inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-07-31 17:39:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

RM-1972: Methods with invalid policy are granted access

Browse Source 
* invalid policy defintions now throw exception .. previously they just granted!
  * invalid capability definitions now throw exception .. previously they abstained with no message
  * reference to RM.Write removed and replaced with RM.Create or more appropriate permission check
  * adjustments to hold capabilities since they wheren't being exercised as we thought
  * ManageAccessRights no longer checks for frozen .. you should be able to manage the permissions of an object if it's frozen and you have the capability
  * Unit tests for new code and adjustments
  * Tweaks to existing integration tests where required



git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/modules/recordsmanagement/BRANCHES/V2.3@97786 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Roy Wetherall
2015-02-23 23:02:09 +00:00
parent 8ed56c8d91
commit ca1f697f45
25 changed files with 965 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/capability/RMEntryVoter.java
View File

@@ -29,12 +29,13 @@ import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.ConfigAttribute;
import net.sf.acegisecurity.vote.AccessDecisionVoter;
import org.alfresco.error.AlfrescoRuntimeException;
import org.alfresco.module.org_alfresco_module_rm.capability.policy.ConfigAttributeDefinition;
import org.alfresco.module.org_alfresco_module_rm.capability.policy.Policy;
import org.alfresco.module.org_alfresco_module_rm.security.RMMethodSecurityInterceptor;
import org.alfresco.module.org_alfresco_module_rm.util.AlfrescoTransactionSupport;
import org.alfresco.module.org_alfresco_module_rm.util.TransactionalResourceHelper;
import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.repo.transaction.AlfrescoTransactionSupport;
import org.alfresco.repo.transaction.TransactionalResourceHelper;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.namespace.NamespacePrefixResolver;
import org.aopalliance.intercept.MethodInvocation;
@@ -59,6 +60,12 @@ public class RMEntryVoter extends RMSecurityCommon
/** Capability Service */
private CapabilityService capabilityService;
/** Transactional Resource Helper */
private TransactionalResourceHelper transactionalResourceHelper;
/** Alfresco transaction support */
private AlfrescoTransactionSupport alfrescoTransactionSupport;
/** Policy map */
private Map<String, Policy> policies = new HashMap<String, Policy>();
@@ -78,6 +85,22 @@ public class RMEntryVoter extends RMSecurityCommon
{
this.nspr = nspr;
}
/**
* @param transactionalResourceHelper transactional resource helper
*/
public void setTransactionalResourceHelper(TransactionalResourceHelper transactionalResourceHelper)
{
this.transactionalResourceHelper = transactionalResourceHelper;
}
/**
* @param alfrescoTransactionSupport alfresco transaction support helper
*/
public void setAlfrescoTransactionSupport(AlfrescoTransactionSupport alfrescoTransactionSupport)
{
this.alfrescoTransactionSupport = alfrescoTransactionSupport;
}
/**
* Register a policy the voter
@@ -130,7 +153,7 @@ public class RMEntryVoter extends RMSecurityCommon
MethodInvocation mi = (MethodInvocation)object;
if (TransactionalResourceHelper.isResourcePresent("voting"))
if (transactionalResourceHelper.isResourcePresent("voting"))
{
if (logger.isDebugEnabled())
{
@@ -144,7 +167,7 @@ public class RMEntryVoter extends RMSecurityCommon
logger.debug("Method: " + mi.getMethod().getDeclaringClass().getName() + "." + mi.getMethod().getName());
}
AlfrescoTransactionSupport.bindResource("voting", true);
alfrescoTransactionSupport.bindResource("voting", true);
try
{
// The system user can do anything
@@ -165,8 +188,15 @@ public class RMEntryVoter extends RMSecurityCommon
return AccessDecisionVoter.ACCESS_ABSTAIN;
}
// check we have an instance of a method invocation
if (!(object instanceof MethodInvocation))
{
// we expect a method invocation
throw new AlfrescoRuntimeException("Passed object is not an instance of MethodInvocation as expected.");
}
// get information about the method
MethodInvocation invocation = (MethodInvocation) object;
Method method = invocation.getMethod();
Class[] params = method.getParameterTypes();
@@ -273,7 +303,7 @@ public class RMEntryVoter extends RMSecurityCommon
}
finally
{
AlfrescoTransactionSupport.unbindResource("voting");
alfrescoTransactionSupport.unbindResource("voting");
}
// all voted to allow
@@ -281,11 +311,12 @@ public class RMEntryVoter extends RMSecurityCommon
}
/**
* Check the capability
*
* @param invocation
* @param params
* @param cad
* @return
* @param invocation method invocation
* @param params parameters
* @param cad config definition
* @return int evaluation result
*/
@SuppressWarnings("rawtypes")
private int checkCapability(MethodInvocation invocation, Class[] params, ConfigAttributeDefinition cad)
@@ -298,29 +329,33 @@ public class RMEntryVoter extends RMSecurityCommon
Capability capability = capabilityService.getCapability(cad.getRequired().getName());
if (capability == null)
{
return AccessDecisionVoter.ACCESS_DENIED;
throw new AlfrescoRuntimeException("The capability '" + cad.getRequired().getName() + "' set on method '" + invocation.getMethod().getName() + "' does not exist.");
}
return capability.hasPermissionRaw(testNodeRef);
}
/**
* Evaluate policy to determine access
*
* @param invocation
* @param params
* @param cad
* @return
* @param invocation invocation information
* @param params parameters
* @param cad configuration attribute definition
* @return int policy evaluation
*/
@SuppressWarnings("rawtypes")
private int checkPolicy(MethodInvocation invocation, Class[] params, ConfigAttributeDefinition cad)
{
// try to get the policy
Policy policy = policies.get(cad.getPolicyName());
if (policy == null)
{
return AccessDecisionVoter.ACCESS_GRANTED;
// throw an exception if the policy is invalid
throw new AlfrescoRuntimeException("The policy '" + cad.getPolicyName() + "' set on the method '" + invocation.getMethod().getName() + "' does not exist.");
}
else
{
// evaluate the policy
return policy.evaluate(invocation, params, cad);
}
}

15
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/capability/declarative/AbstractCapabilityCondition.java
View File

@@ -26,8 +26,8 @@ import org.alfresco.module.org_alfresco_module_rm.freeze.FreezeService;
import org.alfresco.module.org_alfresco_module_rm.model.RecordsManagementModel;
import org.alfresco.module.org_alfresco_module_rm.record.RecordService;
import org.alfresco.module.org_alfresco_module_rm.recordfolder.RecordFolderService;
import org.alfresco.module.org_alfresco_module_rm.util.TransactionalResourceHelper;
import org.alfresco.repo.security.authentication.AuthenticationUtil;
import org.alfresco.repo.transaction.TransactionalResourceHelper;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.repository.NodeService;
import org.alfresco.service.cmr.security.PermissionService;
@@ -56,6 +56,9 @@ public abstract class AbstractCapabilityCondition implements CapabilityCondition
protected FilePlanService filePlanService;
protected DispositionService dispositionService;
protected RecordFolderService recordFolderService;
/** transaction resource helper */
private TransactionalResourceHelper transactionalResourceHelper;
/**
* @param recordService record service
@@ -112,6 +115,14 @@ public abstract class AbstractCapabilityCondition implements CapabilityCondition
{
this.recordFolderService = recordFolderService;
}
/**
* @param transactionalResourceHelper transactional resource helper
*/
public void setTransactionalResourceHelper(TransactionalResourceHelper transactionalResourceHelper)
{
this.transactionalResourceHelper = transactionalResourceHelper;
}
/**
* @see org.alfresco.module.org_alfresco_module_rm.capability.declarative.CapabilityCondition#getName()
@@ -131,7 +142,7 @@ public abstract class AbstractCapabilityCondition implements CapabilityCondition
boolean result = false;
// check transaction cache
Map<String, Boolean> map = TransactionalResourceHelper.getMap(KEY_EVALUATE);
Map<String, Boolean> map = transactionalResourceHelper.getMap(KEY_EVALUATE);
String key = getName() + "|" + nodeRef.toString() + "|" + AuthenticationUtil.getRunAsUser();
if (map.containsKey(key))
{

60
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/capability/declarative/condition/FillingOnHoldContainerCapabilityCondition.java Normal file
View File

@@ -0,0 +1,60 @@
/*
* Copyright (C) 2005-2014 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.module.org_alfresco_module_rm.capability.declarative.condition;
import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel;
import org.alfresco.module.org_alfresco_module_rm.capability.declarative.AbstractCapabilityCondition;
import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.security.AccessStatus;
/**
* Filling capability for hold condition.
*
* @author Roy Wetherall
* @since 2.3
*/
public class FillingOnHoldContainerCapabilityCondition extends AbstractCapabilityCondition
{
/**
* @see org.alfresco.module.org_alfresco_module_rm.capability.declarative.CapabilityCondition#evaluate(org.alfresco.service.cmr.repository.NodeRef)
*/
@Override
public boolean evaluateImpl(NodeRef nodeRef)
{
boolean result = false;
NodeRef holdContainer = nodeRef;
// if we have a file plan, go get the hold container
if (filePlanService.isFilePlan(nodeRef) == true)
{
holdContainer = filePlanService.getHoldContainer(nodeRef);
}
// ensure we are dealing with a hold container
if (TYPE_HOLD_CONTAINER.equals(nodeService.getType(holdContainer)))
{
if (permissionService.hasPermission(holdContainer, RMPermissionModel.FILE_RECORDS) != AccessStatus.DENIED)
{
result = true;
}
}
return result;
}
}

38
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/capability/declarative/condition/FrozenCapabilityCondition.java
View File

@@ -19,27 +19,57 @@
package org.alfresco.module.org_alfresco_module_rm.capability.declarative.condition;
import org.alfresco.module.org_alfresco_module_rm.capability.declarative.AbstractCapabilityCondition;
import org.alfresco.module.org_alfresco_module_rm.hold.HoldService;
import org.alfresco.service.cmr.repository.NodeRef;
/**
* Indicates whether an item is held or not.
* <p>
* A hold object is by definition considered to be held.
*
* @author Roy Wetherall
*/
public class FrozenCapabilityCondition extends AbstractCapabilityCondition
{
private boolean checkChildren = false;
/** indicates whether children should be checked */
private boolean checkChildren = false;
/** hold service */
private HoldService holdService;
/**
* @param checkChildren true to check children, false otherwise
*/
public void setCheckChildren(boolean checkChildren)
{
this.checkChildren = checkChildren;
}
/**
* @param holdService hold service
*/
public void setHoldService(HoldService holdService)
{
this.holdService = holdService;
}
@Override
public boolean evaluateImpl(NodeRef nodeRef)
{
boolean result = freezeService.isFrozen(nodeRef);
if (!result && checkChildren)
boolean result = false;
// check whether we are working with a hold or not
if (holdService.isHold(nodeRef))
{
result = freezeService.hasFrozenChildren(nodeRef);
result = true;
}
else
{
result = freezeService.isFrozen(nodeRef);
if (!result && checkChildren)
{
result = freezeService.hasFrozenChildren(nodeRef);
}
}
return result;
}

21
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/capability/declarative/condition/HoldCapabilityCondition.java
View File

@@ -62,16 +62,23 @@ public class HoldCapabilityCondition extends AbstractCapabilityCondition
{
boolean result = false;
List<NodeRef> holds = holdService.heldBy(nodeRef, includedInHold);
for (NodeRef hold : holds)
if (holdService.isHold(nodeRef))
{
// return true as soon as we find one hold we have filling permission on
if (AccessStatus.ALLOWED.equals(permissionService.hasPermission(hold, RMPermissionModel.FILING)))
result = AccessStatus.ALLOWED.equals(permissionService.hasPermission(nodeRef, RMPermissionModel.FILING));
}
else
{
List<NodeRef> holds = holdService.heldBy(nodeRef, includedInHold);
for (NodeRef hold : holds)
{
result = true;
break;
// return true as soon as we find one hold we have filling permission on
if (AccessStatus.ALLOWED.equals(permissionService.hasPermission(hold, RMPermissionModel.FILING)))
{
result = true;
break;
}
}
}
}
return result;
}

12
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/disposition/DispositionServiceImpl.java
View File

@@ -969,7 +969,7 @@ public class DispositionServiceImpl extends ServiceBaseImpl
* @see org.alfresco.module.org_alfresco_module_rm.disposition.DispositionService#cutoffDisposableItem(NodeRef)
*/
@Override
public void cutoffDisposableItem(NodeRef nodeRef)
public void cutoffDisposableItem(final NodeRef nodeRef)
{
ParameterCheck.mandatory("nodeRef", nodeRef);
@@ -1001,7 +1001,15 @@ public class DispositionServiceImpl extends ServiceBaseImpl
if (recordFolderService.isRecordFolder(nodeRef) &&
!recordFolderService.isRecordFolderClosed(nodeRef))
{
recordFolderService.closeRecordFolder(nodeRef);
// runAs system so that we can close a record that has already been cutoff
authenticationUtil.runAsSystem(new RunAsWork<Void>()
{
public Void doWork() throws Exception
{
recordFolderService.closeRecordFolder(nodeRef);
return null;
}
});
}
}
else

2
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/security/RMMethodSecurityInterceptor.java
View File

@@ -39,7 +39,7 @@ public class RMMethodSecurityInterceptor extends MethodSecurityInterceptor
{
public String name;
public AccessStatus status;
public Map<String, Boolean> conditions = new HashMap<String, Boolean>();
public Map<String, Boolean> conditions = new HashMap<String, Boolean>();
}
/**

45
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/util/AlfrescoTransactionSupport.java Normal file
View File

@@ -0,0 +1,45 @@
/*
* Copyright (C) 2005-2014 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.module.org_alfresco_module_rm.util;
/**
* Alfresco Transaction Support delegation bean.
*
* @author Roy Wetherall
* @since 2.3
* @see org.alfresco.repo.transaction.AlfrescoTransactionSupport
*/
public class AlfrescoTransactionSupport
{
/**
* @see org.alfresco.repo.transaction.AlfrescoTransactionSupport#bindResource(Object, Object)
*/
public void bindResource(Object key, Object resource)
{
org.alfresco.repo.transaction.AlfrescoTransactionSupport.bindResource(key, resource);
}
/**
* @see org.alfresco.repo.transaction.AlfrescoTransactionSupport#unbindResource(Object)
*/
public void unbindResource(Object key)
{
org.alfresco.repo.transaction.AlfrescoTransactionSupport.unbindResource(key);
}
}

106
rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/util/TransactionalResourceHelper.java Normal file
View File

@@ -0,0 +1,106 @@
/*
* Copyright (C) 2005-2014 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.module.org_alfresco_module_rm.util;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.TreeSet;
/**
* Delegate spring bean for TransactionResourceHelper
*
* @author Roy Wetherall
* @since 2.3
* @see org.alfresco.repo.transaction.TransactionalResourceHelper
*/
public class TransactionalResourceHelper
{
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#getCount(Object)
*/
public int getCount(Object resourceKey)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.getCount(resourceKey);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#getCount(Object)
*/
public void resetCount(Object resourceKey)
{
org.alfresco.repo.transaction.TransactionalResourceHelper.resetCount(resourceKey);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#incrementCount(Object)
*/
public int incrementCount(Object resourceKey)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.incrementCount(resourceKey);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#decrementCount(Object, boolean)
*/
public int decrementCount(Object resourceKey, boolean allowNegative)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.decrementCount(resourceKey, allowNegative);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#getCount(Object)
*/
public boolean isResourcePresent(Object resourceKey)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.isResourcePresent(resourceKey);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#getMap(Object)
*/
public <K,V> Map<K,V> getMap(Object resourceKey)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.getMap(resourceKey);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#getSet(Object)
*/
public <V> Set<V> getSet(Object resourceKey)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.getSet(resourceKey);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#getTreeSet(Object)
*/
public <V> TreeSet<V> getTreeSet(Object resourceKey)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.getTreeSet(resourceKey);
}
/**
* @see org.alfresco.repo.transaction.TransactionalResourceHelper#getList(Object)
*/
public <V> List<V> getList(Object resourceKey)
{
return org.alfresco.repo.transaction.TransactionalResourceHelper.getList(resourceKey);
}
}