001: /*
002: * $Id: CheckPermission.java,v 1.3 2003/11/25 06:05:36 jonesde Exp $
003: *
004: * Copyright (c) 2001, 2002 The Open For Business Project - www.ofbiz.org
005: *
006: * Permission is hereby granted, free of charge, to any person obtaining a
007: * copy of this software and associated documentation files (the "Software"),
008: * to deal in the Software without restriction, including without limitation
009: * the rights to use, copy, modify, merge, publish, distribute, sublicense,
010: * and/or sell copies of the Software, and to permit persons to whom the
011: * Software is furnished to do so, subject to the following conditions:
012: *
013: * The above copyright notice and this permission notice shall be included
014: * in all copies or substantial portions of the Software.
015: *
016: * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
017: * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
018: * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
019: * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
020: * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT
021: * OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
022: * THE USE OR OTHER DEALINGS IN THE SOFTWARE.
023: */
024: package org.ofbiz.minilang.method.ifops;
025:
026: import java.util.Iterator;
027: import java.util.LinkedList;
028: import java.util.List;
029:
030: import org.ofbiz.base.util.UtilProperties;
031: import org.ofbiz.base.util.UtilXml;
032: import org.ofbiz.entity.GenericValue;
033: import org.ofbiz.minilang.SimpleMethod;
034: import org.ofbiz.minilang.method.ContextAccessor;
035: import org.ofbiz.minilang.method.MethodContext;
036: import org.ofbiz.minilang.method.MethodOperation;
037: import org.ofbiz.security.Security;
038: import org.w3c.dom.Element;
039:
040: /**
041: * Iff the user does not have the specified permission the fail-message
042: * or fail-property sub-elements are used to add a message to the error-list.
043: *
044: * @author <a href="mailto:jonesde@ofbiz.org">David E. Jones</a>
045: * @version $Revision: 1.3 $
046: * @since 2.0
047: */
048: public class CheckPermission extends MethodOperation {
049:
050: String message = null;
051: String propertyResource = null;
052: boolean isProperty = false;
053:
054: PermissionInfo permissionInfo;
055: ContextAccessor errorListAcsr;
056: List altPermissions = null;
057:
058: public CheckPermission(Element element, SimpleMethod simpleMethod) {
059: super (element, simpleMethod);
060: permissionInfo = new PermissionInfo(element);
061: this .errorListAcsr = new ContextAccessor(element
062: .getAttribute("error-list-name"), "error_list");
063:
064: List altPermElements = UtilXml.childElementList(element,
065: "alt-permission");
066: Iterator apeIter = altPermElements.iterator();
067: if (apeIter.hasNext()) {
068: altPermissions = new LinkedList();
069: }
070: while (apeIter.hasNext()) {
071: Element altPermElement = (Element) apeIter.next();
072: altPermissions.add(new PermissionInfo(altPermElement));
073: }
074:
075: Element failMessage = UtilXml.firstChildElement(element,
076: "fail-message");
077: Element failProperty = UtilXml.firstChildElement(element,
078: "fail-property");
079: if (failMessage != null) {
080: this .message = failMessage.getAttribute("message");
081: this .isProperty = false;
082: } else if (failProperty != null) {
083: this .propertyResource = failProperty
084: .getAttribute("resource");
085: this .message = failProperty.getAttribute("property");
086: this .isProperty = true;
087: }
088: }
089:
090: public boolean exec(MethodContext methodContext) {
091: boolean hasPermission = false;
092:
093: List messages = (List) errorListAcsr.get(methodContext);
094: if (messages == null) {
095: messages = new LinkedList();
096: errorListAcsr.put(methodContext, messages);
097: }
098:
099: // if no user is logged in, treat as if the user does not have permission: do not run subops
100: GenericValue userLogin = methodContext.getUserLogin();
101: if (userLogin != null) {
102: Security security = methodContext.getSecurity();
103: if (this .permissionInfo.hasPermission(methodContext,
104: userLogin, security)) {
105: hasPermission = true;
106: }
107:
108: // if failed, check alternate permissions
109: if (!hasPermission && altPermissions != null) {
110: Iterator altPermIter = altPermissions.iterator();
111: while (altPermIter.hasNext()) {
112: PermissionInfo altPermInfo = (PermissionInfo) altPermIter
113: .next();
114: if (altPermInfo.hasPermission(methodContext,
115: userLogin, security)) {
116: hasPermission = true;
117: break;
118: }
119: }
120: }
121: }
122:
123: if (!hasPermission) {
124: this .addMessage(messages, methodContext);
125: }
126:
127: return true;
128: }
129:
130: public void addMessage(List messages, MethodContext methodContext) {
131: ClassLoader loader = methodContext.getLoader();
132:
133: String message = methodContext.expandString(this .message);
134: String propertyResource = methodContext
135: .expandString(this .propertyResource);
136:
137: if (!isProperty && message != null) {
138: messages.add(message);
139: // if (Debug.infoOn()) Debug.logInfo("[SimpleMapOperation.addMessage] Adding message: " + message, module);
140: } else if (isProperty && propertyResource != null
141: && message != null) {
142: //String propMsg = UtilProperties.getPropertyValue(UtilURL.fromResource(propertyResource, loader), message);
143: String propMsg = UtilProperties.getMessage(
144: propertyResource, message, methodContext
145: .getEnvMap(), methodContext.getLocale());
146: if (propMsg == null || propMsg.length() == 0) {
147: messages
148: .add("Simple Method Permission error occurred, but no message was found, sorry.");
149: } else {
150: messages.add(methodContext.expandString(propMsg));
151: }
152: // if (Debug.infoOn()) Debug.logInfo("[SimpleMapOperation.addMessage] Adding property message: " + propMsg, module);
153: } else {
154: messages
155: .add("Simple Method Permission error occurred, but no message was found, sorry.");
156: // if (Debug.infoOn()) Debug.logInfo("[SimpleMapOperation.addMessage] ERROR: No message found", module);
157: }
158: }
159:
160: public static class PermissionInfo {
161: String permission;
162: String action;
163:
164: public PermissionInfo(Element altPermissionElement) {
165: this .permission = altPermissionElement
166: .getAttribute("permission");
167: this .action = altPermissionElement.getAttribute("action");
168: }
169:
170: public boolean hasPermission(MethodContext methodContext,
171: GenericValue userLogin, Security security) {
172: String permission = methodContext
173: .expandString(this .permission);
174: String action = methodContext.expandString(this .action);
175:
176: if (action != null && action.length() > 0) {
177: // run hasEntityPermission
178: return security.hasEntityPermission(permission, action,
179: userLogin);
180: } else {
181: // run hasPermission
182: return security.hasPermission(permission, userLogin);
183: }
184: }
185: }
186: }
|