Fix ALF-2287: getChangeLog should only be available to admins

- lock down AtomPub and Web Service getContentChanges()

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@19697 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

config/alfresco/cmis-ws-context.xml

@@ -351,6 +351,7 @@
         <property name="fileFolderService" ref="FileFolderService" />
         <property name="searchService" ref="SearchService" />
         <property name="permissionService" ref="PermissionService" />
+        <property name="authorityService" ref="AuthorityService" />
 
         <property name="propertiesUtil" ref="propertiesUtils" />
     </bean>

config/alfresco/templates/webscripts/org/alfresco/cmis/changes.get.desc.xml

@@ -33,7 +33,7 @@
     <response type="cmis.atomfeed"/>
   </responses>
   
-  <authentication>guest</authentication>
+  <authentication>admin</authentication>
   <transaction allow="readonly"/>
   <family>CMIS</family>
   <lifecycle>public_api</lifecycle>

source/java/org/alfresco/repo/cmis/ws/DMAbstractServicePort.java

@@ -65,6 +65,7 @@ import org.alfresco.service.cmr.repository.AssociationRef;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
 import org.alfresco.service.cmr.search.SearchService;
+import org.alfresco.service.cmr.security.AuthorityService;
 import org.alfresco.service.cmr.security.PermissionService;
 import org.alfresco.service.cmr.version.Version;
 import org.alfresco.service.descriptor.DescriptorService;
@@ -132,6 +133,7 @@ public class DMAbstractServicePort
     protected SearchService searchService;
     protected PropertyUtil propertiesUtil;
     protected PermissionService permissionService;
+    protected AuthorityService authorityService;
 
     public void setCmisService(CMISServices cmisService)
     {
@@ -188,6 +190,11 @@ public class DMAbstractServicePort
         this.permissionService = permissionService;
     }
 
+    public void setAuthorityService(AuthorityService authorityService)
+    {
+        this.authorityService = authorityService;
+    }
+
     protected PropertyFilter createPropertyFilter(String filter) throws CmisException
     {
         try

source/java/org/alfresco/repo/cmis/ws/DMDiscoveryServicePort.java

@@ -40,6 +40,7 @@ import org.alfresco.cmis.CMISResultSetRow;
 import org.alfresco.cmis.CMISServiceException;
 import org.alfresco.cmis.PropertyFilter;
 import org.alfresco.repo.cmis.ws.utils.ExceptionUtil;
+import org.alfresco.repo.security.permissions.AccessDeniedException;
 import org.alfresco.service.cmr.repository.NodeRef;
 
 /**
@@ -172,6 +173,11 @@ public class DMDiscoveryServicePort extends DMAbstractServicePort implements Dis
     public void getContentChanges(String repositoryId, Holder<String> changeLogToken, Boolean includeProperties, String filter, Boolean includePolicyIds, Boolean includeACL,
             BigInteger maxItems, CmisExtensionType extension, Holder<CmisObjectListType> objects) throws CmisException
     {
+        if (!authorityService.hasAdminAuthority())
+        {
+            throw ExceptionUtil.createCmisException("Cannot retrieve content changes", new AccessDeniedException("Requires admin authority"));
+        }
+        
         // TODO: includePolicyIds
         checkRepositoryId(repositoryId);
         String changeToken = (null != changeLogToken) ? (changeLogToken.value) : (null);