/ - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 951

Added by Jing Tao almost 23 years ago

The two hasPermission methods were rewritten. Some logic bugs were fixed. Now user, public and group will not be checked speratedly, but they will be check together as string array. In order to do this, private methods isAccessDocument, containDocumentOwner, isAllowFirst, hasAllowRule, hasExplicitDenyRule, hasImplicitDenyRule, and createUsersPackage were added.

       private static final int WRITE = 2;
       private static final int READ = 4;
       private static final int ALL = 7;
       private static final String ALLOWFIRST="allowFirst";
       private static final String DENYFIRST="denyFirst";
       private static final String ALLOW="allow";
       private static final String DENY="deny";
       private static final String PUBLIC="public";
       private static String sysdate = MetaCatUtil.dbAdapter.getDateTimeFunction();
       private static String isnull = MetaCatUtil.dbAdapter.getIsNULLFunction();
-...
         return txtPerm.append("\"").toString();
+      }
       /**
         * Check if a document id is a access document. Access document need user
         * has "all" permission to access it.
         * @param docId, the document id need to be checked
         */
         private boolean isAccessDocument(String docId) throws SQLException
+        {
           //detele the rev number if docid contains it
           docId=MetaCatUtil.getDocIdFromString(docId);
           PreparedStatement pStmt=null;
           try
+          {
             pStmt = conn.prepareStatement("select 'x' from xml_access where " +
                                           "accessfileid like '" + docId +  "'");
             pStmt.execute();
             ResultSet rs = pStmt.getResultSet();
             boolean hasRow = rs.next();
             pStmt.close();
             if(hasRow)
+            {
               return true;
+            }
+          }
           catch(SQLException e)
+          {
             pStmt.close();
             throw new SQLException("AccessControlList.hasPermission():2 " +
                          "Error checking ownership for " + principal +
                          " on document #" + docId + ". " + e.getMessage());
+          }
           return false;
         }//isAccessDocument
       /**
         * To create a part of query: "docid like '" +str1+ "', " +"docid like '"
         * +str2+"'" ... We need to check user, group and public together for the
         * permission. So we need the principal in an array and according the array
         * to create a part of query which will be used in other methods
         * @param principals, a string array storing the username, groups name and
         * public.
         */
        private String partQueryAboutDocId( String [] principals)
+       {
          String partQuery="";
          int lengthOfArray=principals.length;
          for (int i=0;i<(lengthOfArray-1);i++)
+         {
             partQuery=partQuery+"docid like '"+principals[i]+"',";
+         }
          //the last one dosen't has "'"
          partQuery=partQuery+"docid like '"+principals[(lengthOfArray-1)]+"'";
          return partQuery;
+       }
       /**
         * Check if a stirng array contains a given documents' owner
         * @param principals, a string array storing the username, groups name and
         * public.
         * @param docid, the id of given documents
         */
       private boolean containDocumentOwner( String [] principals, String docId)
                         throws SQLException
+      {
         int lengthOfArray=principals.length;
         boolean hasRow;
         PreparedStatement pStmt=null;
         try
+        {
           pStmt = conn.prepareStatement(
                     "SELECT 'x' FROM xml_documents " +
                     "WHERE docid = ? AND user_owner = ?");
           //check every element in the string array too see if it conatains
           //the owner of document
           for (int i=0; i<lengthOfArray; i++)
+          {
             // Bind the values to the query
             pStmt.setString(1, docId);
             pStmt.setString(2, principals[i]);
             pStmt.execute();
             ResultSet rs = pStmt.getResultSet();
             hasRow = rs.next();
             if (hasRow)
+            {
               pStmt.close();
               return true;
             }//if
           }//for
         }//try
         catch (SQLException e)
+        {
             pStmt.close();
             throw new
             SQLException("AccessControlList.hasPermission(). " +
                          "Error checking ownership for " + principals[0] +
                          " on document #" + docId + ". " + e.getMessage());
         }//catch
         pStmt.close();
         return false;
       }//containDocumentOwner
       /**
         * Check if the permission order for user at that documents is allowFirst
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         */
       private boolean isAllowFirst(String [] principals, String docId)
                       throws SQLException, Exception
+      {
         int lengthOfArray=principals.length;
         boolean hasRow;
         //select permission order from database
         PreparedStatement pStmt = conn.prepareStatement(
                     "SELECT perm_order FROM xml_access " +
                     "WHERE principal_name= ? AND docid = ?");
        //check every name in the array
         for (int i=0; i<lengthOfArray;i++)
+        {
           //bind value
           pStmt.setString(1, principals[i]);//user name
           pStmt.setString(2, docId);//docid
           pStmt.execute();
           ResultSet rs = pStmt.getResultSet();
           hasRow=rs.next();
           if (hasRow)
+          {
             //get the permission order from data base
             String permissionOrder=rs.getString(1);
             //if the permission order is "allowFirst
             if (permissionOrder.compareTo(ALLOWFIRST)==0)
+            {
               pStmt.close();
               return true;
+            }
             else
+            {
               pStmt.close();
               return false;
+            }
           }//if
         }//for
         //if reach here, means there is no permssion record for given names and
         //docid. So throw a exception.
         pStmt.close();
         throw new Exception("There is no permission record for user"+principals[0]+
                             "at document "+docId);
       }//isAllowFirst
       /**
         * Check if the users array has allow rules for given users, docid and
         * permission.
         * If it has permission rule and ticket count is greater than 0, the ticket
         * number will decrease one
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasAllowRule(String [] principals, String docId,
                                       String permission)
                       throws SQLException, Exception
+     {
        int lengthOfArray=principals.length;
        ResultSet rs;
        PreparedStatement pStmt;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        int ticketCount;
        //This sql statement will select entry with
        //begin_time<=currentTime<=end_time in xml_access table
        //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
        //function will assign begin_time=sysdate
        pStmt = conn.prepareStatement(
                     "SELECT permission, ticket_count " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
        //bind docid, perm_type
        pStmt.setString(1, docId);
        pStmt.setString(3, ALLOW);
        //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
           pStmt.execute();
           rs=pStmt.getResultSet();
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             ticketCount=rs.getInt(2);
             //permission is ok and ticketcount geat than 0 or ticket is null,
             //the user have a permission to access the file
             if ((( permissionValueInTable & permissionValue )== permissionValue )
                   && (rs.wasNull()||ticketCount > 0))
+            {
                //ticket count should minus one
                //ticketCount isnot null and greater than 0, order is allowfirst
                if (!rs.wasNull() && ticketCount>0 && isAllowFirst(principals,docId))
+               {
                   decreaseNumberOfAccess(permissionValueInTable, principals[i],
                                                   docId, ALLOW, ALLOWFIRST);
+                }
                //ticketCount isnot null and greater than 0, order is not allowfirst
                if (!rs.wasNull() &&ticketCount>0 && !isAllowFirst(principals,docId))
+               {
                   decreaseNumberOfAccess(permissionValueInTable, principals[i],
                                                   docId, ALLOW, DENYFIRST);
+               }
                pStmt.close();
                return true;
              }//if
           }//while
         }//for
         pStmt.close();
         return false;//no allow rule
      }//hasAllowRule
        /**
         * Check if the users array has explicit deny rules for given users, docid
         * and permission. That means the perm_type is deny and current time is
         * less than end_time and greater than begin time, or no time limit.
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasExplicitDenyRule(String [] principals, String docId,
                                       String permission)
                       throws SQLException
+     {
        int lengthOfArray=principals.length;
        ResultSet rs;
        PreparedStatement pStmt;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        //This sql statement will select entry with
        //begin_time<=currentTime<=end_time in xml_access table
        //If begin_time or end_time is null in table, isnull(begin_time, sysdate)
        //function will assign begin_time=sysdate
        pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
        //bind docid, perm_type
        pStmt.setString(1, docId);
        pStmt.setString(3, DENY);
        //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
           pStmt.execute();
           rs=pStmt.getResultSet();
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             //permission is ok the user doesn't have permission to access the file
             if (( permissionValueInTable & permissionValue )== permissionValue )
+            {
                pStmt.close();
                return true;
              }//if
           }//while
         }//for
         pStmt.close();
         return false;//no deny rule
       }//hasExplicitDenyRule
        /**
         * Check if the users array has implicit deny rules for given users, docid
         * and permission. That means the though perm_type is "allow" but current
         * time is less than begin_time or greater than end time, or ticket count
         * is 0.
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasImplicitDenyRule(String [] principals, String docId,
                                       String permission)
                       throws SQLException
+     {
        int lengthOfArray=principals.length;
        ResultSet rs;
        PreparedStatement pStmt;
        int permissionValue=intValue(permission);
        int permissionValueInTable;
        //This sql statement will select entry with  perm_type =allow and
        //currentTime is less than begin_time or greater than end time
        //in xml_access table. This is an implicit deny rule (allow is out of date)
        pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " < " + isnull + "(begin_time," + sysdate + ") " +
                     "OR " + sysdate + " > "+ isnull + "(end_time," + sysdate + ")");
        //bind docid, perm_type
        pStmt.setString(1, docId);
        pStmt.setString(3, ALLOW);//It is allow
        //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
           pStmt.execute();
           rs=pStmt.getResultSet();
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             //permission is ok the user doesn't have permission to access the file
             if (( permissionValueInTable & permissionValue )== permissionValue )
+            {
                pStmt.close();
                //has a implicit deny rule: allow is out of date
                return true;
              }//if
           }//while
         }//for
         pStmt.close();
         //Now, there is no implicit deny rule which is allow is out of date
         //another implicit deny rule need to be check: allow is out of ticketCount
         //ticketCount=0
         pStmt = conn.prepareStatement(
                     "SELECT permission " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND ticket_count = ?");
        //bind docid, perm_type, ticket_count
        pStmt.setString(1, docId);
        pStmt.setString(3, ALLOW);//It is allow!
        pStmt.setInt(4,0);
        //bind every elenment in user name array
         for (int i=0;i<lengthOfArray; i++)
+        {
           pStmt.setString(2, principals[i]);
           pStmt.execute();
           rs=pStmt.getResultSet();
           while (rs.next())//check every entry for one user
+          {
             permissionValueInTable=rs.getInt(1);
             //permission is ok the user doesn't have permission to access the file
             if (( permissionValueInTable & permissionValue )== permissionValue )
+            {
                pStmt.close();
                //has a implicit deny rule: allow is out of ticketCount
                return true;
              }//if
           }//while
         }//for
         pStmt.close();
         return false;//no implicit deny rule
       }//hasImplicitDenyRule
       /**
         * Creat a users pakages to check permssion rule, user itself, public and
         * the gourps the user belong will be include in this package
         * @param user, the name of user
         * @param groups, the string array of the groups that user belong to
         */
       private String [] createUsersPackage(String user, String [] groups)
+      {
         String [] usersPackage=null;
         int lengthOfPackage;
         if (groups!=null)
+        {
           //if gouprs is not null and user is not public, we should create a array
           //to store the groups and user and public.
           //So the length of userPackage is the length of group plus two
           if (user.compareTo(PUBLIC)!=0)
+          {
             lengthOfPackage=(groups.length)+2;
             usersPackage=new String [lengthOfPackage];
             //the first two elements is user self and public
             usersPackage[0]=user;
             usersPackage[1]=PUBLIC;
             //put groups element from index 0 to lengthOfPackage-3 into userPackage
             //from index 2 to lengthOfPackage-1
             for (int i=2; i<lengthOfPackage; i++)
+            {
               usersPackage[i]=groups[i-2];
             } //for
           }//if user!=public
           else//use=public
+          {
             lengthOfPackage=(groups.length)+1;
             usersPackage=new String [lengthOfPackage];
             //the first lements is public
             usersPackage[0]=PUBLIC;
             //put groups element from index 0 to lengthOfPackage-2 into userPackage
             //from index 1 to lengthOfPackage-1
             for (int i=1; i<lengthOfPackage; i++)
+            {
               usersPackage[i]=groups[i-1];
             } //for
           }//else user=public
         }//if groups!=null
         else
+        {
           //because no groups, the userPackage only need two elements
           //one is for user, the other is for public
           if (user.compareTo(PUBLIC)!=0)
+          {
             lengthOfPackage=2;
             usersPackage=new String [lengthOfPackage];
             usersPackage[0]=user;
             usersPackage[1]=PUBLIC;
           }//if user!=public
           else //user==public
+          {
             //only put public into array
             lengthOfPackage=1;
             usersPackage=new String [lengthOfPackage];
             usersPackage[0]=PUBLIC;
+          }
         }//else groups==null
         return usersPackage;
       }//createUsersPackage
       /**
         * Check from db connection if at least one of the list of @principals
         * has @permission on @docid.
         * @param permission permission type to check for
-...
         * @param docid document identifier to check on
         */
       public boolean hasPermission(String permission, String user,
                                    String[] groups, String docid )
                                    String[] groups, String docId )
                      throws SQLException
+      {
         //detele the rev number if docid contains it
         docId=MetaCatUtil.getDocIdFromString(docId);
         boolean hasPermission=false;
         String [] userPackage=null;
         // b' of the command line invocation
         if ( (user == null) && (groups == null || groups.length == 0) ) {
           return true;
+        }
         // Check for @permission on @docid for @user and/or @groups
         boolean hasPermission = hasPermission(permission,user,docid);
         int i = 0;
         if ( groups != null ) {
           while ( !hasPermission && i<groups.length ) {
             hasPermission = hasPermission(permission,groups[i++],docid);
+          }
+        }
         // Check for @permission for "public" user
         if ( !hasPermission ) {
           hasPermission = hasPermission(permission,"public",docid);
+        }
         //create a userpackage including user, public and group member
         userPackage=createUsersPackage(user, groups);
         //if the requested document is access documents the user should
         //have "all" permission not matter the requested permission
         if (isAccessDocument(docId))
+        {
           // check for all permission on @docid for @userPackage
           hasPermission = hasPermission(userPackage,docId,"all");
         }//if
         else //if it is not access documents, just check the request permission
+        {
           // Check for @permission on @docid for @user and/or @groups
           hasPermission = hasPermission(userPackage,docId, permission);
         }//else
         return hasPermission;
+      }
       /**
         * Check from db connection if @principal has @permission on @docid.
         * @param permission permission type to check for
         * @param principal name of principal to check for @permission
         * @param docid document identifier to check on
         * Check from db connection if the users in String array @principals has
         * @permission on @docid*
         * @param principals, names in userPakcage need to check for @permission
         * @param docid, document identifier to check on
         * @param permission, permission (write or all...) to check for
         */
       private boolean hasPermission(String permission,
                                     String principal, String docid)
                      throws SQLException
       private boolean hasPermission(String [] principals, String docId,
                                                 String permission)
                              throws SQLException
+      {
         //detele the rev number if docid contains it
         docid=MetaCatUtil.getDocIdFromString(docid);
         PreparedStatement pstmt;
         // since owner of resource has all permission on it,
         // check if @principal is owner of @docid in xml_documents table
         if ( principal != null ) {
           try {
             pstmt = conn.prepareStatement(
                     "SELECT 'x' FROM xml_documents " +
                     "WHERE docid = ? AND user_owner = ?");
             // Bind the values to the query
             pstmt.setString(1, docid);
             pstmt.setString(2, principal);
             pstmt.execute();
             ResultSet rs = pstmt.getResultSet();
             boolean hasRow = rs.next();
             pstmt.close();
             if (hasRow) {
         try
+        {
           //first, if there is a docid owner in user package, return true
           //because doc owner has all permssion
           if (containDocumentOwner(principals, docId))
+          {
               return true;
+            }
           } catch (SQLException e) {
             throw new
             SQLException("AccessControlList.hasPermission(). " +
                          "Error checking ownership for " + principal +
                          " on document #" + docid + ". " + e.getMessage());
+          }
           //check to see if the file we are checking is an access file and if the
           //user that is trying to update it has ALL permissions
           //If there is no owner in user package, checking the table
           //check perm_order
           if (isAllowFirst(principals, docId))
+          {
             if (hasExplicitDenyRule(principals, docId, permission)||
                                 hasImplicitDenyRule(principals, docId, permission))
+            {
               //if it is allowfirst and has deny rule(either explicit or implicit)
               //deny access
               return false;
             }//if
             else if ( hasAllowRule(principals, docId, permission))
+            {
               //if it is allowfirst and hasn't deny rule and has allow rule
               //allow access
               return true;
             }//else if
             else
+            {
               //other situation deny access
               return false;
             }//else
          }//if isAllowFirst
          else //denyFirst
+         {
            if (hasAllowRule(principals, docId, permission))
+           {
              //if it is denyFirst and has allow rule, allow access
              return true;
+           }
            else
+           {
              //if it is denyfirst but no allow rule, deny access
              return false;
+           }
          }//else denyfirst
         }//try
         catch (Exception e)
+        {
           MetaCatUtil.debugMessage("There is a exception in hasPermission method: "
                              +e.getMessage());
+        }
         return false;
       }//hasPermission
       private boolean hasValidDenyEntry(String persmission, String principal,
                                           String docId)
                       throws SQLException
+      {
       //detele the rev number if docid contains it
           docId=MetaCatUtil.getDocIdFromString(docId);
           PreparedStatement pStmt;
           String permissionType;
           int accessValue;
           try
+          {
             pstmt = conn.prepareStatement("select 'x' from xml_access where " +
                                           "accessfileid like '" + docid +
                                           "' and principal_name like '" + principal+
                                           "' and perm_type like 'allow' and " +
                                           "permission = 7");
             pstmt.execute();
             ResultSet rs = pstmt.getResultSet();
             pStmt = conn.prepareStatement("select perm_type, permission, begin_time"
                                         + ", end_time from xml_access where " +
                                           "docid like '" + docId +  "' and "
                                         + "principal_name like '"+principal+"'");
             pStmt.execute();
             ResultSet rs = pStmt.getResultSet();
             boolean hasRow = rs.next();
             pstmt.close();
             pStmt.close();
             if(hasRow)
+            {
               return true;
-...
+          {
             throw new SQLException("AccessControlList.hasPermission():2 " +
                          "Error checking ownership for " + principal +
                          " on document #" + docid + ". " + e.getMessage());
                          " on document #" + docId + ". " + e.getMessage());
+          }
           // check @principal's @permission on @docid from xml_access table
           int accessValue = 0;
           int ticketCount = 0;
           String permOrder = "";
           try {
             pstmt = conn.prepareStatement(
                     "SELECT permission, perm_order, ticket_count " +
                     "FROM xml_access " +
                     "WHERE docid = ? " +
                     "AND principal_name = ? " +
                     "AND perm_type = ? " +
                     "AND " + sysdate +
                     " BETWEEN " + isnull + "(begin_time," + sysdate + ") " +
                          "AND " + isnull + "(end_time," + sysdate + ")");
             // check if it is "deny" with "allowFirst" first
             // Bind the values to the query
             pstmt.setString(1, docid);
             pstmt.setString(2, principal);
             pstmt.setString(3, "deny");
             pstmt.execute();
             ResultSet rs = pstmt.getResultSet();
             boolean hasRows = rs.next();
             while ( hasRows ) {
               accessValue = rs.getInt(1);
               permOrder = rs.getString(2);
               ticketCount = rs.getInt(3);
               if ( ( accessValue & intValue(permission) ) == intValue(permission) &&
                    ( permOrder.equals("allowFirst") ) &&
                    ( rs.wasNull() || ticketCount > 0 ) ) {
                 if ( !rs.wasNull() && ticketCount > 0 ) {
                   decreaseNumberOfAccess(accessValue,principal,docid,
                                                               "deny","allowFirst");
+                }
                 pstmt.close();
                 return false;
+              }
               hasRows = rs.next();
+            }
             // it is not denied then check if it is "allow"
             // Bind the values to the query
             pstmt.setString(1, docid);
             pstmt.setString(2, principal);
             pstmt.setString(3, "allow");
             pstmt.execute();
             rs = pstmt.getResultSet();
             hasRows = rs.next();
             while ( hasRows ) {
               accessValue = rs.getInt(1);
               permOrder = rs.getString(2);
               ticketCount = rs.getInt(3);
               if ( ( accessValue & intValue(permission) )==intValue(permission) &&
                    ( rs.wasNull() || ticketCount > 0 ) ) {
                 if ( !rs.wasNull() && ticketCount > 0 ) {
                   decreaseNumberOfAccess(accessValue,principal,
                                                           docid,"allow",permOrder);
+                }
                 pstmt.close();
                 return true;
+              }
               hasRows = rs.next();
+            }
             // it is not allowed then check if it is "deny" with "denyFirst"
             // Bind the values to the query
             pstmt.setString(1, docid);
             pstmt.setString(2, principal);
             pstmt.setString(3, "deny");
             pstmt.execute();
             rs = pstmt.getResultSet();
             hasRows = rs.next();
             while ( hasRows ) {
               accessValue = rs.getInt(1);
               permOrder = rs.getString(2);
               ticketCount = rs.getInt(3);
               if ( ( accessValue & intValue(permission) ) == intValue(permission) &&
                    ( permOrder.equals("denyFirst") ) &&
                    ( rs.wasNull() || ticketCount > 0 ) ) {
                 if ( !rs.wasNull() && ticketCount > 0 ) {
                     decreaseNumberOfAccess(accessValue,principal,docid,
                                                     "deny","denyFirst");
+                }
                 pstmt.close();
                 return false;
+              }
               hasRows = rs.next();
+            }
             pstmt.close();
             return false;
           } catch (SQLException e) {
             throw new
             SQLException("AccessControlList.hasPermission(). " +
                          "Error checking " + permission + " permission for " +
                          principal + " on document #" + docid + ". " +
                          e.getMessage());
+          }
+        }
         return false;
           return false;
+      }
       /* Decrease the number of access to @docid for @principal in db. */
       private void decreaseNumberOfAccess(int permission, String principal,
                                           String docid, String permType,
-...
         * @param groups names of user's groups to which user belongs
         */
       public String getACL(String docid, String user, String[] groups)
               throws SQLException
               throws SQLException
+      {
         StringBuffer output = new StringBuffer();
         StringBuffer outTemp = new StringBuffer();

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 951

Added by Jing Tao almost 23 years ago