When there are no authentication credentials, CQ permissions are ignored

- The public service interceptors prevent unauthenticated access,
   while the internal services ('little' services) should not apply any permission checks
 - Added explicit Authority-related test to check
 - ALF-9033, ALF-9129 (RINF 50), ALF-9322, ALF-7167 (RINF 11)


git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@28737 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

source/java/org/alfresco/repo/blog/cannedqueries/DraftsAndPublishedBlogPostsCannedQuery.java

@@ -183,10 +183,4 @@ public class DraftsAndPublishedBlogPostsCannedQuery extends AbstractCannedQueryP
         // No post-query sorting. It's done within the queryAndFilter() method above.
         return false;
     }
-    
-    @Override
-    protected boolean isApplyPostQueryPermissions()
-    {
-        return true;
-    }
 }

source/java/org/alfresco/repo/blog/cannedqueries/GetBlogPostsCannedQuery.java

@@ -168,10 +168,4 @@ public class GetBlogPostsCannedQuery extends AbstractCannedQueryPermissions<Blog
         // No post-query sorting. It's done within the queryAndFilter() method above.
         return false;
     }
-    
-    @Override
-    protected boolean isApplyPostQueryPermissions()
-    {
-        return true;
-    }
 }

source/java/org/alfresco/repo/security/authority/AuthorityServiceTest.java

@@ -32,9 +32,12 @@ import javax.transaction.UserTransaction;
 
 import junit.framework.TestCase;
 
+import net.sf.acegisecurity.AuthenticationCredentialsNotFoundException;
+
 import org.alfresco.error.AlfrescoRuntimeException;
 import org.alfresco.model.ContentModel;
 import org.alfresco.query.PagingRequest;
+import org.alfresco.query.PagingResults;
 import org.alfresco.repo.domain.permissions.AclDAO;
 import org.alfresco.repo.security.authentication.AuthenticationComponent;
 import org.alfresco.repo.security.authentication.AuthenticationUtil;
@@ -372,6 +375,31 @@ public class AuthorityServiceTest extends TestCase
         assertEquals("Unexpected result: " + authorities, 4 + (SITE_CNT*2), authorityService.getAuthorities().size());
     }
     
+    public void testNoUser()
+    {
+        pubAuthorityService.createAuthority(AuthorityType.GROUP, "DEFAULT");
+
+        authenticationComponent.setCurrentUser(AuthenticationUtil.getAdminUserName());
+        PagingResults<String> results = pubAuthorityService.getAuthorities(
+                AuthorityType.GROUP, null, null, true, true, new PagingRequest(10));
+        AuthenticationUtil.clearCurrentSecurityContext();
+        try
+        {
+            pubAuthorityService.getAuthorities(
+                    AuthorityType.GROUP, null, null, true, true, new PagingRequest(10));
+            fail("Public AuthorityService should reject unauthorized use.");
+        }
+        catch (AuthenticationCredentialsNotFoundException e)
+        {
+            // Expected
+        }
+        PagingResults<String> resultsCheck = authorityService.getAuthorities(
+                AuthorityType.GROUP, null, null, true, true, new PagingRequest(10));
+        assertEquals(
+                "Unauthorized use of private service should work just like 'admin'",
+                results.getPage().size(), resultsCheck.getPage().size());
+    }
+    
     public void testAuthorities()
     {
         assertEquals(1, getAllAuthorities(AuthorityType.ADMIN).size());

source/java/org/alfresco/repo/security/authority/GetAuthoritiesCannedQuery.java

@@ -164,6 +164,7 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
     @SuppressWarnings({ "unchecked"})
     protected List<AuthorityInfo> applyPostQuerySorting(List<AuthorityInfo> results, CannedQuerySortDetails sortDetails)
     {
+        @SuppressWarnings("rawtypes")
         final List<Pair<Object, SortOrder>> sortPairs = (List)sortDetails.getSortPairs();
         if (sortPairs.size() > 0)
         {
@@ -205,12 +206,6 @@ public class GetAuthoritiesCannedQuery extends AbstractCannedQueryPermissions<Au
         return (authName.toLowerCase().startsWith(nameFilterLower));
     }
     
-    @Override
-    protected boolean isApplyPostQueryPermissions()
-    {
-        return false;
-    }
-    
     private interface QueryCallback
     {
         boolean handle(AuthorityInfo auth);

source/java/org/alfresco/repo/security/permissions/impl/acegi/AbstractCannedQueryPermissions.java

@@ -18,7 +18,6 @@
  */
 package org.alfresco.repo.security.permissions.impl.acegi;
 
-import java.util.Collections;
 import java.util.List;
 
 import net.sf.acegisecurity.Authentication;
@@ -52,17 +51,32 @@ public abstract class AbstractCannedQueryPermissions<R> extends AbstractCannedQu
         this.methodSecurity = methodSecurity;
     }
     
+    /**
+     * {@inheritDoc}
+     * <p/>
+     * By default, the is a permission checking class.  Override the method if you wish to
+     * switch the behaviour at runtime.
+     * 
+     * @return      <tt>true</tt> always
+     */
+    @Override
+    protected boolean isApplyPostQueryPermissions()
+    {
+        return true;
+    }
+
     @Override
     protected List<R> applyPostQueryPermissions(List<R> results, int requestedCount)
     {
         Context context = ContextHolder.getContext();
         if ((context == null) || (! (context instanceof AlfrescoSecureContext)))
         {
+            // This indicates that we have come via the internal service methods
             if (logger.isDebugEnabled())
             {
-                logger.debug("Unexpected context: "+(context == null ? "null" : context.getClass())+" - "+Thread.currentThread().getId());
+                logger.debug("Ignoring post-query permissions.  The secure context is empty: " + this);
             }
-            return Collections.emptyList();
+            return results;
         }
         Authentication authentication = (((SecureContext) context).getAuthentication());