Examples with UserManagementService org.exist.xmldb.UserManagementService used on opensource projects

Example 91 with UserManagementService

use of org.exist.xmldb.UserManagementService in project exist by eXist-db.

the class XMLDBSecurityTest method worldChownCollection.

// fails since guest has no write permissions
@Test(expected = XMLDBException.class)
public void worldChownCollection() throws XMLDBException {
    final Collection test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest1", "guest", "guest");
    final UserManagementService ums = (UserManagementService) test.getService("UserManagementService", "1.0");
    final Account guest = ums.getAccount("guest");
    // make myself the owner ;-)
    ums.chown(guest, "guest");
}

Example 92 with UserManagementService

use of org.exist.xmldb.UserManagementService in project exist by eXist-db.

the class XMLDBSecurityTest method canExecuteXQueryWithOnlyExecuteAndReadPermission.

/**
 * Note the eventual goal is for XQuery to be executeable in eXist
 * with just the EXECUTE flag set, this however will require some
 * serious refactoring. See my (Adam) posts to exist-open thread entitled
 * '[HEADS-UP] Merge in of Security Branch', most significant
 * messages from 08/02/2012
 */
@Test
public void canExecuteXQueryWithOnlyExecuteAndReadPermission() throws XMLDBException {
    Collection test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest1", "test1", "test1");
    final UserManagementService ums = (UserManagementService) test.getService("UserManagementService", "1.0");
    final String xquery = "<xquery>{ 1 + 2 }</xquery>";
    Resource xqueryResource = test.createResource("test.xquery", BinaryResource.RESOURCE_TYPE);
    xqueryResource.setContent(xquery);
    test.storeResource(xqueryResource);
    // execute only on xquery
    ums.chmod(xqueryResource, "r-x------");
    test.close();
    test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest1", "test1", "test1");
    xqueryResource = test.getResource("test.xquery");
    assertEquals(xquery, new String((byte[]) xqueryResource.getContent()));
    // execute the stored XQuery
    final EXistXPathQueryService queryService = (EXistXPathQueryService) test.getService("XPathQueryService", "1.0");
    final ResourceSet result = queryService.executeStoredQuery("/db/securityTest1/test.xquery");
    assertEquals("<xquery>3</xquery>", result.getResource(0).getContent());
}

Example 93 with UserManagementService

use of org.exist.xmldb.UserManagementService in project exist by eXist-db.

the class XMLDBSecurityTest method copyCollectionWithResource_doesNotPreservePermissions.

/**
 * As the 'test1' user, creates the collection and resource:
 *
 *  test1:users /db/securityTest3/source
 *  test1:users /db/securityTest3/source/source.xml
 *
 * As the 'test3' user, copy the collection:
 *
 *  /db/securityTest3/source
 *      -> /db/securityTest3/copy-of-source
 */
@Test
public void copyCollectionWithResource_doesNotPreservePermissions() throws XMLDBException {
    Collection test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest3", "test1", "test1");
    EXistCollectionManagementService cms = (EXistCollectionManagementService) test.getService("CollectionManagementService", "1.0");
    // create collection owned by "test1", and group "users" in /db/securityTest3
    Collection source = cms.createCollection("source");
    // create resource owned by "test1", and group "users" in /db/securityTest3/source
    final Resource resSource = source.createResource("source.xml", XMLResource.RESOURCE_TYPE);
    resSource.setContent("<test/>");
    source.storeResource(resSource);
    // as the 'test3' user copy the collection
    test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest3", "test3", "test3");
    cms = (EXistCollectionManagementService) test.getService("CollectionManagementService", "1.0");
    cms.copy("/db/securityTest3/source", "/db/securityTest3", "copy-of-source");
    UserManagementService ums = (UserManagementService) test.getService("UserManagementService", "1.0");
    final Collection copyOfSource = test.getChildCollection("copy-of-source");
    Permission permissions = ums.getPermissions(copyOfSource);
    // collection should be owned by test3:guest, i.e. permissions were not preserved from the test1 users doc /db/securityTest3/source
    assertEquals("test3", permissions.getOwner().getName());
    assertEquals("guest", permissions.getGroup().getName());
    ums = (UserManagementService) copyOfSource.getService("UserManagementService", "1.0");
    final Resource resCopyOfSource = copyOfSource.getResource("source.xml");
    permissions = ums.getPermissions(resCopyOfSource);
    // resource in collection should be owned by test3:guest, i.e. permissions were not preserved from the test1 users doc /db/securityTest3/source.xml
    assertEquals("test3", permissions.getOwner().getName());
    assertEquals("guest", permissions.getGroup().getName());
}

Example 94 with UserManagementService

use of org.exist.xmldb.UserManagementService in project exist by eXist-db.

the class XMLDBSecurityTest method cannotReadBinaryResourceWithoutReadPermission.

@Test(expected = XMLDBException.class)
public void cannotReadBinaryResourceWithoutReadPermission() throws XMLDBException {
    Collection test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest1", "test1", "test1");
    final UserManagementService ums = (UserManagementService) test.getService("UserManagementService", "1.0");
    Resource resource = test.getResource("test.bin");
    ums.chmod(resource, "-wx------");
    test.close();
    test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest1", "test1", "test1");
    resource = test.getResource("test.bin");
    assertArrayEquals("binary-test".getBytes(), (byte[]) resource.getContent());
}

Example 95 with UserManagementService

use of org.exist.xmldb.UserManagementService in project exist by eXist-db.

the class XMLDBSecurityTest method cannotUpdateXmlResourceWithoutExecutePermissionOnParentCollection.

@Test(expected = XMLDBException.class)
public void cannotUpdateXmlResourceWithoutExecutePermissionOnParentCollection() throws XMLDBException {
    Collection test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest1", "test1", "test1");
    final UserManagementService ums = (UserManagementService) test.getService("UserManagementService", "1.0");
    ums.chmod("rw-------");
    test.close();
    test = DatabaseManager.getCollection(getBaseUri() + "/db/securityTest1", "test1", "test1");
    Resource resource = test.getResource("test.xml");
    assertEquals("<test/>", resource.getContent());
    // attempt to pdate the resource
    resource.setContent("<testing/>");
    test.storeResource(resource);
}