/ - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 570

Added by bojilova over 24 years ago

AccessControlList
- methods for parsing and loading acl file
- checkup method for permission for given principal on given resource
DBQuery
- checkup for READ permission using AccessControlList.hasPermission()
DocumentImpl
- using AccessControlList object to parse and load an acl file into xml_access table
- checkup for WRITE permission on UPDATE action using the same AccessControl.hasPermission()

             boolean tableHasRows = rs.next();
             while (tableHasRows) {
               docid = rs.getString(1);
               if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
               if ( !hasPermission(conn, user, group, docid) ) {continue;}
               docname = rs.getString(2);
               doctype = rs.getString(3);
               doctitle = rs.getString(4);
-...
               while(tableHasRows)
+              {
                 docid = rs.getString(1);
                 if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
                 if ( !hasPermission(conn, user, group, docid) ) {continue;}
                 fieldname = rs.getString(2);
                 fielddata = rs.getString(3);
-...
          return createQuery(value, "any");
+       }
       /** Check for "read" permissions from DB connection */
       private boolean hasReadPermission(Connection conn, String docid,
                                          String user, String group)
                                          throws SQLException {
       /**
         * Check for "READ" permission on @docid for @user and/or @group
         * from DB connection
         */
       private boolean hasPermission ( Connection conn, String user,
                                       String group, String docid )
                       throws SQLException
+      {
         // b' of the command line invocation
         if ( (user == null) && (group == null) ) {
           return true;
+        }
         PreparedStatement pstmt;
         // checking if user is owner of docid or if docid has public access
         try {
           pstmt = conn.prepareStatement(
                        "SELECT 'x' FROM xml_documents " +
                        "WHERE docid LIKE ? AND user_owner LIKE ? " +
                        "UNION " +
                        "SELECT 'x' FROM xml_documents " +
                        "WHERE docid LIKE ? AND public_access = 1");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.setString(3, docid);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           pstmt.close();
           if (hasRow) {
             return true;
+          }
         } catch (SQLException e) {
           throw new
             SQLException("Error checking document's owner or public access: "
                           + e.getMessage());
         // Check for READ permission on @docid for @user and/or @group
         AccessControlList aclobj = new AccessControlList(conn);
         boolean hasPermission = aclobj.hasPermission("READ",user,docid);
         if ( !hasPermission && group != null ) {
           hasPermission = aclobj.hasPermission("READ",group,docid);
+        }
         // checking if docid has public access at this time
         try {
           pstmt = conn.prepareStatement(
                        "SELECT 'x' FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name = 'public' " +
                        "AND principal_type = 'user' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate)");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           pstmt.close();
           if (hasRow) {
             return true;
+          }
         } catch (SQLException e) {
           throw new
             SQLException("Error checking doc's public access: " + e.getMessage());
+        }
         // checking access type from xml_access table
         int accesstype = 0;
         try {
           pstmt = conn.prepareStatement(
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'user' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate) " +
                        "UNION " +
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'group' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate)");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.setString(3, docid);
           pstmt.setString(4, group);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRows = rs.next();
           while ( hasRows ) {
             accesstype = rs.getInt(1);
             if ( (accesstype & READ) == READ ) {
               pstmt.close();
               return true;
+            }
             hasRows = rs.next();
+          }
           pstmt.close();
           return false;
         } catch (SQLException e) {
           throw new
           SQLException("Error getting document's permissions: " + e.getMessage());
+        }
         return hasPermission;
+      }
+    }

         if ( action.equals("UPDATE") ) {
           // check for 'write' permission for 'user' to update this document
           if ( !hasWritePermission(conn, docid, user, group) ) {
           if ( !hasPermission(conn, user, group, docid) ) {
             throw new Exception("User " + user +
                   " does not have permission to update XML Document #" + docid);
+          }
-...
         String newdocid = ac.generate(docid, "DELETE");
         // check for 'write' permission for 'user' to delete this document
         if ( !hasWritePermission(conn, docid, user, group) ) {
         if ( !hasPermission(conn, user, group, docid) ) {
           throw new Exception("User " + user +
                   " does not have permission to delete XML Document #" + docid);
+        }
-...
         conn.setAutoCommit(true);
+      }
       /** Check for "write" permissions from DB connection */
       private static boolean hasWritePermission(Connection conn, String docid,
                                          String user, String group)
                                          throws SQLException {
       /**
         * Check for "WRITE" permission on @docid for @user and/or @group
         * from DB connection
         */
       private static boolean hasPermission( Connection conn, String user,
                                             String group, String docid)
                              throws SQLException
+      {
         // b' of the command line invocation
         if ( (user == null) && (group == null) ) {
           return true;
+        }
         PreparedStatement pstmt;
         // checking if user is owner of docid
         try {
           pstmt = conn.prepareStatement(
                        "SELECT 'x' FROM xml_documents " +
                        "WHERE docid LIKE ? AND user_owner LIKE ?");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRow = rs.next();
           pstmt.close();
           if (hasRow) {
             return true;
+          }
         } catch (SQLException e) {
           throw new
             SQLException("Error checking document's owner: " + e.getMessage());
         // Check for WRITE permission on @docid for @user and/or @group
         AccessControlList aclobj = new AccessControlList(conn);
         boolean hasPermission = aclobj.hasPermission("WRITE",user,docid);
         if ( !hasPermission && group != null ) {
           hasPermission = aclobj.hasPermission("WRITE",group,docid);
+        }
         // checking access type from xml_access table
         int accesstype = 0;
         try {
           pstmt = conn.prepareStatement(
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'user' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate) " +
                        "UNION " +
                        "SELECT access_type FROM xml_access " +
                        "WHERE docid LIKE ? " +
                        "AND principal_name LIKE ? " +
                        "AND principal_type = 'group' " +
                        "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                        "AND nvl(end_time,sysdate)");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, user);
           pstmt.setString(3, docid);
           pstmt.setString(4, group);
           pstmt.execute();
           ResultSet rs = pstmt.getResultSet();
           boolean hasRows = rs.next();
           while ( hasRows ) {
             accesstype = rs.getInt(1);
             if ( (accesstype & WRITE) == WRITE ) {
               pstmt.close();
               return true;
+            }
             hasRows = rs.next();
+          }
           pstmt.close();
           return false;
         } catch (SQLException e) {
           throw new
           SQLException("Error getting document's permissions: " + e.getMessage());
+        }
         return hasPermission;
+      }
       /**

       static final int WRITE = 2;
       static final int READ = 4;
       private Connection  conn;
       private String docid;
       private Connection conn;
       private String parserName;
       private Stack elementStack;
       private Vector allow  = new Vector();
       private Vector begin1 = new Vector();
       private Vector end1   = new Vector();
       private Vector count1 = new Vector();
       private Vector denyv  = new Vector();
       private Vector begin2 = new Vector();
       private Vector end2   = new Vector();
       private Vector count2 = new Vector();
       private String resourceId;
       private Vector principalName;
       private int    permission;
       private String permType;
       private String permOrder;
       private String beginTime;
       private String endTime;
       private int    ticketCount;
       private String principal_name = "";
       private String principal_type;
       private int permission = 0;
       private String begin_time;
       private String end_time;
       private int count;
       private int deny;
       /**
        * Construct an instance of the AccessControlList class.
        * It is used by the permission check up from DBQuery and DocumentImpl
+       *
        * @param conn the JDBC connection where acl data are loaded
        */
       public AccessControlList ( Connection conn )
+      {
         this.conn = conn;
+      }
       /**
        * Construct an instance of the AccessControlList class.
        * It parse acl file and loads acl data into db connection.
+       *
        * @param conn the JDBC connection where acl data are loaded
        * @param docid the Accession# of the document with the acl data
        * @param acl the acl file containing acl data for the document
        * @param acl the acl file containing acl data
        */
       public AccessControlList ( Connection conn, String docid, Reader acl )
                       throws SAXException, IOException, ClassNotFoundException
-...
         String parserName = util.getOption("saxparser");
         this.conn = conn;
         this.docid = docid;
         this.parserName = parserName;
         elementStack = new Stack();
         this.elementStack = new Stack();
         this.principalName = new Vector();
         this.permission = 0;
         this.ticketCount = 0;
         // Initialize the parser and read the queryspec
         XMLReader parser = initializeParser();
-...
+      }
       /**
        * Construct an instance of the AccessControlList class.
        * It parse acl file and loads acl data into db connection.
+       *
        * @param conn the JDBC connection where acl data are loaded
        * @param docid the Accession# of the document with the acl data
        * @param aclfilename the name of acl file containing acl data
        */
       public AccessControlList( Connection conn, String docid, String aclfilename )
                       throws SAXException, IOException, ClassNotFoundException
+      {
-...
             currentNode.setAttribute(atts.getLocalName(i), atts.getValue(i));
+          }
+        }
         if ( currentNode.getTagName().equals("resource") ) {
           permOrder = currentNode.getAttribute("order");
+        }
         elementStack.push(currentNode);
+      }
-...
         BasicNode currentNode = (BasicNode)elementStack.peek();
         String currentTag = currentNode.getTagName();
         if (currentTag.equals("groupName")) {
           principal_name = inputString;
           principal_type = "group";
         } else if (currentTag.equals("userName")) {
           principal_name = inputString;
           principal_type = "user";
         if (currentTag.equals("resourceIdentifier")) {
           resourceId = inputString;
         } else if (currentTag.equals("principalName")) {
           principalName.addElement(new String(inputString));
         } else if (currentTag.equals("permission")) {
           if ( inputString.trim().toUpperCase().equals("READ") ) {
             permission = permission | READ;
-...
             permission = permission | ALL;
+          }
         } else if (currentTag.equals("duration") &&
                    begin_time == null && end_time == null ) {
                    beginTime == null && endTime == null ) {
           try {
             begin_time = inputString.substring(0, inputString.indexOf(" "));
             end_time = inputString.substring(inputString.indexOf(" ")+1);
             beginTime = inputString.substring(0, inputString.indexOf(" "));
             endTime = inputString.substring(inputString.indexOf(" ")+1);
           } catch (StringIndexOutOfBoundsException se) {
             begin_time = inputString;
             beginTime = inputString;
+          }
         } else if (currentTag.equals("count") && count == 0 ) {
           count = (new Integer(inputString.trim())).intValue();
         } else if (currentTag.equals("ticketCount") && ticketCount == 0 ) {
           ticketCount = (new Integer(inputString.trim())).intValue();
+        }
+      }
-...
              throws SAXException
+      {
         BasicNode leaving = (BasicNode)elementStack.pop();
         if ( leaving.getTagName().equals("allow") && permission > 0 ) {
           // collect allowed permissions in a Vector variable allow
           allow.add(new Integer(permission));
           begin1.add(begin_time);
           end1.add(end_time);
           count1.add(new Integer(count));
         if ( leaving.getTagName().equals("allow") ) {
           if ( permission > 0 ) {
             // insert into db calculated permission for the list of principals
             try {
               insertPermissions("allowed");
             } catch (SQLException sqle) {
               throw new SAXException(sqle);
+            }
+          }
           // reset the allowed permission
           principalName = new Vector();
           permission = 0;
           begin_time = null;
           end_time = null;
           count = 0;
           beginTime = null;
           endTime = null;
           ticketCount = 0;
         } else if ( leaving.getTagName().equals("deny") && permission > 0 ) {
           // collect denied permissions in a Vector variable denyv
           denyv.add(new Integer(permission));
           begin2.add(begin_time);
           end2.add(end_time);
           count2.add(new Integer(count));
         } else if ( leaving.getTagName().equals("deny") ) {
           if ( permission > 0 ) {
           // reset the denied permission
           permission = 0;
           begin_time = null;
           end_time = null;
           count = 0;
         } else if ( leaving.getTagName().equals("accessControl") ) {
           // when order attribute for <accessControl> is specified to "denyFirst"
           // exclude the allowed permissions from the list of denied ones
           if ( leaving.getAttribute("order").equals("denyFirst") ) {
             for ( int i = 0; i < allow.size(); i++ ) {
               for ( int j = 0; j < denyv.size(); j++ ) {
                 denyv.setElementAt(
                 new Integer(((Integer)denyv.elementAt(j)).intValue() &
                             ~((Integer)allow.elementAt(i)).intValue()), j);
+              }
             // insert into db calculated permission for the list of principals
             try {
               insertPermissions("denied");
             } catch (SQLException sqle) {
               throw new SAXException(sqle);
+            }
+          }
           // insert into db connection collected permissions for the principal
           try {
             insertPermissions();
           } catch (SQLException sqle) {
             throw new SAXException(sqle);
+          }
           // reset the denied permission
           principalName = new Vector();
           permission = 0;
           beginTime = null;
           endTime = null;
           ticketCount = 0;
           // reset the list of allowed and denied permissions
           // for use for the next principal
           allow  = new Vector();
           begin1 = new Vector();
           end1   = new Vector();
           count1 = new Vector();
         } else if ( leaving.getTagName().equals("resource") ) {
           // reset the resource identifier
           resourceId = null;
           permOrder = null;
+        }
           denyv  = new Vector();
           begin2 = new Vector();
           end2   = new Vector();
           count2 = new Vector();
         } else if ( leaving.getTagName().equals("user") ||
                     leaving.getTagName().equals("group") ) {
     //      try {
     //        principal_name =
     //        principal_name.substring(0, principal_name.lastIndexOf("."));
     //      } catch (StringIndexOutOfBoundsException se) {
             // reset the name of the current principal for next use
             principal_name = "";
     //      }
+        }
+      }
       /** Insert into db connection collected permissions for a principal */
       private void insertPermissions()
       /** Insert into db calculated permission for the list of principals */
       private void insertPermissions( String permType )
               throws SQLException
+      {
         PreparedStatement pstmt;
-...
         try {
           pstmt = conn.prepareStatement(
                   "INSERT INTO xml_access " +
                   "(docid, principal_name, principal_type, " +
                   "permission, begin_time, end_time, ticket_counter, deny)" +
                   "VALUES (?, ?, ?, ?, to_date(?,'mm/dd/yy'), " +
                   " to_date(?,'mm/dd/yy'), ?, ?)");
                   "(docid,principal_name,permission,perm_type,perm_order," +
                   "begin_time,end_time,ticket_count) VALUES " +
                   "(?,?,?,?,?,to_date(?,'mm/dd/yy'),to_date(?,'mm/dd/yy'),?)");
           // Bind the values to the query
           pstmt.setString(1, docid);
           pstmt.setString(2, principal_name);
           pstmt.setString(3, principal_type);
           // insert the allowed permissions first
           for ( int i = 0; i < allow.size(); i++ ) {
             pstmt.setInt(4, ((Integer)allow.elementAt(i)).intValue());
             pstmt.setString(5, (String)begin1.elementAt(i));
             pstmt.setString(6, (String)end1.elementAt(i));
             if ( ((Integer)count1.elementAt(i)).intValue() > 0 ) {
               pstmt.setString(7, "" + ((Integer)count1.elementAt(i)).intValue());
             } else {
               pstmt.setString(7, "");
+            }
           pstmt.setString(1, resourceId);
           pstmt.setInt(3, permission);
           pstmt.setString(4, permType);
           pstmt.setString(5, permOrder);
           pstmt.setString(6, beginTime);
           pstmt.setString(7, endTime);
           if ( ticketCount > 0 ) {
             pstmt.setString(8, "" + ticketCount);
           } else {
             pstmt.setString(8, "");
+          }
           for ( int i = 0; i < principalName.size(); i++ ) {
             pstmt.setString(2, (String)principalName.elementAt(i));
             pstmt.execute();
+          }
         } catch (SQLException e) {
           throw new
           SQLException("AccessControlList.insertPermissions(): " + e.getMessage());
+        }
+      }
       /** Check for @permission for @principal on @resourceId from db connection */
       public boolean hasPermission ( String permission, String principal,
                                      String resourceId )
                      throws SQLException
+      {
         PreparedStatement pstmt;
         // check public access to @resourceId from xml_documents table
         if ( permission.equals("READ") ) {
           try {
             pstmt = conn.prepareStatement(
                     "SELECT 'x' FROM xml_documents " +
                     "WHERE docid LIKE ? AND public_access = 1");
             // Bind the values to the query
             pstmt.setString(1, principal);
             pstmt.execute();
             ResultSet rs = pstmt.getResultSet();
             boolean hasRow = rs.next();
             pstmt.close();
             if (hasRow) {
               return true;
+            }
     //System.out.println("Passed the check for public access");
           } catch (SQLException e) {
             throw new
             SQLException("Error checking document's public access: "
                           + e.getMessage());
+          }
+        }
         // since owner of resource has all permission on it,
         // check if @principal is owner of @resourceId in xml_documents table
         if ( principal != null ) {
           try {
             pstmt = conn.prepareStatement(
                     "SELECT 'x' FROM xml_documents " +
                     "WHERE docid LIKE ? AND user_owner LIKE ?");
             // Bind the values to the query
             pstmt.setString(1, resourceId);
             pstmt.setString(2, principal);
           // insert the denied permissions
           for ( int i = 0; i < denyv.size(); i++ ) {
             if ( ((Integer)denyv.elementAt(i)).intValue() <= 0 ) {
               continue;
             pstmt.execute();
             ResultSet rs = pstmt.getResultSet();
             boolean hasRow = rs.next();
             pstmt.close();
             if (hasRow) {
               return true;
+            }
             pstmt.setInt(4, ((Integer)denyv.elementAt(i)).intValue());
             pstmt.setString(5, (String)begin2.elementAt(i));
             pstmt.setString(6, (String)end2.elementAt(i));
             if ( ((Integer)count2.elementAt(i)).intValue() > 0 ) {
               pstmt.setString(7, "" + ((Integer)count2.elementAt(i)).intValue());
             } else {
               pstmt.setString(7, "");
     //System.out.println("Passed the check for ownership");
           } catch (SQLException e) {
             throw new
             SQLException("AccessControlList.hasPermission(): " +
                          "Error checking document's ownership. " + e.getMessage());
+          }
           // check @principal's @permission on @resourceId from xml_access table
           int accessValue = 0;
           int ticketCount = 0;
           String permOrder = "";
           try {
             pstmt = conn.prepareStatement(
                     "SELECT permission, perm_order, ticket_count " +
                     "FROM xml_access " +
                     "WHERE docid LIKE ? " +
                     "AND principal_name LIKE ? " +
                     "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                     "AND nvl(end_time,sysdate) " +
                     "AND perm_type LIKE ?");
             // check if it is "denied" first
             // Bind the values to the query
             pstmt.setString(1, resourceId);
             pstmt.setString(2, principal);
             pstmt.setString(3, "denied");
             pstmt.execute();
             ResultSet rs = pstmt.getResultSet();
             boolean hasRows = rs.next();
             while ( hasRows ) {
               accessValue = rs.getInt(1);
               permOrder = rs.getString(2);
               ticketCount = rs.getInt(3);
               if ( ( accessValue & intValue(permission) ) == intValue(permission) &&
                    ( permOrder.equals("allow first") ) &&
                    ( rs.wasNull() || ticketCount > 0 ) ) {
                 if ( !rs.wasNull() && ticketCount > 0 ) {
                   decreaseNumberOfAccess(accessValue,principal,resourceId,"denied");
+                }
                 pstmt.close();
                 return false;
+              }
               hasRows = rs.next();
+            }
             pstmt.setString(8, "" + 1);
     //System.out.println("Passed the check for denied access");
             // it is not denied then check if it is "allowed"
             // Bind the values to the query
             pstmt.setString(1, resourceId);
             pstmt.setString(2, principal);
             pstmt.setString(3, "allowed");
             pstmt.execute();
             rs = pstmt.getResultSet();
             hasRows = rs.next();
             while ( hasRows ) {
               accessValue = rs.getInt(1);
               ticketCount = rs.getInt(3);
               if ( ( accessValue & intValue(permission) )==intValue(permission) &&
                    ( rs.wasNull() || ticketCount > 0 ) ) {
                 if ( !rs.wasNull() && ticketCount > 0 ) {
                   decreaseNumberOfAccess(accessValue,principal,resourceId,"allowed");
+                }
                 pstmt.close();
                 return true;
+              }
               hasRows = rs.next();
+            }
     //System.out.println("Passed the check for allowed access");
             // ???
             // here there could be a check for the group's permission like
             // selfrecursive call to hasPermission(conn,permission,group,recourceId)
             //
             pstmt.close();
             return false;
           } catch (SQLException e) {
             throw new
             SQLException("AccessControlList.hasPermission(): " +
                          "Error checking document's permission. " + e.getMessage());
+          }
+        }
         return false;
+      }
         } catch (SQLException e) {
           throw new
           SQLException("AccessControlList.insertPermissions(): " + e.getMessage());
       /** decrease the number of access to @resourceId for @principal */
       private void decreaseNumberOfAccess(int permission, String principal,
                                           String resourceId, String permType)
                    throws SQLException
+      {
         PreparedStatement pstmt;
         pstmt = conn.prepareStatement(
                 "UPDATE xml_access SET ticket_count = ticket_count - 1 " +
                 "WHERE docid LIKE ? " +
                 "AND principal_name LIKE ? " +
                 "AND permission LIKE ? " +
                 "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
                                 "AND nvl(end_time,sysdate) " +
                 "AND perm_type LIKE ?");
         // Bind the values to the query
         pstmt.setString(1, resourceId);
         pstmt.setString(2, principal);
         pstmt.setInt(3, permission);
         pstmt.setString(4, permType);
         pstmt.execute();
         pstmt.close();
+      }
       // get the int value of READ, WRITE or ALL
       private int intValue ( String permission )
+      {
         if ( permission.equals("READ") ) {
           return READ;
         } else if ( permission.equals("WRITE") ) {
           return WRITE;
         } else if ( permission.equals("ALL") ) {
           return ALL;
+        }
         return -1;
+      }
+    }

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 570

Added by bojilova over 24 years ago