Examples with ActivityMapper org.mifos.security.util.ActivityMapper used on opensource projects

Example 1 with ActivityMapper

use of org.mifos.security.util.ActivityMapper in project head by mifos.

the class MifosRequestProcessor method checkProcessRoles.

protected boolean checkProcessRoles(HttpServletRequest request, HttpServletResponse response, ActionMapping mapping) {
    boolean returnValue = true;
    if (request.getSession() != null && request.getSession().getAttribute("UserContext") != null) {
        HttpSession session = request.getSession();
        ActivityMapper activityMapper = ActivityMapper.getInstance();
        String path = mapping.getPath();
        String method = request.getParameter("method");
        String key = path + "-" + method;
        Short activityId = null;
        if (null != method && (method.equals("cancel") || method.equals("validate") || method.equals("searchPrev") || method.equals("searchNext"))) {
            return true;
        }
        String activityKey = null;
        if (isReportRequest(request)) {
            String reportId = request.getParameter("reportId");
            activityKey = key + "-" + reportId;
            activityId = activityMapper.getActivityId(activityKey);
        } else {
            activityId = activityMapper.getActivityId(key);
            request.setAttribute(Globals.ERROR_KEY, null);
        }
        if (null == activityId) {
            activityKey = path + "-" + request.getParameter("viewPath");
            activityId = activityMapper.getActivityId(activityKey);
        }
        // Check for fine-grained permissions
        if (null == activityId) {
            activityKey = key + "-" + session.getAttribute(SecurityConstants.SECURITY_PARAM);
            activityId = activityMapper.getActivityId(activityKey);
        }
        if (null == activityId) {
            return false;
        } else if (activityId.shortValue() == 0) {
            return true;
        }
        returnValue = ApplicationContextProvider.getBean(LegacyRolesPermissionsDao.class).isActivityAllowed((UserContext) session.getAttribute("UserContext"), setActivityContextFromRequest(request, activityId));
    }
    return returnValue;
}