inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-07-31 17:39:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

MNT-15068: Merged V2.2 to V2.2.1.x

Browse Source 
109401: RM-2391 : The Audit Log GET requests have to verify first which user is logged in and to which data it has access.
      - Added capability checking to the AuditLog Get REST API. Added a unit test. Minor changes on the Share side to forward the forbidden status.
   111064: RM-2391 :
      - also check for the access audit capability on each node from the report
   114786: RM-2391 :
      - Implemented final fix and added a unit test.


git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/modules/recordsmanagement/BRANCHES/V2.2.1.x@115178 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Tatyana Valkevych
2015-10-26 15:58:04 +00:00
parent bb0fa6f8cd
commit 7158053a19
7 changed files with 206 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
rm-server/config/alfresco/module/org_alfresco_module_rm/rm-service-context.xml
View File

@@ -921,6 +921,7 @@
<property name="recordsManagementActionService" ref="RecordsManagementActionService" />
<property name="filePlanService" ref="FilePlanService" />
<property name="namespaceService" ref="NamespaceService" />
<property name="capabilityService" ref="CapabilityService" />
<property name="ignoredAuditProperties">
<list>
<value>cm:lastThumbnailModification</value>

2
rm-server/config/alfresco/module/org_alfresco_module_rm/rm-webscript-context.xml
View File

@@ -536,6 +536,8 @@
<property name="recordsManagementAuditService" ref="RecordsManagementAuditService"/>
<property name="contentStreamer" ref="webscript.content.streamer" />
<property name="namespaceService" ref="namespaceService" />
<property name="capabilityService" ref="CapabilityService" />
<property name="filePlanService" ref="FilePlanService" />
</bean>
<!-- REST impl for GET Class Definitions for RM/DM -->

23
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/audit/RecordsManagementAuditServiceImpl.java
View File

@@ -40,6 +40,7 @@ import org.alfresco.model.ContentModel;
import org.alfresco.module.org_alfresco_module_rm.action.RecordsManagementAction;
import org.alfresco.module.org_alfresco_module_rm.action.RecordsManagementActionService;
import org.alfresco.module.org_alfresco_module_rm.audit.event.AuditEvent;
import org.alfresco.module.org_alfresco_module_rm.capability.CapabilityService;
import org.alfresco.module.org_alfresco_module_rm.fileplan.FilePlanService;
import org.alfresco.repo.audit.AuditComponent;
import org.alfresco.repo.audit.model.AuditApplication;
@@ -62,6 +63,7 @@ import org.alfresco.service.cmr.repository.ContentWriter;
import org.alfresco.service.cmr.repository.MLText;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.security.AccessStatus;
import org.alfresco.service.namespace.NamespaceService;
import org.alfresco.service.namespace.QName;
import org.alfresco.service.transaction.TransactionService;
@@ -98,6 +100,8 @@ public class RecordsManagementAuditServiceImpl extends AbstractLifecycleBean
/** Logger */
private static Log logger = LogFactory.getLog(RecordsManagementAuditServiceImpl.class);
private static final String ACCESS_AUDIT_CAPABILITY = "AccessAudit";
private static final String KEY_RM_AUDIT_NODE_RECORDS = "RMAUditNodeRecords";
protected static final String RM_AUDIT_EVENT_LOGIN_SUCCESS = "Login.Success";
@@ -179,6 +183,7 @@ public class RecordsManagementAuditServiceImpl extends AbstractLifecycleBean
private RecordsManagementActionService rmActionService;
private FilePlanService filePlanService;
private NamespaceService namespaceService;
protected CapabilityService capabilityService;
private boolean shutdown = false;
@@ -270,6 +275,17 @@ public class RecordsManagementAuditServiceImpl extends AbstractLifecycleBean
{
this.namespaceService = namespaceService;
}
/**
* @param capabilityService capability service
*/
public void setCapabilityService(CapabilityService capabilityService)
{
this.capabilityService = capabilityService;
}
/**
* @param ignoredAuditProperties
@@ -904,6 +920,13 @@ public class RecordsManagementAuditServiceImpl extends AbstractLifecycleBean
// Skip it
return true;
}
if(nodeRef != null && nodeService.exists(nodeRef) &&
!AccessStatus.ALLOWED.equals(
capabilityService.getCapabilityAccessState(nodeRef, ACCESS_AUDIT_CAPABILITY)))
{
return true;
}
// TODO: Refactor this to use the builder pattern
RecordsManagementAuditEntry entry = new RecordsManagementAuditEntry(

54
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/script/AuditLogGet.java
View File

@@ -21,9 +21,17 @@ package org.alfresco.module.org_alfresco_module_rm.script;
import java.io.File;
import java.io.IOException;
import org.alfresco.module.org_alfresco_module_rm.audit.RecordsManagementAuditQueryParameters;
import org.alfresco.module.org_alfresco_module_rm.audit.RecordsManagementAuditService.ReportFormat;
import org.alfresco.module.org_alfresco_module_rm.capability.CapabilityService;
import org.alfresco.module.org_alfresco_module_rm.fileplan.FilePlanService;
import org.alfresco.repo.web.scripts.content.ContentStreamer;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.security.AccessStatus;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.extensions.webscripts.Status;
import org.springframework.extensions.webscripts.WebScriptException;
import org.springframework.extensions.webscripts.WebScriptRequest;
import org.springframework.extensions.webscripts.WebScriptResponse;
@@ -39,9 +47,16 @@ public class AuditLogGet extends BaseAuditRetrievalWebScript
private static Log logger = LogFactory.getLog(AuditLogGet.class);
private static final String PARAM_EXPORT = "export";
private static final String ACCESS_AUDIT_CAPABILITY = "AccessAudit";
/** Content Streamer */
protected ContentStreamer contentStreamer;
/** Capability service */
protected CapabilityService capabilityService;
/** File plan service */
protected FilePlanService filePlanService;
/**
* @param contentStreamer
@@ -50,6 +65,24 @@ public class AuditLogGet extends BaseAuditRetrievalWebScript
{
this.contentStreamer = contentStreamer;
}
/**
*
* @param capabilityService Capability Service
*/
public void setCapabilityService(CapabilityService capabilityService)
{
this.capabilityService = capabilityService;
}
/**
*
* @param capabilityService Capability Service
*/
public void setFilePlanService(FilePlanService filePlanService)
{
this.filePlanService = filePlanService;
}
@Override
public void execute(WebScriptRequest req, WebScriptResponse res) throws IOException
@@ -58,8 +91,16 @@ public class AuditLogGet extends BaseAuditRetrievalWebScript
try
{
RecordsManagementAuditQueryParameters queryParams = parseQueryParameters(req);
ReportFormat reportFormat = parseReportFormat(req);
if( !userCanAccessAudit(queryParams) )
{
throw new WebScriptException(Status.STATUS_FORBIDDEN, "Access denied because the user does not have the Access Audit capability");
}
// parse the parameters and get a file containing the audit trail
auditTrail = this.rmAuditService.getAuditTrailFile(parseQueryParameters(req), parseReportFormat(req));
auditTrail = this.rmAuditService.getAuditTrailFile(queryParams, reportFormat);
if (logger.isDebugEnabled())
{
@@ -101,4 +142,15 @@ public class AuditLogGet extends BaseAuditRetrievalWebScript
}
}
}
private boolean userCanAccessAudit(RecordsManagementAuditQueryParameters queryParams)
{
NodeRef targetNode = queryParams.getNodeRef();
if( targetNode == null )
{
targetNode = filePlanService.getFilePlanBySiteId(FilePlanService.DEFAULT_RM_SITE_ID);
}
return AccessStatus.ALLOWED.equals(
capabilityService.getCapabilityAccessState(targetNode, ACCESS_AUDIT_CAPABILITY));
}
}

49
rm-server/test/java/org/alfresco/module/org_alfresco_module_rm/test/legacy/service/RecordsManagementAuditServiceImplTest.java
View File

@@ -141,6 +141,55 @@ public class RecordsManagementAuditServiceImplTest extends BaseRMTestCase
}, ADMIN_USER);
}
/**
* Test getAuditTrail method to check that deleted items always show in the audit.
*
* @see RM-2391 (last addressed isue)
*/
public void testGetAuditTrailForDeletedItem()
{
// We have only one entry for the event "audit.start":
List<RecordsManagementAuditEntry> entries = getAuditTrail(1, ADMIN_USER);
assertEquals(entries.get(0).getEvent(), "audit.start");
// Event "audit.view" was generated but will be visible on the next call to getAuditTrail().
// Make a change:
updateTitle(filePlan, ADMIN_USER); // event=Update RM Object
// Show the audit has been updated; at this point we have three entries for the three events up to now:
// "audit.start", "audit.view" and "Update RM Object";
entries = getAuditTrail(3, ADMIN_USER);
assertEquals(entries.get(0).getEvent(), "audit.start");
assertEquals(entries.get(1).getEvent(), "audit.view");
assertEquals(entries.get(2).getEvent(), "Update RM Object");
// New "audit.view" event was generated - will be visible on next getAuditTrail().
doTestInTransaction(new Test<Void>()
{
@Override
public Void run() throws Exception
{
nodeService.deleteNode(record);
List<RecordsManagementAuditEntry> entries = getAuditTrail(5, ADMIN_USER);
assertEquals(entries.get(0).getEvent(), "audit.start");
assertEquals(entries.get(1).getEvent(), "audit.view");
assertEquals(entries.get(2).getEvent(), "Update RM Object");
assertEquals(entries.get(3).getEvent(), "audit.view");
// Show the audit contains a reference to the deleted item:
assertEquals(entries.get(4).getEvent(), "Delete RM Object");
assertEquals(entries.get(4).getNodeRef(), record);
return null;
}
});
}
/**
* Test getAuditTrail method and parameter filters.
*/

72
rm-server/test/java/org/alfresco/module/org_alfresco_module_rm/test/legacy/webscript/AuditRestApiTest.java Normal file
View File

@@ -0,0 +1,72 @@
package org.alfresco.module.org_alfresco_module_rm.test.legacy.webscript;
import java.io.IOException;
import java.text.MessageFormat;
import org.alfresco.module.org_alfresco_module_rm.test.util.BaseRMWebScriptTestCase;
import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.util.GUID;
import org.springframework.extensions.webscripts.Status;
import org.springframework.extensions.webscripts.TestWebScriptServer.GetRequest;
public class AuditRestApiTest extends BaseRMWebScriptTestCase
{
/** URL for the REST APIs */
protected static final String GET_NODE_AUDITLOG_URL_FORMAT = "/api/node/{0}/rmauditlog";
private static final String USER_WITHOUT_AUDIT_CAPABILITY = GUID.generate();
private NodeRef record;
public void testAuditAccessCapability() throws IOException
{
String recordAuditUrl = MessageFormat.format(GET_NODE_AUDITLOG_URL_FORMAT,record.toString().replace("://", "/"));
sendRequest(new GetRequest(recordAuditUrl), Status.STATUS_OK, AuthenticationUtil.getAdminUserName() );
sendRequest(new GetRequest(recordAuditUrl), Status.STATUS_FORBIDDEN, USER_WITHOUT_AUDIT_CAPABILITY );
}
@Override
protected void setupTestData()
{
super.setupTestData();
retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Object>()
{
@Override
public Object execute() throws Throwable
{
AuthenticationUtil.setFullyAuthenticatedUser(AuthenticationUtil
.getSystemUserName());
createUser(USER_WITHOUT_AUDIT_CAPABILITY);
record = utils.createRecord(recordFolder, GUID.generate());
return null;
}
});
}
@Override
protected void tearDownImpl()
{
super.tearDownImpl();
deleteUser(USER_WITHOUT_AUDIT_CAPABILITY);
}
protected String getRMSiteId()
{
return filePlanService.DEFAULT_RM_SITE_ID;
}
}

7
rm-server/test/java/org/alfresco/module/org_alfresco_module_rm/test/util/BaseRMWebScriptTestCase.java
View File

@@ -279,7 +279,7 @@ public class BaseRMWebScriptTestCase extends BaseWebScriptTest
assertNotNull("Could not create base folder", folder);
// Create the site
siteId = GUID.generate();
siteId = getRMSiteId();
siteInfo = siteService.createSite("rm-site-dashboard", siteId, "title", "descrition", SiteVisibility.PUBLIC, RecordsManagementModel.TYPE_RM_SITE);
filePlan = siteService.getContainer(siteId, RmSiteType.COMPONENT_DOCUMENT_LIBRARY);
assertNotNull("Site document library container was not created successfully.", filePlan);
@@ -383,4 +383,9 @@ public class BaseRMWebScriptTestCase extends BaseWebScriptTest
authorityService.deleteAuthority(groupName, true);
}
}
protected String getRMSiteId()
{
return GUID.generate();
}
}