1 |
|
|
2 |
|
|
3 |
|
|
4 |
|
|
5 |
|
|
6 |
|
|
7 |
|
|
8 |
|
|
9 |
|
|
10 |
|
|
11 |
|
|
12 |
|
|
13 |
|
|
14 |
|
|
15 |
|
|
16 |
|
|
17 |
|
|
18 |
|
|
19 |
|
|
20 |
|
package org.xwiki.security.authorization.internal; |
21 |
|
|
22 |
|
import java.util.Collection; |
23 |
|
import java.util.Map; |
24 |
|
import java.util.Set; |
25 |
|
|
26 |
|
import javax.inject.Named; |
27 |
|
import javax.inject.Singleton; |
28 |
|
|
29 |
|
import org.xwiki.component.annotation.Component; |
30 |
|
import org.xwiki.security.GroupSecurityReference; |
31 |
|
import org.xwiki.security.SecurityReference; |
32 |
|
import org.xwiki.security.UserSecurityReference; |
33 |
|
import org.xwiki.security.authorization.Right; |
34 |
|
import org.xwiki.security.authorization.RightMap; |
35 |
|
import org.xwiki.security.authorization.RuleState; |
36 |
|
import org.xwiki.security.authorization.SecurityRule; |
37 |
|
import org.xwiki.security.authorization.SecurityRuleEntry; |
38 |
|
|
39 |
|
import static org.xwiki.security.authorization.RuleState.ALLOW; |
40 |
|
import static org.xwiki.security.authorization.RuleState.UNDETERMINED; |
41 |
|
|
42 |
|
|
43 |
|
@link |
44 |
|
|
45 |
|
|
46 |
|
|
47 |
|
|
48 |
|
|
49 |
|
@version |
50 |
|
@since |
51 |
|
|
52 |
|
@Component |
53 |
|
@Named("priority") |
54 |
|
@Singleton |
|
|
| 0% |
Uncovered Elements: 65 (65) |
Complexity: 16 |
Complexity Density: 0.42 |
|
55 |
|
public class PrioritizingAuthorizationSettler extends AbstractAuthorizationSettler |
56 |
|
{ |
57 |
|
|
58 |
|
private static final int USER_PRIORITY = Integer.MAX_VALUE; |
59 |
|
|
60 |
|
|
61 |
|
private static final int ALL_GROUP_PRIORITY = 0; |
62 |
|
|
|
|
| 0% |
Uncovered Elements: 15 (15) |
Complexity: 3 |
Complexity Density: 0.27 |
|
63 |
0 |
@Override... |
64 |
|
protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, |
65 |
|
SecurityRuleEntry entry, Policies policies) |
66 |
|
{ |
67 |
0 |
XWikiSecurityAccess access = new XWikiSecurityAccess(); |
68 |
0 |
Map<Right, Integer> priorities = new RightMap<Integer>(); |
69 |
0 |
SecurityReference reference = entry.getReference(); |
70 |
0 |
Set<Right> enabledRights = Right.getEnabledRights(reference.getSecurityType()); |
71 |
|
|
72 |
|
|
73 |
0 |
for (Right right : enabledRights) { |
74 |
0 |
for (SecurityRule obj : entry.getRules()) { |
75 |
0 |
if (obj.match(right)) { |
76 |
0 |
resolveLevel(right, user, groups, obj, access, policies, priorities); |
77 |
0 |
if (access.get(right) == ALLOW) { |
78 |
0 |
implyRights(right, access, reference, policies, priorities); |
79 |
|
} |
80 |
|
} |
81 |
|
} |
82 |
|
} |
83 |
|
|
84 |
0 |
return access; |
85 |
|
} |
86 |
|
|
87 |
|
|
88 |
|
|
89 |
|
|
90 |
|
@param |
91 |
|
@param |
92 |
|
@param |
93 |
|
@param |
94 |
|
@param |
95 |
|
|
|
|
| 0% |
Uncovered Elements: 10 (10) |
Complexity: 3 |
Complexity Density: 0.5 |
|
96 |
0 |
private void implyRights(Right right, XWikiSecurityAccess access, SecurityReference reference,... |
97 |
|
Policies policies, Map<Right, Integer> priorities) |
98 |
|
{ |
99 |
0 |
Set<Right> impliedRights = right.getImpliedRights(); |
100 |
0 |
if (impliedRights != null) { |
101 |
0 |
for (Right enabledRight : Right.getEnabledRights(reference.getSecurityType())) { |
102 |
0 |
if (impliedRights.contains(enabledRight)) { |
103 |
|
|
104 |
0 |
policies.set(enabledRight, right); |
105 |
0 |
resolveConflict(ALLOW, enabledRight, access, policies, priorities.get(right), priorities); |
106 |
|
} |
107 |
|
} |
108 |
|
} |
109 |
|
} |
110 |
|
|
111 |
|
|
112 |
|
@link |
113 |
|
@link |
114 |
|
|
115 |
|
@param |
116 |
|
@param |
117 |
|
@param |
118 |
|
@param |
119 |
|
@param |
120 |
|
@param |
121 |
|
@param |
122 |
|
|
123 |
|
|
|
|
| 0% |
Uncovered Elements: 15 (15) |
Complexity: 4 |
Complexity Density: 0.44 |
|
124 |
0 |
private void resolveLevel(Right right,... |
125 |
|
UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRule rule, |
126 |
|
XWikiSecurityAccess access, Policies policies, Map<Right, Integer> priorities) |
127 |
|
{ |
128 |
0 |
RuleState state = rule.getState(); |
129 |
0 |
if (state == UNDETERMINED) { |
130 |
0 |
return; |
131 |
|
} |
132 |
|
|
133 |
0 |
if (rule.match(user)) { |
134 |
0 |
resolveConflict(state, right, access, policies, USER_PRIORITY, priorities); |
135 |
|
} else { |
136 |
0 |
for (GroupSecurityReference group : groups) { |
137 |
0 |
if (rule.match(group)) { |
138 |
0 |
resolveConflict(state, right, access, policies, getPriority(group), priorities); |
139 |
0 |
break; |
140 |
|
} |
141 |
|
} |
142 |
|
} |
143 |
|
} |
144 |
|
|
145 |
|
|
146 |
|
|
147 |
|
|
148 |
|
@param |
149 |
|
@param |
150 |
|
@param |
151 |
|
@param |
152 |
|
@param |
153 |
|
@param |
154 |
|
|
|
|
| 0% |
Uncovered Elements: 15 (15) |
Complexity: 4 |
Complexity Density: 0.44 |
|
155 |
0 |
private void resolveConflict(RuleState state, Right right, XWikiSecurityAccess access, Policies policies,... |
156 |
|
int priority, Map<Right, Integer> priorities) |
157 |
|
{ |
158 |
0 |
if (access.get(right) == UNDETERMINED) { |
159 |
0 |
access.set(right, state); |
160 |
0 |
priorities.put(right, priority); |
161 |
0 |
return; |
162 |
|
} |
163 |
0 |
if (access.get(right) != state) { |
164 |
0 |
if (priority > priorities.get(right)) { |
165 |
0 |
access.set(right, state); |
166 |
0 |
priorities.put(right, priority); |
167 |
|
} else { |
168 |
0 |
access.set(right, policies.getTieResolutionPolicy(right)); |
169 |
|
} |
170 |
|
} |
171 |
|
} |
172 |
|
|
173 |
|
|
174 |
|
@param |
175 |
|
@return |
176 |
|
|
|
|
| 0% |
Uncovered Elements: 5 (5) |
Complexity: 2 |
Complexity Density: 0.67 |
|
177 |
0 |
private int getPriority(GroupSecurityReference group)... |
178 |
|
{ |
179 |
0 |
if (group.getName().equals("XWikiAllGroup")) { |
180 |
0 |
return ALL_GROUP_PRIORITY; |
181 |
|
} else { |
182 |
0 |
return ALL_GROUP_PRIORITY + 1; |
183 |
|
} |
184 |
|
} |
185 |
|
} |