inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-07-31 17:39:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix for AWC-488 - when a permissions "access is denied" occurs for content/externalaccess/template URL then the login page is now shown

Browse Source 
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@2290 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Kevin Roast
2006-02-03 10:56:47 +00:00
parent da914e0549
commit 2c8233db84
7 changed files with 111 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
source/java/org/alfresco/web/app/servlet/DownloadContentServlet.java
View File

@@ -25,7 +25,6 @@ import java.text.MessageFormat;
import java.util.StringTokenizer;
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
@@ -39,6 +38,8 @@ import org.alfresco.service.cmr.repository.ContentService;
import org.alfresco.service.cmr.repository.MimetypeService;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.repository.StoreRef;
import org.alfresco.service.cmr.security.AccessStatus;
import org.alfresco.service.cmr.security.PermissionService;
import org.alfresco.service.namespace.QName;
import org.alfresco.web.app.Application;
import org.alfresco.web.ui.common.Utils;
@@ -141,7 +142,9 @@ public class DownloadContentServlet extends HttpServlet
propertyQName = QName.createQName(property);
}
// build noderef from the appropriate URL elements
NodeRef nodeRef = new NodeRef(storeRef, id);
if (logger.isDebugEnabled())
{
logger.debug("Found NodeRef: " + nodeRef.toString());
@@ -150,6 +153,20 @@ public class DownloadContentServlet extends HttpServlet
logger.debug("With attachment mode: " + attachment);
}
// get the services we need to retrieve the content
ServiceRegistry serviceRegistry = ServletHelper.getServiceRegistry(getServletContext());
ContentService contentService = serviceRegistry.getContentService();
PermissionService permissionService = serviceRegistry.getPermissionService();
// check that the user has at least READ_CONTENT access - else redirect to the login page
if (permissionService.hasPermission(nodeRef, PermissionService.READ_CONTENT) == AccessStatus.DENIED)
{
if (logger.isDebugEnabled())
logger.debug("User does not have permissions to read content for NodeRef: " + nodeRef.toString());
ServletHelper.redirectToLoginPage(req, res, getServletContext());
return;
}
if (attachment == true)
{
// set header based on filename - will force a Save As from the browse if it doesn't recognise it
@@ -160,10 +177,6 @@ public class DownloadContentServlet extends HttpServlet
try
{
// get the services we need to retrieve the content
ServiceRegistry serviceRegistry = ServletHelper.getServiceRegistry(getServletContext());
ContentService contentService = serviceRegistry.getContentService();
// get the content reader
ContentReader reader = contentService.getReader(nodeRef, propertyQName);
// ensure that it is safe to use