Examples with HasPermission org.craftercms.commons.security.permissions.annotations.HasPermission used on opensource projects

Example 21 with HasPermission

use of org.craftercms.commons.security.permissions.annotations.HasPermission in project studio by craftercms.

the class UserServiceImpl method enableUsers.

@Override
@HasPermission(type = DefaultPermission.class, action = "update_users")
public List<User> enableUsers(List<Long> userIds, List<String> usernames, boolean enabled) throws ServiceLayerException, UserNotFoundException, AuthenticationException {
    List<User> users = userServiceInternal.enableUsers(userIds, usernames, enabled);
    SiteFeed siteFeed = siteService.getSite(studioConfiguration.getProperty(CONFIGURATION_GLOBAL_SYSTEM_SITE));
    AuditLog auditLog = auditServiceInternal.createAuditLogEntry();
    auditLog.setSiteId(siteFeed.getId());
    if (enabled) {
        auditLog.setOperation(OPERATION_ENABLE);
    } else {
        auditLog.setOperation(OPERATION_DISABLE);
    }
    auditLog.setActorId(getCurrentUser().getUsername());
    auditLog.setPrimaryTargetId(siteFeed.getSiteId());
    auditLog.setPrimaryTargetType(TARGET_TYPE_USER);
    auditLog.setPrimaryTargetValue(siteFeed.getName());
    List<AuditLogParameter> paramters = new ArrayList<AuditLogParameter>();
    for (User u : users) {
        AuditLogParameter paramter = new AuditLogParameter();
        paramter.setTargetId(Long.toString(u.getId()));
        paramter.setTargetType(TARGET_TYPE_USER);
        paramter.setTargetValue(u.getUsername());
        paramters.add(paramter);
    }
    auditLog.setParameters(paramters);
    auditServiceInternal.insertAuditLog(auditLog);
    return users;
}

Example 22 with HasPermission

use of org.craftercms.commons.security.permissions.annotations.HasPermission in project studio by craftercms.

the class UserServiceImpl method getUserSites.

@Override
@HasPermission(type = DefaultPermission.class, action = "read_users")
public List<Site> getUserSites(long userId, String username) throws ServiceLayerException, UserNotFoundException {
    List<Site> sites = new ArrayList<>();
    Set<String> allSites = siteService.getAllAvailableSites();
    List<Group> userGroups = userServiceInternal.getUserGroups(userId, username);
    boolean isSysAdmin = userGroups.stream().anyMatch(group -> group.getGroupName().equals(SYSTEM_ADMIN_GROUP));
    // Iterate all sites. If the user has any of the site groups, it has access to the site
    for (String siteId : allSites) {
        List<String> siteGroups = groupServiceInternal.getSiteGroups(siteId);
        if (isSysAdmin || userGroups.stream().anyMatch(userGroup -> siteGroups.contains(userGroup.getGroupName()))) {
            try {
                SiteFeed siteFeed = siteService.getSite(siteId);
                Site site = new Site();
                site.setSiteId(siteFeed.getSiteId());
                site.setDesc(siteFeed.getDescription());
                sites.add(site);
            } catch (SiteNotFoundException e) {
                logger.error("Site not found: {0}", e, siteId);
            }
        }
    }
    return sites;
}

Example 23 with HasPermission

use of org.craftercms.commons.security.permissions.annotations.HasPermission in project studio by craftercms.

the class UserServiceImpl method updateUser.

@Override
@HasPermission(type = DefaultPermission.class, action = "update_users")
public void updateUser(User user) throws ServiceLayerException, UserNotFoundException, AuthenticationException {
    userServiceInternal.updateUser(user);
    SiteFeed siteFeed = siteService.getSite(studioConfiguration.getProperty(CONFIGURATION_GLOBAL_SYSTEM_SITE));
    AuditLog auditLog = auditServiceInternal.createAuditLogEntry();
    auditLog.setOperation(OPERATION_UPDATE);
    auditLog.setSiteId(siteFeed.getId());
    auditLog.setActorId(getCurrentUser().getUsername());
    auditLog.setPrimaryTargetId(user.getUsername());
    auditLog.setPrimaryTargetType(TARGET_TYPE_USER);
    auditLog.setPrimaryTargetValue(user.getUsername());
    auditServiceInternal.insertAuditLog(auditLog);
}

Example 24 with HasPermission

use of org.craftercms.commons.security.permissions.annotations.HasPermission in project studio by craftercms.

the class WebDavServiceImpl method list.

/**
 * {@inheritDoc}
 */
@Override
@ValidateParams
@HasPermission(type = DefaultPermission.class, action = "webdav_read")
public List<WebDavItem> list(@ValidateStringParam(name = "siteId") @ProtectedResourceId("siteId") final String siteId, @ValidateStringParam(name = "profileId") final String profileId, @ValidateStringParam(name = "path") final String path, @ValidateStringParam(name = "type") final String type) throws WebDavException {
    WebDavProfile profile = getProfile(siteId, profileId);
    String listPath = StringUtils.appendIfMissing(profile.getBaseUrl(), "/");
    MimeType filterType;
    try {
        Sardine sardine = createClient(profile);
        if (StringUtils.isEmpty(type) || type.equals(FILTER_ALL_ITEMS)) {
            filterType = MimeType.valueOf(ALL_VALUE);
        } else {
            filterType = new MimeType(type);
        }
        if (StringUtils.isNotEmpty(path)) {
            String[] tokens = StringUtils.split(path, "/");
            for (String token : tokens) {
                if (StringUtils.isNotEmpty(token)) {
                    listPath += StringUtils.appendIfMissing(UriUtils.encode(token, charset.name()), "/");
                }
            }
        }
        if (!sardine.exists(listPath)) {
            logger.debug("Folder {0} doesn't exist", listPath);
            return Collections.emptyList();
        }
        logger.debug("Listing resources at {0}", listPath);
        List<DavResource> resources = sardine.list(listPath, 1, true);
        logger.debug("Found {0} resources at {0}", resources.size(), listPath);
        return resources.stream().skip(// to avoid repeating the folder being listed
        1).filter(r -> r.isDirectory() || filterType.includes(MimeType.valueOf(r.getContentType()))).map(r -> new WebDavItem(getName(r), getUrl(r, profileId, profile), r.isDirectory())).collect(Collectors.toList());
    } catch (Exception e) {
        throw new WebDavException("Error listing resources", e);
    }
}

Example 25 with HasPermission

use of org.craftercms.commons.security.permissions.annotations.HasPermission in project studio by craftercms.

the class WebDavServiceImpl method upload.

/**
 * {@inheritDoc}
 */
@Override
@ValidateParams
@HasPermission(type = DefaultPermission.class, action = "webdav_write")
public WebDavItem upload(@ValidateStringParam(name = "siteId") @ProtectedResourceId("siteId") final String siteId, @ValidateStringParam(name = "profileId") final String profileId, @ValidateStringParam(name = "path") final String path, @ValidateStringParam(name = "filename") final String filename, final InputStream content) throws WebDavException {
    WebDavProfile profile = getProfile(siteId, profileId);
    String uploadUrl = StringUtils.appendIfMissing(profile.getBaseUrl(), "/");
    try {
        Sardine sardine = createClient(profile);
        if (StringUtils.isNotEmpty(path)) {
            String[] folders = StringUtils.split(path, "/");
            for (String folder : folders) {
                uploadUrl += StringUtils.appendIfMissing(folder, "/");
                logger.debug("Checking folder {0}", uploadUrl);
                if (!sardine.exists(uploadUrl)) {
                    logger.debug("Creating folder {0}", uploadUrl);
                    sardine.createDirectory(uploadUrl);
                    logger.debug("Folder {0} created", uploadUrl);
                } else {
                    logger.debug("Folder {0} already exists", uploadUrl);
                }
            }
        }
        uploadUrl = StringUtils.appendIfMissing(uploadUrl, "/");
        String fileUrl = uploadUrl + UriUtils.encode(filename, charset.name());
        logger.debug("Starting upload of file {0}", filename);
        logger.debug("Uploading file to {0}", fileUrl);
        sardine.put(fileUrl, content);
        logger.debug("Upload complete for file {0}", fileUrl);
        return new WebDavItem(filename, getRemoteAssetUrl(profileId, path, filename), false);
    } catch (Exception e) {
        throw new WebDavException("Error uploading file", e);
    }
}