader(xmlquery),user,group);
+      util.returnConnection(conn);
+      return doclist;
     } 
     catch (Exception e) 
     {
-      if (conn != null) 
-      {
-        util.returnConnection(conn); 
-      }
+      util.returnConnection(conn); 
       util.debugMessage("Error in runQuery: " + e.getMessage());
       doclist = null;
       return doclist;
@@ -499,10 +496,7 @@
     }
     catch(Exception e)
     {
-      //if (conn != null) 
-      {
-        util.returnConnection(conn); 
-      }
+      util.returnConnection(conn); 
     } 
   }
   
