01: /*
02: * Licensed to the Apache Software Foundation (ASF) under one or more
03: * contributor license agreements. See the NOTICE file distributed with
04: * this work for additional information regarding copyright ownership.
05: * The ASF licenses this file to You under the Apache License, Version 2.0
06: * (the "License"); you may not use this file except in compliance with
07: * the License. You may obtain a copy of the License at
08: *
09: * http://www.apache.org/licenses/LICENSE-2.0
10: *
11: * Unless required by applicable law or agreed to in writing, software
12: * distributed under the License is distributed on an "AS IS" BASIS,
13: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14: * See the License for the specific language governing permissions and
15: * limitations under the License.
16: */
17: package org.apache.jetspeed.security.impl;
18:
19: import java.security.AccessControlException;
20: import java.security.AccessController;
21:
22: import org.apache.jetspeed.JetspeedActions;
23: import org.apache.jetspeed.om.common.portlet.MutablePortletApplication;
24: import org.apache.jetspeed.om.common.portlet.PortletDefinitionComposite;
25: import org.apache.jetspeed.page.PageManager;
26: import org.apache.jetspeed.security.PortletPermission;
27: import org.apache.jetspeed.security.SecurityAccessController;
28:
29: /**
30: * SecurityAccessorImpl implements SecurityAccessor component abstracting
31: * access to either Security Permission or Security Constraint implementations
32: *
33: * @author <a href="mailto:taylor@apache.org">David Sean Taylor </a>
34: * @version $Id: $
35: */
36: public class SecurityAccessControllerImpl implements
37: SecurityAccessController {
38: protected PageManager pageManager;
39: protected int securityMode = SecurityAccessController.PERMISSIONS;
40:
41: public SecurityAccessControllerImpl(PageManager pageManager,
42: int securityMode) {
43: this .pageManager = pageManager;
44: this .securityMode = securityMode;
45: }
46:
47: public int getSecurityMode() {
48: return securityMode;
49: }
50:
51: public boolean checkPortletAccess(
52: PortletDefinitionComposite portlet, int mask) {
53: if (portlet == null)
54: return false;
55: if (securityMode == SecurityAccessController.CONSTRAINTS) {
56: String constraintRef = portlet
57: .getJetspeedSecurityConstraint();
58: if (constraintRef == null) {
59: constraintRef = ((MutablePortletApplication) portlet
60: .getPortletApplicationDefinition())
61: .getJetspeedSecurityConstraint();
62: if (constraintRef == null) {
63: return true; // allow access
64: }
65: }
66: String actions = JetspeedActions.getContainerActions(mask);
67: return pageManager.checkConstraint(constraintRef, actions);
68: } else {
69: try {
70: AccessController.checkPermission(new PortletPermission(
71: portlet.getUniqueName(), mask));
72: } catch (AccessControlException ace) {
73: return false;
74: }
75: return true;
76: }
77:
78: }
79: }
|