1
|
/**
|
2
|
* '$RCSfile$'
|
3
|
* Purpose: A class that handles checking permssision for a document
|
4
|
and subtree in a document
|
5
|
*
|
6
|
* Copyright: 2000 Regents of the University of California and the
|
7
|
* National Center for Ecological Analysis and Synthesis
|
8
|
* Authors: Chad Berkley
|
9
|
*
|
10
|
* '$Author: daigle $'
|
11
|
* '$Date: 2008-10-29 11:42:15 -0700 (Wed, 29 Oct 2008) $'
|
12
|
* '$Revision: 4485 $'
|
13
|
*
|
14
|
* This program is free software; you can redistribute it and/or modify
|
15
|
* it under the terms of the GNU General Public License as published by
|
16
|
* the Free Software Foundation; either version 2 of the License, or
|
17
|
* (at your option) any later version.
|
18
|
*
|
19
|
* This program is distributed in the hope that it will be useful,
|
20
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
21
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
22
|
* GNU General Public License for more details.
|
23
|
*
|
24
|
* You should have received a copy of the GNU General Public License
|
25
|
* along with this program; if not, write to the Free Software
|
26
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
27
|
*/
|
28
|
package edu.ucsb.nceas.metacat;
|
29
|
|
30
|
import java.sql.*;
|
31
|
import java.util.Enumeration;
|
32
|
import java.util.Hashtable;
|
33
|
import java.util.Stack;
|
34
|
import java.util.Vector;
|
35
|
import java.util.Iterator;
|
36
|
|
37
|
import org.apache.log4j.Logger;
|
38
|
|
39
|
import edu.ucsb.nceas.metacat.service.PropertyService;
|
40
|
import edu.ucsb.nceas.metacat.util.MetaCatUtil;
|
41
|
import edu.ucsb.nceas.utilities.PropertyNotFoundException;
|
42
|
|
43
|
public class PermissionController
|
44
|
{
|
45
|
private String docId = null;
|
46
|
private boolean hasSubTreeAccessControl = false; // flag if has a subtree
|
47
|
// access for this docid
|
48
|
private Vector subTreeList = new Vector();
|
49
|
|
50
|
private long TOPLEVELSTARTNODEID = 0; //if start node is 0, means it is top
|
51
|
//level document
|
52
|
|
53
|
private static Logger logMetacat = Logger.getLogger(PermissionController.class);
|
54
|
|
55
|
/**
|
56
|
* Constructor for PermissionController
|
57
|
* @param myDocid the docid need to access
|
58
|
*/
|
59
|
public PermissionController(String myDocid) throws McdbException
|
60
|
{
|
61
|
// Get rid of rev number
|
62
|
docId = MetaCatUtil.getSmartDocId(myDocid);
|
63
|
//hasSubTreeAccessControl = checkSubTreeAccessControl();
|
64
|
}
|
65
|
|
66
|
/**
|
67
|
* Constructor for PermssionController
|
68
|
* @param myDocid String
|
69
|
* @param needDeleteRev boolean
|
70
|
*/
|
71
|
public PermissionController(String myDocid, boolean needDeleteRevFromDocid)
|
72
|
{
|
73
|
if (!needDeleteRevFromDocid)
|
74
|
{
|
75
|
docId = myDocid;
|
76
|
}
|
77
|
else
|
78
|
{
|
79
|
docId = MetaCatUtil.getDocIdFromAccessionNumber(myDocid);
|
80
|
}
|
81
|
}
|
82
|
|
83
|
/**
|
84
|
* Return if a document has subtree access control
|
85
|
*/
|
86
|
public boolean hasSubTreeAccessControl()
|
87
|
{
|
88
|
return hasSubTreeAccessControl;
|
89
|
}
|
90
|
|
91
|
|
92
|
/**
|
93
|
* Check from db connection if at least one of the list of @principals
|
94
|
* @param user the user name
|
95
|
* @param groups the groups which the use is in
|
96
|
* @param myPermission permission type to check for
|
97
|
*/
|
98
|
public boolean hasPermission(String user, String[]groups, String myPermission)
|
99
|
throws SQLException, Exception
|
100
|
{
|
101
|
boolean hasPermission=false;
|
102
|
String [] userPackage=null;
|
103
|
int permission =AccessControlList.intValue(myPermission);
|
104
|
|
105
|
//for the commnad line invocation
|
106
|
if ((user==null) && (groups==null || groups.length==0))
|
107
|
{
|
108
|
return true;
|
109
|
}
|
110
|
|
111
|
//create a userpackage including user, public and group member
|
112
|
userPackage=createUsersPackage(user, groups);
|
113
|
|
114
|
//if the requested document is access documents and requested permission
|
115
|
//is "write", the user should have "all" right
|
116
|
|
117
|
if (isAccessDocument(docId) && (permission == AccessControlInterface.WRITE))
|
118
|
{
|
119
|
|
120
|
hasPermission = hasPermission(userPackage,docId, 7);// 7 is all permission
|
121
|
}//if
|
122
|
else //in other situation, just check the request permission
|
123
|
{
|
124
|
|
125
|
|
126
|
// Check for @permission on @docid for @user and/or @groups
|
127
|
hasPermission = hasPermission(userPackage,docId, permission);
|
128
|
|
129
|
}//else
|
130
|
|
131
|
return hasPermission;
|
132
|
}
|
133
|
|
134
|
|
135
|
/**
|
136
|
* Check from db connection if the users in String array @principals has
|
137
|
* @permission on @docid*
|
138
|
* @param principals, names in userPakcage need to check for @permission
|
139
|
* @param docid, document identifier to check on
|
140
|
* @param permission, permission (write or all...) to check for
|
141
|
*/
|
142
|
private boolean hasPermission(String [] principals, String docId,
|
143
|
int permission)
|
144
|
throws SQLException
|
145
|
{
|
146
|
long startId = TOPLEVELSTARTNODEID;// this is for top level, so startid is 0
|
147
|
try
|
148
|
{
|
149
|
//first, if there is a docid owner in user package, return true
|
150
|
//because doc owner has all permssion
|
151
|
if (containDocumentOwner(principals, docId))
|
152
|
{
|
153
|
|
154
|
return true;
|
155
|
}
|
156
|
|
157
|
//If there is no owner in user package, checking the table
|
158
|
//check perm_order
|
159
|
if (isAllowFirst(principals, docId, startId))
|
160
|
{
|
161
|
|
162
|
if (hasExplicitDenyRule(principals, docId, permission, startId))
|
163
|
{
|
164
|
//if it is allowfirst and has deny rule(either explicit )
|
165
|
//deny access
|
166
|
|
167
|
return false;
|
168
|
}//if
|
169
|
else if ( hasAllowRule(principals, docId, permission, startId))
|
170
|
{
|
171
|
//if it is allowfirst and hasn't deny rule and has allow rule
|
172
|
//allow access
|
173
|
|
174
|
return true;
|
175
|
}//else if
|
176
|
else
|
177
|
{
|
178
|
//other situation deny access
|
179
|
|
180
|
return false;
|
181
|
}//else
|
182
|
}//if isAllowFirst
|
183
|
else //denyFirst
|
184
|
{
|
185
|
if (hasAllowRule(principals, docId, permission, startId))
|
186
|
{
|
187
|
//if it is denyFirst and has allow rule, allow access
|
188
|
return true;
|
189
|
}
|
190
|
else
|
191
|
{
|
192
|
//if it is denyfirst but no allow rule, deny access
|
193
|
return false;
|
194
|
}
|
195
|
}//else denyfirst
|
196
|
}//try
|
197
|
catch (Exception e)
|
198
|
{
|
199
|
logMetacat.warn("There is a exception in hasPermission method: "
|
200
|
+e.getMessage());
|
201
|
}
|
202
|
|
203
|
return false;
|
204
|
}//hasPermission
|
205
|
|
206
|
/**
|
207
|
* Method to check if a person has permission to a inline data file
|
208
|
* @param user String
|
209
|
* @param groups String[]
|
210
|
* @param myPermission String
|
211
|
* @param inlineDataId String
|
212
|
* @throws McdbException
|
213
|
* @return boolean
|
214
|
*/
|
215
|
private boolean hasPermissionForInlineData(String user, String[] groups,
|
216
|
String myPermission, String inlineDataId)
|
217
|
throws Exception
|
218
|
{
|
219
|
// this method can call the public method - hasPermission(...)
|
220
|
// the only difference is about the ownership, you couldn't find the owner
|
221
|
// from inlinedataId directly. You should get it from eml document itself
|
222
|
String []userPackage = createUsersPackage(user, groups);
|
223
|
if (containDocumentOwner(userPackage, docId))
|
224
|
{
|
225
|
return true;
|
226
|
}
|
227
|
else
|
228
|
{
|
229
|
PermissionController controller =
|
230
|
new PermissionController(inlineDataId, false);
|
231
|
return controller.hasPermission(user, groups, myPermission);
|
232
|
}
|
233
|
}
|
234
|
|
235
|
/**
|
236
|
* The method to determine of a node can be access by a user just by subtree
|
237
|
* access control
|
238
|
*/
|
239
|
public boolean hasPermissionForSubTreeNode(String user, String[] groups,
|
240
|
String myPermission, long nodeId)
|
241
|
throws McdbException
|
242
|
{
|
243
|
boolean flag = true;
|
244
|
// Get unaccessble subtree for this user
|
245
|
Hashtable unaccessableSubTree = hasUnaccessableSubTree(user, groups,
|
246
|
myPermission);
|
247
|
Enumeration en = unaccessableSubTree.elements();
|
248
|
while (en.hasMoreElements())
|
249
|
{
|
250
|
SubTree tree = (SubTree)en.nextElement();
|
251
|
long start = tree.getStartNodeId();
|
252
|
long stop = tree.getEndNodeId();
|
253
|
// nodeid in unaccessablesubtree, return false
|
254
|
if ( nodeId >= start && nodeId <= stop)
|
255
|
{
|
256
|
flag = false;
|
257
|
break;
|
258
|
}
|
259
|
}
|
260
|
return flag;
|
261
|
}
|
262
|
/**
|
263
|
* This method will return a hasTable of subtree which user doesn't has the
|
264
|
* permssion to access
|
265
|
* @param user the user name
|
266
|
* @param groups the groups which the use is in
|
267
|
* @param myPermission permission type to check for
|
268
|
*/
|
269
|
public Hashtable hasUnaccessableSubTree(String user, String[] groups,
|
270
|
String myPermission) throws McdbException
|
271
|
{
|
272
|
Hashtable resultUnaccessableSubTree = new Hashtable();
|
273
|
String [] principals=null;
|
274
|
int permission =AccessControlList.intValue(myPermission);
|
275
|
|
276
|
//for the commnad line invocation return null(no unaccessable subtree)
|
277
|
if ((user==null) && (groups==null || groups.length==0))
|
278
|
{
|
279
|
return resultUnaccessableSubTree;
|
280
|
}
|
281
|
|
282
|
//create a userpackage including user, public and group member
|
283
|
principals=createUsersPackage(user, groups);
|
284
|
//for the document owner return null(no unaccessable subtree)
|
285
|
try
|
286
|
{
|
287
|
if (containDocumentOwner(principals, docId))
|
288
|
{
|
289
|
return resultUnaccessableSubTree;
|
290
|
}
|
291
|
}
|
292
|
catch (SQLException ee)
|
293
|
{
|
294
|
throw new McdbException(ee);
|
295
|
}
|
296
|
|
297
|
// go through every subtree which has access control
|
298
|
for (int i = 0; i< subTreeList.size(); i++)
|
299
|
{
|
300
|
SubTree tree = (SubTree)subTreeList.elementAt(i);
|
301
|
long startId = tree.getStartNodeId();
|
302
|
|
303
|
|
304
|
try
|
305
|
{
|
306
|
if (isAllowFirst(principals, docId, startId))
|
307
|
{
|
308
|
|
309
|
if (hasExplicitDenyRule(principals, docId, permission, startId ))
|
310
|
{
|
311
|
|
312
|
//if it is allowfirst and has deny rule
|
313
|
// put the subtree into unaccessable vector
|
314
|
if (!resultUnaccessableSubTree.containsKey(new Long(startId)))
|
315
|
{
|
316
|
resultUnaccessableSubTree.put(new Long(startId), tree);
|
317
|
}
|
318
|
}//if
|
319
|
else if ( hasAllowRule(principals, docId, permission, startId))
|
320
|
{
|
321
|
//if it is allowfirst and hasn't deny rule and has allow rule
|
322
|
//allow access do nothing
|
323
|
|
324
|
}//else if
|
325
|
else
|
326
|
{
|
327
|
//other situation deny access
|
328
|
if (!resultUnaccessableSubTree.containsKey(new Long(startId)))
|
329
|
{
|
330
|
resultUnaccessableSubTree.put(new Long(startId), tree);
|
331
|
}
|
332
|
|
333
|
}//else
|
334
|
}//if isAllowFirst
|
335
|
else //denyFirst
|
336
|
{
|
337
|
if (hasAllowRule(principals, docId, permission,startId))
|
338
|
{
|
339
|
//if it is denyFirst and has allow rule, allow access, do nothing
|
340
|
|
341
|
}
|
342
|
else
|
343
|
{
|
344
|
//if it is denyfirst but no allow rule, deny access
|
345
|
// add into vector
|
346
|
if (!resultUnaccessableSubTree.containsKey(new Long(startId)))
|
347
|
{
|
348
|
resultUnaccessableSubTree.put(new Long(startId), tree);
|
349
|
}
|
350
|
}
|
351
|
}//else denyfirst
|
352
|
}//try
|
353
|
catch( Exception e)
|
354
|
{
|
355
|
logMetacat.error("error in PermissionControl.has" +
|
356
|
"UnaccessableSubTree "+e.getMessage());
|
357
|
throw new McdbException(e);
|
358
|
}
|
359
|
|
360
|
}//for
|
361
|
// merge the subtree if a subtree is another subtree'subtree
|
362
|
resultUnaccessableSubTree = mergeEquivalentSubtree(resultUnaccessableSubTree);
|
363
|
return resultUnaccessableSubTree;
|
364
|
}//hasUnaccessableSubtree
|
365
|
|
366
|
|
367
|
/*
|
368
|
* A method to merge nested subtree into bigger one. For example subtree b
|
369
|
* is a subtree of subtree a. And user doesn't have read permission for both
|
370
|
* so we only use subtree a is enough.
|
371
|
*/
|
372
|
private Hashtable mergeEquivalentSubtree(Hashtable unAccessSubTree)
|
373
|
{
|
374
|
Hashtable newSubTreeHash = new Hashtable();
|
375
|
boolean needDelete = false;
|
376
|
// check the parameters
|
377
|
if (unAccessSubTree == null || unAccessSubTree.isEmpty())
|
378
|
{
|
379
|
return newSubTreeHash;
|
380
|
}
|
381
|
else
|
382
|
{
|
383
|
// look every subtree start point and stop point, to see if it is embedded
|
384
|
// in another one. If embedded, they are equavelent and we can use bigger
|
385
|
// one to replace smaller one
|
386
|
Enumeration en = unAccessSubTree.elements();
|
387
|
while (en.hasMoreElements())
|
388
|
{
|
389
|
SubTree tree = (SubTree)en.nextElement();
|
390
|
String treeId = tree.getSubTreeId();
|
391
|
long startId = tree.getStartNodeId();
|
392
|
long endId = tree.getEndNodeId();
|
393
|
|
394
|
Enumeration enu = unAccessSubTree.elements();
|
395
|
while (enu.hasMoreElements())
|
396
|
{
|
397
|
SubTree subTree = (SubTree)enu.nextElement();
|
398
|
String subTreeId= subTree.getSubTreeId();
|
399
|
long subTreeStartId = subTree.getStartNodeId();
|
400
|
long subTreeEndId = subTree.getEndNodeId();
|
401
|
//compare and if the first subtree is a subtree of the second
|
402
|
// one, set neeDelete true
|
403
|
if (startId > subTreeStartId && endId < subTreeEndId)
|
404
|
{
|
405
|
needDelete = true;
|
406
|
logMetacat.info("the subtree: "+ treeId +
|
407
|
" need to be get rid of from unaccessable"+
|
408
|
" subtree list becuase it is a subtree of"+
|
409
|
" another subtree in the list");
|
410
|
break;
|
411
|
}//if
|
412
|
}//while
|
413
|
// if not need to delete, put the subtree into hash
|
414
|
if (!needDelete)
|
415
|
{
|
416
|
newSubTreeHash.put(new Long(startId), tree);
|
417
|
}
|
418
|
//reset needDelete
|
419
|
needDelete = false;
|
420
|
}//while
|
421
|
return newSubTreeHash;
|
422
|
}//else
|
423
|
}
|
424
|
|
425
|
/**
|
426
|
* Check if a document id is a access document. Access document need user
|
427
|
* has "all" permission to access it.
|
428
|
*
|
429
|
* @param docId,
|
430
|
* the document id need to be checked
|
431
|
*/
|
432
|
private boolean isAccessDocument(String docId) throws SQLException {
|
433
|
// detele the rev number if docid contains it
|
434
|
docId = MetaCatUtil.getDocIdFromString(docId);
|
435
|
PreparedStatement pStmt = null;
|
436
|
DBConnection conn = null;
|
437
|
int serialNumber = -1;
|
438
|
try {
|
439
|
// check out DBConnection
|
440
|
conn = DBConnectionPool.getDBConnection("PermissionControl.isAccessDoc");
|
441
|
serialNumber = conn.getCheckOutSerialNumber();
|
442
|
pStmt = conn.prepareStatement("select doctype from xml_documents where "
|
443
|
+ "docid like '" + docId + "'");
|
444
|
pStmt.execute();
|
445
|
ResultSet rs = pStmt.getResultSet();
|
446
|
boolean hasRow = rs.next();
|
447
|
String doctype = null;
|
448
|
if (hasRow) {
|
449
|
doctype = rs.getString(1);
|
450
|
|
451
|
}
|
452
|
pStmt.close();
|
453
|
|
454
|
// if it is an access document
|
455
|
if (doctype != null
|
456
|
&& ((MetaCatUtil.getOptionList(PropertyService
|
457
|
.getProperty("xml.accessdoctype")).contains(doctype)))) {
|
458
|
|
459
|
return true;
|
460
|
}
|
461
|
|
462
|
} catch (SQLException e) {
|
463
|
throw new SQLException("PermissionControl.isAccessDocument "
|
464
|
+ "Error checking" + " on document " + docId + ". " + e.getMessage());
|
465
|
} catch (PropertyNotFoundException pnfe) {
|
466
|
throw new SQLException("PermissionControl.isAccessDocument "
|
467
|
+ "Error checking" + " on document " + docId + ". " + pnfe.getMessage());
|
468
|
} finally {
|
469
|
try {
|
470
|
pStmt.close();
|
471
|
} finally {
|
472
|
DBConnectionPool.returnDBConnection(conn, serialNumber);
|
473
|
}
|
474
|
}
|
475
|
|
476
|
return false;
|
477
|
}// isAccessDocument
|
478
|
|
479
|
|
480
|
|
481
|
/**
|
482
|
* Check if a stirng array contains a given documents' owner
|
483
|
*
|
484
|
* @param principals,
|
485
|
* a string array storing the username, groups name and public.
|
486
|
* @param docid,
|
487
|
* the id of given documents
|
488
|
*/
|
489
|
private boolean containDocumentOwner( String[] principals, String docId)
|
490
|
throws SQLException
|
491
|
{
|
492
|
int lengthOfArray=principals.length;
|
493
|
boolean hasRow;
|
494
|
PreparedStatement pStmt=null;
|
495
|
DBConnection conn = null;
|
496
|
int serialNumber = -1;
|
497
|
|
498
|
try
|
499
|
{
|
500
|
//check out DBConnection
|
501
|
conn=DBConnectionPool.getDBConnection("PermissionControl.containDocOnwer");
|
502
|
serialNumber=conn.getCheckOutSerialNumber();
|
503
|
pStmt = conn.prepareStatement(
|
504
|
"SELECT 'x' FROM xml_documents " +
|
505
|
"WHERE docid = ? AND lower(user_owner) = ?");
|
506
|
//check every element in the string array too see if it conatains
|
507
|
//the owner of document
|
508
|
for (int i=0; i<lengthOfArray; i++)
|
509
|
{
|
510
|
|
511
|
// Bind the values to the query
|
512
|
pStmt.setString(1, docId);
|
513
|
pStmt.setString(2, principals[i]);
|
514
|
logMetacat.info("the principle stack is : " +
|
515
|
principals[i]);
|
516
|
|
517
|
pStmt.execute();
|
518
|
ResultSet rs = pStmt.getResultSet();
|
519
|
hasRow = rs.next();
|
520
|
if (hasRow)
|
521
|
{
|
522
|
pStmt.close();
|
523
|
logMetacat.info("find the owner");
|
524
|
return true;
|
525
|
}//if
|
526
|
|
527
|
}//for
|
528
|
}//try
|
529
|
catch (SQLException e)
|
530
|
{
|
531
|
pStmt.close();
|
532
|
|
533
|
throw new
|
534
|
SQLException("PermissionControl.hasPermission(). " +
|
535
|
"Error checking ownership for " + principals[0] +
|
536
|
" on document #" + docId + ". " + e.getMessage());
|
537
|
}//catch
|
538
|
finally
|
539
|
{
|
540
|
try
|
541
|
{
|
542
|
pStmt.close();
|
543
|
}
|
544
|
finally
|
545
|
{
|
546
|
DBConnectionPool.returnDBConnection(conn, serialNumber);
|
547
|
}
|
548
|
}
|
549
|
return false;
|
550
|
}//containDocumentOwner
|
551
|
|
552
|
/**
|
553
|
* Check if the permission order for user at that documents is allowFirst
|
554
|
* @param principals, list of names of principals to check for
|
555
|
* @param docid, document identifier to check for
|
556
|
*/
|
557
|
private boolean isAllowFirst(String [] principals, String docId,
|
558
|
long startId)
|
559
|
throws SQLException, Exception
|
560
|
{
|
561
|
int lengthOfArray=principals.length;
|
562
|
boolean hasRow;
|
563
|
PreparedStatement pStmt = null;
|
564
|
DBConnection conn = null;
|
565
|
int serialNumber = -1;
|
566
|
String sql = null;
|
567
|
boolean topLever =false;
|
568
|
if (startId == TOPLEVELSTARTNODEID)
|
569
|
{
|
570
|
//top level
|
571
|
topLever = true;
|
572
|
sql = "SELECT perm_order FROM xml_access " +
|
573
|
"WHERE lower(principal_name) = ? AND docid = ? AND startnodeid is NULL";
|
574
|
}
|
575
|
else
|
576
|
{
|
577
|
//sub tree level
|
578
|
sql = "SELECT perm_order FROM xml_access " +
|
579
|
"WHERE lower(principal_name)= ? AND docid = ? AND startnodeid = ?";
|
580
|
}
|
581
|
|
582
|
try
|
583
|
{
|
584
|
//check out DBConnection
|
585
|
conn=DBConnectionPool.getDBConnection("AccessControlList.isAllowFirst");
|
586
|
serialNumber=conn.getCheckOutSerialNumber();
|
587
|
|
588
|
//select permission order from database
|
589
|
pStmt = conn.prepareStatement(sql);
|
590
|
|
591
|
//check every name in the array
|
592
|
for (int i=0; i<lengthOfArray;i++)
|
593
|
{
|
594
|
//bind value
|
595
|
pStmt.setString(1, principals[i]);//user name
|
596
|
pStmt.setString(2, docId);//docid
|
597
|
|
598
|
// if subtree, we need set subtree id
|
599
|
if (!topLever)
|
600
|
{
|
601
|
pStmt.setLong(3, startId);
|
602
|
}
|
603
|
|
604
|
pStmt.execute();
|
605
|
ResultSet rs = pStmt.getResultSet();
|
606
|
hasRow=rs.next();
|
607
|
if (hasRow)
|
608
|
{
|
609
|
//get the permission order from data base
|
610
|
String permissionOrder=rs.getString(1);
|
611
|
//if the permission order is "allowFirst
|
612
|
if (permissionOrder.equalsIgnoreCase(AccessControlInterface.ALLOWFIRST))
|
613
|
{
|
614
|
pStmt.close();
|
615
|
return true;
|
616
|
}
|
617
|
else
|
618
|
{
|
619
|
pStmt.close();
|
620
|
return false;
|
621
|
}
|
622
|
}//if
|
623
|
}//for
|
624
|
}//try
|
625
|
catch (SQLException e)
|
626
|
{
|
627
|
throw e;
|
628
|
}
|
629
|
finally
|
630
|
{
|
631
|
try
|
632
|
{
|
633
|
pStmt.close();
|
634
|
}
|
635
|
finally
|
636
|
{
|
637
|
DBConnectionPool.returnDBConnection(conn, serialNumber);
|
638
|
}
|
639
|
}
|
640
|
|
641
|
//if reach here, means there is no permssion record for given names and
|
642
|
//docid. So throw a exception.
|
643
|
|
644
|
throw new Exception("There is no permission record for user"+principals[0]+
|
645
|
"at document "+docId);
|
646
|
|
647
|
}//isAllowFirst
|
648
|
|
649
|
/**
|
650
|
* Check if the permission order for user at that documents is allowFirst
|
651
|
* @param principals, list of names of principals to check for
|
652
|
* @param docid, document identifier to check for
|
653
|
*/
|
654
|
public Vector<AccessControlForSingleFile> getAccessControl()
|
655
|
throws SQLException, Exception
|
656
|
{
|
657
|
Vector<AccessControlForSingleFile> accessControl = new Vector<AccessControlForSingleFile>();
|
658
|
boolean hasRow;
|
659
|
PreparedStatement pStmt = null;
|
660
|
DBConnection conn = null;
|
661
|
int serialNumber = -1;
|
662
|
String sql = null;
|
663
|
boolean topLever =false;
|
664
|
sql = "SELECT principal_name, permission, perm_type, perm_order FROM xml_access ";
|
665
|
|
666
|
//TODO, need this?
|
667
|
long startId = 0;
|
668
|
if (startId == TOPLEVELSTARTNODEID)
|
669
|
{
|
670
|
//top level
|
671
|
topLever = true;
|
672
|
sql += "WHERE docid = ? AND startnodeid is NULL";
|
673
|
}
|
674
|
else
|
675
|
{
|
676
|
//sub tree level
|
677
|
sql += "WHERE docid = ? AND startnodeid = ?";
|
678
|
}
|
679
|
|
680
|
try
|
681
|
{
|
682
|
//check out DBConnection
|
683
|
conn=DBConnectionPool.getDBConnection("AccessControlList.getPermissions");
|
684
|
serialNumber=conn.getCheckOutSerialNumber();
|
685
|
|
686
|
//select permission order from database
|
687
|
pStmt = conn.prepareStatement(sql);
|
688
|
|
689
|
//bind value
|
690
|
pStmt.setString(1, docId);//docid
|
691
|
|
692
|
// if subtree, we need set subtree id
|
693
|
if (!topLever)
|
694
|
{
|
695
|
pStmt.setLong(2, startId);
|
696
|
}
|
697
|
|
698
|
pStmt.execute();
|
699
|
ResultSet rs = pStmt.getResultSet();
|
700
|
while (rs.next())
|
701
|
{
|
702
|
//get the permission order from data base
|
703
|
String principalName=rs.getString(1);
|
704
|
String permission=rs.getString(2);
|
705
|
String permType=rs.getString(3);
|
706
|
String permOrder=rs.getString(4);
|
707
|
|
708
|
//translate to string version
|
709
|
String myPermission = AccessControlList.txtValue(Integer.parseInt(permission));
|
710
|
|
711
|
//make it into an object
|
712
|
AccessControlForSingleFile acfsf =
|
713
|
new AccessControlForSingleFile(docId, principalName, myPermission, permType, permOrder);
|
714
|
accessControl.add(acfsf);
|
715
|
}
|
716
|
pStmt.close();
|
717
|
}//try
|
718
|
catch (SQLException e)
|
719
|
{
|
720
|
throw e;
|
721
|
}
|
722
|
finally
|
723
|
{
|
724
|
try
|
725
|
{
|
726
|
pStmt.close();
|
727
|
}
|
728
|
finally
|
729
|
{
|
730
|
DBConnectionPool.returnDBConnection(conn, serialNumber);
|
731
|
}
|
732
|
}
|
733
|
|
734
|
return accessControl;
|
735
|
|
736
|
}//getPermissions
|
737
|
|
738
|
/**
|
739
|
* Check if the users array has allow rules for given users, docid and
|
740
|
* permission.
|
741
|
* If it has permission rule and ticket count is greater than 0, the ticket
|
742
|
* number will decrease one for every allow rule
|
743
|
* @param principals, list of names of principals to check for
|
744
|
* @param docid, document identifier to check for
|
745
|
* @param permission, the permssion need to check
|
746
|
*/
|
747
|
private boolean hasAllowRule(String [] principals, String docId,
|
748
|
int permission, long startId)
|
749
|
throws SQLException, Exception
|
750
|
{
|
751
|
int lengthOfArray=principals.length;
|
752
|
boolean allow=false;//initial value is no allow rule
|
753
|
ResultSet rs;
|
754
|
PreparedStatement pStmt = null;
|
755
|
int permissionValue=permission;
|
756
|
int permissionValueInTable;
|
757
|
int ticketCount;
|
758
|
DBConnection conn = null;
|
759
|
int serialNumber = -1;
|
760
|
boolean topLever = false;
|
761
|
String sql = null;
|
762
|
if (startId == TOPLEVELSTARTNODEID)
|
763
|
{
|
764
|
// for toplevel
|
765
|
topLever = true;
|
766
|
sql = "SELECT permission FROM xml_access WHERE docid = ? " +
|
767
|
"AND lower(principal_name) = ? AND perm_type = ? AND startnodeid is NULL";
|
768
|
}
|
769
|
else
|
770
|
{
|
771
|
topLever =false;
|
772
|
sql = "SELECT permission FROM xml_access WHERE docid = ? " +
|
773
|
"AND lower(principal_name) = ? AND perm_type = ? AND startnodeid = ?";
|
774
|
}
|
775
|
try
|
776
|
{
|
777
|
//check out DBConnection
|
778
|
conn=DBConnectionPool.getDBConnection("AccessControlList.hasAllowRule");
|
779
|
serialNumber=conn.getCheckOutSerialNumber();
|
780
|
//This sql statement will select entry with
|
781
|
//begin_time<=currentTime<=end_time in xml_access table
|
782
|
//If begin_time or end_time is null in table, isnull(begin_time, sysdate)
|
783
|
//function will assign begin_time=sysdate
|
784
|
pStmt = conn.prepareStatement(sql);
|
785
|
//bind docid, perm_type
|
786
|
pStmt.setString(1, docId);
|
787
|
pStmt.setString(3, AccessControlInterface.ALLOW);
|
788
|
|
789
|
// if subtree lever, need to set subTreeId
|
790
|
if (!topLever)
|
791
|
{
|
792
|
pStmt.setLong(4, startId);
|
793
|
}
|
794
|
|
795
|
//bind every elenment in user name array
|
796
|
for (int i=0;i<lengthOfArray; i++)
|
797
|
{
|
798
|
pStmt.setString(2, principals[i]);
|
799
|
pStmt.execute();
|
800
|
rs=pStmt.getResultSet();
|
801
|
while (rs.next())//check every entry for one user
|
802
|
{
|
803
|
permissionValueInTable=rs.getInt(1);
|
804
|
|
805
|
//permission is ok
|
806
|
//the user have a permission to access the file
|
807
|
if (( permissionValueInTable & permissionValue )== permissionValue )
|
808
|
{
|
809
|
|
810
|
allow=true;//has allow rule entry
|
811
|
}//if
|
812
|
}//while
|
813
|
}//for
|
814
|
}//try
|
815
|
catch (SQLException sqlE)
|
816
|
{
|
817
|
throw sqlE;
|
818
|
}
|
819
|
catch (Exception e)
|
820
|
{
|
821
|
throw e;
|
822
|
}
|
823
|
finally
|
824
|
{
|
825
|
try
|
826
|
{
|
827
|
pStmt.close();
|
828
|
}
|
829
|
finally
|
830
|
{
|
831
|
DBConnectionPool.returnDBConnection(conn, serialNumber);
|
832
|
}
|
833
|
}
|
834
|
return allow;
|
835
|
}//hasAllowRule
|
836
|
|
837
|
|
838
|
|
839
|
/**
|
840
|
* Check if the users array has explicit deny rules for given users, docid
|
841
|
* and permission. That means the perm_type is deny and current time is
|
842
|
* less than end_time and greater than begin time, or no time limit.
|
843
|
* @param principals, list of names of principals to check for
|
844
|
* @param docid, document identifier to check for
|
845
|
* @param permission, the permssion need to check
|
846
|
*/
|
847
|
private boolean hasExplicitDenyRule(String [] principals, String docId,
|
848
|
int permission, long startId)
|
849
|
throws SQLException
|
850
|
{
|
851
|
int lengthOfArray=principals.length;
|
852
|
ResultSet rs;
|
853
|
PreparedStatement pStmt = null;
|
854
|
int permissionValue=permission;
|
855
|
int permissionValueInTable;
|
856
|
DBConnection conn = null;
|
857
|
int serialNumber = -1;
|
858
|
String sql = null;
|
859
|
boolean topLevel = false;
|
860
|
|
861
|
// decide top level or subtree level
|
862
|
if (startId == TOPLEVELSTARTNODEID)
|
863
|
{
|
864
|
topLevel = true;
|
865
|
sql = "SELECT permission FROM xml_access WHERE docid = ? " +
|
866
|
"AND lower(principal_name) = ? AND perm_type = ? AND startnodeid is NULL";
|
867
|
}
|
868
|
else
|
869
|
{
|
870
|
topLevel = false;
|
871
|
sql = "SELECT permission FROM xml_access WHERE docid = ? " +
|
872
|
"AND lower(principal_name) = ? AND perm_type = ? AND startnodeid = ?";
|
873
|
}
|
874
|
|
875
|
try
|
876
|
{
|
877
|
//check out DBConnection
|
878
|
conn=DBConnectionPool.getDBConnection("PermissionControl.hasExplicitDeny");
|
879
|
serialNumber=conn.getCheckOutSerialNumber();
|
880
|
|
881
|
pStmt = conn.prepareStatement(sql);
|
882
|
//bind docid, perm_type
|
883
|
pStmt.setString(1, docId);
|
884
|
pStmt.setString(3, AccessControlInterface.DENY);
|
885
|
|
886
|
// subtree level need to set up subtreeid
|
887
|
if (!topLevel)
|
888
|
{
|
889
|
pStmt.setLong(4, startId);
|
890
|
}
|
891
|
|
892
|
//bind every elenment in user name array
|
893
|
for (int i=0;i<lengthOfArray; i++)
|
894
|
{
|
895
|
pStmt.setString(2, principals[i]);
|
896
|
pStmt.execute();
|
897
|
rs=pStmt.getResultSet();
|
898
|
while (rs.next())//check every entry for one user
|
899
|
{
|
900
|
permissionValueInTable=rs.getInt(1);
|
901
|
|
902
|
//permission is ok the user doesn't have permission to access the file
|
903
|
if (( permissionValueInTable & permissionValue )== permissionValue )
|
904
|
|
905
|
{
|
906
|
pStmt.close();
|
907
|
return true;
|
908
|
}//if
|
909
|
}//while
|
910
|
}//for
|
911
|
}//try
|
912
|
catch (SQLException e)
|
913
|
{
|
914
|
throw e;
|
915
|
}//catch
|
916
|
finally
|
917
|
{
|
918
|
try
|
919
|
{
|
920
|
pStmt.close();
|
921
|
}
|
922
|
finally
|
923
|
{
|
924
|
DBConnectionPool.returnDBConnection(conn, serialNumber);
|
925
|
}
|
926
|
}//finally
|
927
|
return false;//no deny rule
|
928
|
}//hasExplicitDenyRule
|
929
|
|
930
|
|
931
|
/**
|
932
|
* Creat a users pakages to check permssion rule, user itself, public and
|
933
|
* the gourps the user belong will be include in this package
|
934
|
* @param user, the name of user
|
935
|
* @param groups, the string array of the groups that user belong to
|
936
|
*/
|
937
|
private String[] createUsersPackage(String user, String [] groups)
|
938
|
{
|
939
|
String [] usersPackage=null;
|
940
|
int lengthOfPackage;
|
941
|
|
942
|
if (groups!=null)
|
943
|
{
|
944
|
//if gouprs is not null and user is not public, we should create a array
|
945
|
//to store the groups and user and public.
|
946
|
//So the length of userPackage is the length of group plus two
|
947
|
if (!user.equalsIgnoreCase(AccessControlInterface.PUBLIC))
|
948
|
{
|
949
|
lengthOfPackage=(groups.length)+2;
|
950
|
usersPackage=new String [lengthOfPackage];
|
951
|
//the first two elements is user self and public
|
952
|
//in order to ignore case sensitive, we transfer user to lower case
|
953
|
if (user != null)
|
954
|
{
|
955
|
usersPackage[0]= user.toLowerCase();
|
956
|
logMetacat.info("after transfer to lower case(not null): "+
|
957
|
usersPackage[0]);
|
958
|
}
|
959
|
else
|
960
|
{
|
961
|
usersPackage[0] = user;
|
962
|
usersPackage[0]= user.toLowerCase();
|
963
|
logMetacat.info("after transfer to lower case(null): "+
|
964
|
usersPackage[0]);
|
965
|
}
|
966
|
usersPackage[1]=AccessControlInterface.PUBLIC;
|
967
|
//put groups element from index 0 to lengthOfPackage-3 into userPackage
|
968
|
//from index 2 to lengthOfPackage-1
|
969
|
for (int i=2; i<lengthOfPackage; i++)
|
970
|
{
|
971
|
//tansfer group to lower case too
|
972
|
if (groups[i-2] != null)
|
973
|
{
|
974
|
usersPackage[i]=groups[i-2].toLowerCase();
|
975
|
}
|
976
|
} //for
|
977
|
}//if user!=public
|
978
|
else//use=public
|
979
|
{
|
980
|
lengthOfPackage=(groups.length)+1;
|
981
|
usersPackage=new String [lengthOfPackage];
|
982
|
//the first lements is public
|
983
|
usersPackage[0]=AccessControlInterface.PUBLIC;
|
984
|
//put groups element from index 0 to lengthOfPackage-2 into userPackage
|
985
|
//from index 1 to lengthOfPackage-1
|
986
|
for (int i=1; i<lengthOfPackage; i++)
|
987
|
{
|
988
|
if (groups[i-1] != null)
|
989
|
{
|
990
|
usersPackage[i]=groups[i-1].toLowerCase();
|
991
|
}
|
992
|
} //for
|
993
|
}//else user=public
|
994
|
|
995
|
}//if groups!=null
|
996
|
else
|
997
|
{
|
998
|
//because no groups, the userPackage only need two elements
|
999
|
//one is for user, the other is for public
|
1000
|
if (!user.equalsIgnoreCase(AccessControlInterface.PUBLIC))
|
1001
|
{
|
1002
|
lengthOfPackage=2;
|
1003
|
usersPackage=new String [lengthOfPackage];
|
1004
|
if (user != null)
|
1005
|
{
|
1006
|
usersPackage[0]=user.toLowerCase();
|
1007
|
}
|
1008
|
else
|
1009
|
{
|
1010
|
usersPackage[0]=user;
|
1011
|
}
|
1012
|
usersPackage[1]=AccessControlInterface.PUBLIC;
|
1013
|
}//if user!=public
|
1014
|
else //user==public
|
1015
|
{
|
1016
|
//only put public into array
|
1017
|
lengthOfPackage=1;
|
1018
|
usersPackage=new String [lengthOfPackage];
|
1019
|
usersPackage[0]=AccessControlInterface.PUBLIC;
|
1020
|
}
|
1021
|
}//else groups==null
|
1022
|
return usersPackage;
|
1023
|
}//createUsersPackage
|
1024
|
|
1025
|
|
1026
|
/**
|
1027
|
* A static method to get Hashtable which cointains a inlinedata object list that
|
1028
|
* user can't read it. The key is subtree id of inlinedata, the data is
|
1029
|
* internal file name for the inline data which is stored as docid
|
1030
|
* in xml_access table or data object doc id.
|
1031
|
* @param docidWithoutRev, metadata docid which should be the accessfileid
|
1032
|
* in the table
|
1033
|
* @param user , the name of user
|
1034
|
* @param groups, the group which the user belong to
|
1035
|
*/
|
1036
|
public static Hashtable<String, String> getUnReadableInlineDataIdList(String docidWithoutRev,
|
1037
|
String user, String[] groups,
|
1038
|
boolean withRevision)
|
1039
|
throws Exception
|
1040
|
{
|
1041
|
Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docidWithoutRev,
|
1042
|
user, groups, AccessControlInterface.READSTRING,
|
1043
|
withRevision);
|
1044
|
|
1045
|
return inlineDataList;
|
1046
|
}
|
1047
|
|
1048
|
/**
|
1049
|
* A static method to get Hashtable which cointains a inline data object list that
|
1050
|
* user can't overwrite it. The key is subtree id of inline data distrubition,
|
1051
|
* the value is internal file name for the inline data which is stored as docid
|
1052
|
* in xml_access table or data object doc id.
|
1053
|
* @param docidWithoutRev, metadata docid which should be the accessfileid
|
1054
|
* in the table
|
1055
|
* @param user , the name of user
|
1056
|
* @param groups, the group which the user belong to
|
1057
|
*/
|
1058
|
public static Hashtable<String, String> getUnWritableInlineDataIdList(String docidWithoutRev,
|
1059
|
String user, String[] groups,
|
1060
|
boolean withRevision)
|
1061
|
throws Exception
|
1062
|
{
|
1063
|
Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docidWithoutRev,
|
1064
|
user, groups, AccessControlInterface.WRITESTRING,
|
1065
|
withRevision);
|
1066
|
|
1067
|
return inlineDataList;
|
1068
|
}
|
1069
|
|
1070
|
|
1071
|
/*
|
1072
|
* This method will get hashtable which contains a unaccessable distribution
|
1073
|
* inlinedata object list
|
1074
|
*
|
1075
|
* withRevision is used to get inline id list with or without revision number
|
1076
|
* e.g. when withRevision is true, temp.1.1.1, temp.1.1.2 would be returned
|
1077
|
* otherwise temp.1.1 and temp.1.2 would be returned.
|
1078
|
*/
|
1079
|
private static Hashtable<String, String> getUnAccessableInlineDataIdList(String docid,
|
1080
|
String user, String[] groups, String permission,
|
1081
|
boolean withRevision)
|
1082
|
throws SQLException,McdbException, Exception
|
1083
|
{
|
1084
|
Hashtable<String, String> unAccessibleIdList = new Hashtable();
|
1085
|
Hashtable allIdList = getAllInlineDataIdList(docid);
|
1086
|
Enumeration<String> en = allIdList.keys();
|
1087
|
while (en.hasMoreElements())
|
1088
|
{
|
1089
|
String subTreeId = (String) en.nextElement();
|
1090
|
String fileId = (String) allIdList.get(subTreeId);
|
1091
|
//Here fileid is internal file id for line data. It stored in docid
|
1092
|
// field in xml_access table. so we don't need to delete rev
|
1093
|
PermissionController controller = new PermissionController(docid, false);
|
1094
|
if (!controller.hasPermissionForInlineData(user, groups, permission, fileId))
|
1095
|
{
|
1096
|
if(withRevision)
|
1097
|
{
|
1098
|
logMetacat.info("Put subtree id " + subTreeId +
|
1099
|
" and " + "inline data file name " +
|
1100
|
fileId + " into " + "un" + permission +
|
1101
|
" hash");
|
1102
|
unAccessibleIdList.put(subTreeId, fileId);
|
1103
|
|
1104
|
}
|
1105
|
else
|
1106
|
{
|
1107
|
logMetacat.info("Put subtree id " + subTreeId +
|
1108
|
" and " + "inline data file name " +
|
1109
|
MetaCatUtil.
|
1110
|
getInlineDataIdWithoutRev(fileId) +
|
1111
|
" into " + "un" + permission +
|
1112
|
" hash");
|
1113
|
unAccessibleIdList.put(subTreeId, MetaCatUtil.
|
1114
|
getInlineDataIdWithoutRev(fileId));
|
1115
|
}
|
1116
|
}
|
1117
|
}
|
1118
|
return unAccessibleIdList;
|
1119
|
}
|
1120
|
|
1121
|
|
1122
|
/*
|
1123
|
* This method will get a hash table from xml_access table for all records
|
1124
|
* about the inline data. The key is subtree id and data is a inline internal
|
1125
|
* file name
|
1126
|
*/
|
1127
|
private static Hashtable getAllInlineDataIdList(String docid) throws SQLException
|
1128
|
{
|
1129
|
Hashtable inlineDataList = new Hashtable();
|
1130
|
String sql = "SELECT subtreeid, docid FROM xml_access WHERE " +
|
1131
|
"accessfileid = ? AND subtreeid IS NOT NULL";
|
1132
|
PreparedStatement pStmt=null;
|
1133
|
ResultSet rs=null;
|
1134
|
DBConnection conn=null;
|
1135
|
int serialNumber=-1;
|
1136
|
try
|
1137
|
{
|
1138
|
//check out DBConnection
|
1139
|
conn=DBConnectionPool.getDBConnection("PermissionControl.getDataSetId");
|
1140
|
serialNumber=conn.getCheckOutSerialNumber();
|
1141
|
pStmt=conn.prepareStatement(sql);
|
1142
|
//bind the value to query
|
1143
|
pStmt.setString(1, docid);
|
1144
|
//execute the query
|
1145
|
pStmt.execute();
|
1146
|
rs=pStmt.getResultSet();
|
1147
|
//process the result
|
1148
|
while(rs.next())
|
1149
|
{
|
1150
|
String subTreeId = rs.getString(1);
|
1151
|
String inlineDataId = rs.getString(2);
|
1152
|
if (subTreeId != null && !subTreeId.trim().equals("") &&
|
1153
|
inlineDataId != null && !inlineDataId.trim().equals(""))
|
1154
|
{
|
1155
|
inlineDataList.put(subTreeId, inlineDataId);
|
1156
|
}
|
1157
|
}//while
|
1158
|
}//try
|
1159
|
finally
|
1160
|
{
|
1161
|
try
|
1162
|
{
|
1163
|
pStmt.close();
|
1164
|
}
|
1165
|
finally
|
1166
|
{
|
1167
|
DBConnectionPool.returnDBConnection(conn, serialNumber);
|
1168
|
}
|
1169
|
}//finally
|
1170
|
return inlineDataList;
|
1171
|
}//getAllInlineDataIdList
|
1172
|
}
|