01: /**********************************************************************************
02: * $URL: https://source.sakaiproject.org/svn/course-management/tags/sakai_2-4-1/cm-impl/hibernate-impl/impl/src/java/org/sakaiproject/coursemanagement/impl/aop/CourseManagementAdministrationAuthzAdvisor.java $
03: * $Id: CourseManagementAdministrationAuthzAdvisor.java 13837 2006-08-18 00:41:43Z jholtzman@berkeley.edu $
04: ***********************************************************************************
05: *
06: * Copyright (c) 2006 The Sakai Foundation.
07: *
08: * Licensed under the Educational Community License, Version 1.0 (the "License");
09: * you may not use this file except in compliance with the License.
10: * You may obtain a copy of the License at
11: *
12: * http://www.opensource.org/licenses/ecl1.php
13: *
14: * Unless required by applicable law or agreed to in writing, software
15: * distributed under the License is distributed on an "AS IS" BASIS,
16: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17: * See the License for the specific language governing permissions and
18: * limitations under the License.
19: *
20: **********************************************************************************/package org.sakaiproject.coursemanagement.impl.aop;
21:
22: import java.lang.reflect.Method;
23:
24: import org.apache.commons.logging.Log;
25: import org.apache.commons.logging.LogFactory;
26: import org.sakaiproject.authz.api.SecurityService;
27: import org.sakaiproject.coursemanagement.impl.exception.PermissionException;
28: import org.springframework.aop.MethodBeforeAdvice;
29:
30: public class CourseManagementAdministrationAuthzAdvisor implements
31: MethodBeforeAdvice {
32: private static final Log log = LogFactory
33: .getLog(CourseManagementAdministrationAuthzAdvisor.class);
34:
35: SecurityService securityService;
36:
37: public void setSecurityService(SecurityService securityService) {
38: this .securityService = securityService;
39: }
40:
41: public void before(Method method, Object[] oa, Object obj)
42: throws Throwable {
43: if (log.isDebugEnabled())
44: log
45: .debug("Checking authorization for CM Administration actions");
46:
47: // We can't check the standard site- or group- or resource-based authorization for modifying CM data,
48: // since CM isn't scoped by sakai references. So we allow only the super user.
49: if (!securityService.isSuperUser()) {
50: if (log.isDebugEnabled())
51: log
52: .debug("Denying access to CM Administration on method "
53: + method);
54: throw new PermissionException(
55: "Only Sakai super-users (admins) can modify CM data");
56: }
57:
58: if (log.isDebugEnabled())
59: log
60: .debug("This user is permitted to use the CM Admin service");
61: }
62: }
|