Examples with AccessDeniedException org.springframework.security.access.AccessDeniedException used on opensource projects

Example 1 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project head by mifos.

the class UncaughtExceptionHandler method checkForAccessDenied.

private ModelAndView checkForAccessDenied(Exception ex, HttpServletRequest request) {
    if (ex instanceof AccessDeniedException) {
        ModelAndView modelAndView = null;
        String viewName = determineViewName(ex, request);
        if (viewName != null) {
            modelAndView = getModelAndView(viewName, ex, request);
        }
        return modelAndView;
    }
    if (ex.getCause() != null && ex.getCause() instanceof Exception) {
        return checkForAccessDenied((Exception) ex.getCause(), request);
    }
    return null;
}

Example 2 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project head by mifos.

the class EditCustomerStatusAction method updateStatus.

@CloseSession
@TransactionDemarcate(validateAndResetToken = true)
public ActionForward updateStatus(ActionMapping mapping, ActionForm form, HttpServletRequest request, @SuppressWarnings("unused") HttpServletResponse response) throws Exception {
    EditCustomerStatusActionForm editStatusActionForm = (EditCustomerStatusActionForm) form;
    CustomerBO customerBOInSession = (CustomerBO) SessionUtils.getAttribute(Constants.BUSINESS_KEY, request);
    if (customerBOInSession.isBlackListed() && customerBOInSession.getStatus().getValue() == CustomerConstants.CLIENT_CLOSED) {
        try {
            this.clientServiceFacade.removeFromBlacklist(customerBOInSession.getCustomerId());
            customerBOInSession.setVersionNo(customerBOInSession.getVersionNo() + 1);
        } catch (AccessDeniedException e) {
            throw new CustomerException(SecurityConstants.KEY_ACTIVITY_NOT_ALLOWED);
        }
    }
    try {
        this.centerServiceFacade.updateCustomerStatus(customerBOInSession.getCustomerId(), customerBOInSession.getVersionNo(), editStatusActionForm.getFlagId(), editStatusActionForm.getNewStatusId(), editStatusActionForm.getNotes());
        createClientQuestionnaire.saveResponses(request, editStatusActionForm, customerBOInSession.getCustomerId());
    } catch (BusinessRuleException e) {
        throw new ApplicationException(e.getMessageKey(), e);
    }
    return mapping.findForward(getDetailAccountPage(form));
}

Example 3 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project head by mifos.

the class PentahoReportsServiceImpl method getReport.

@Override
public PentahoReport getReport(Integer reportId, Integer outputTypeId, Map<String, AbstractPentahoParameter> params) {
    ByteArrayOutputStream baos = null;
    if (!checkAccessToReport(reportId)) {
        throw new AccessDeniedException("Access denied");
    }
    try {
        String reportFileName = getReportFilename(reportId);
        // load report definition
        ResourceManager manager = new ResourceManager();
        manager.registerDefaults();
        URL url = PentahoReportLocator.getURLForReport(reportFileName);
        Resource res = manager.createDirectly(url, MasterReport.class);
        MasterReport report = (MasterReport) res.getResource();
        PentahoReport result = new PentahoReport();
        List<PentahoValidationError> errors = new ArrayList<PentahoValidationError>();
        try {
            addParametersToReport(report, params);
            validate(report, errors);
        } catch (ReflectionException ex) {
            errors.add(new PentahoValidationError(ex.getMessage()));
        }
        result.setErrors(errors);
        if (errors.isEmpty()) {
            baos = new ByteArrayOutputStream();
            PentahoOutputType outputType = PentahoOutputType.findById(outputTypeId);
            switch(outputType) {
                case XLS:
                    ExcelReportUtil.createXLS(report, baos);
                    break;
                case RTF:
                    RTFReportUtil.createRTF(report, baos);
                    break;
                case HTML:
                    HtmlReportUtil.createStreamHTML(report, baos);
                    break;
                case CSV:
                    CSVReportUtil.createCSV(report, baos, "UTF-8");
                    break;
                case XML:
                    XmlTableReportUtil.createFlowXML(report, baos);
                    break;
                default:
                    // PDF
                    PdfReportUtil.createPDF(report, baos);
                    break;
            }
            result.setContentType(outputType.getContentType());
            result.setFileExtension(outputType.getFileExtension());
            result.setName(getReportName(reportId));
            result.setContent(baos.toByteArray());
        }
        return result;
    } catch (Exception e) {
        throw new MifosRuntimeException(e);
    } finally {
        closeStream(baos);
    }
}

Example 4 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project head by mifos.

the class PentahoReportingController method executeReport.

@RequestMapping(value = "/execPentahoReport.ftl", method = RequestMethod.POST)
public ModelAndView executeReport(final HttpServletRequest request, HttpServletResponse response, @RequestParam(value = CANCEL_PARAM, required = false) String cancel, @Valid @ModelAttribute("pentahoReportFormBean") PentahoReportFormBean pentahoReportFormBean, BindingResult bindingResult) throws IOException {
    if (!this.pentahoReportsService.checkAccessToReport(pentahoReportFormBean.getReportId())) {
        throw new AccessDeniedException("Access denied");
    }
    ModelAndView mav = null;
    Integer reportId = pentahoReportFormBean.getReportId();
    if (StringUtils.isNotBlank(cancel)) {
        mav = new ModelAndView("redirect:" + REPORTS_MAIN_URL);
    } else if (bindingResult.hasErrors()) {
        mav = new ModelAndView("viewPentahoReport");
        initFormBean(pentahoReportFormBean, reportId, request);
    } else {
        Integer outputType = Integer.parseInt(pentahoReportFormBean.getOutputType());
        Map<String, AbstractPentahoParameter> reportParams = pentahoReportFormBean.getAllParameteres();
        PentahoReport report = this.pentahoReportsService.getReport(reportId, outputType, reportParams);
        if (report.isInError()) {
            for (PentahoValidationError error : report.getErrors()) {
                addErrorToBindingResult(error, bindingResult);
            }
            mav = new ModelAndView("viewPentahoReport");
            initFormBean(pentahoReportFormBean, reportId, request);
        } else {
            if (report.getContentType().equalsIgnoreCase("text/html")) {
                HashMap<String, String> modelMap = new HashMap<String, String>();
                modelMap.put("reportContent", new String(report.getContent()));
                mav = new ModelAndView("viewHtmlReport", modelMap);
            } else {
                response.setHeader("Content-Disposition", "attachment; filename=\"" + report.getFilename() + "\"");
                response.setContentType(report.getContentType());
                response.setContentLength(report.getContentSize());
                response.getOutputStream().write(report.getContent());
            }
        }
    }
    return mav;
}

Example 5 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security-oauth by spring-projects.

the class ScopeVoter method vote.

public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    int result = ACCESS_ABSTAIN;
    if (!(authentication instanceof OAuth2Authentication)) {
        return result;
    }
    for (ConfigAttribute attribute : attributes) {
        if (denyAccess.equals(attribute.getAttribute())) {
            return ACCESS_DENIED;
        }
    }
    OAuth2Request clientAuthentication = ((OAuth2Authentication) authentication).getOAuth2Request();
    for (ConfigAttribute attribute : attributes) {
        if (this.supports(attribute)) {
            result = ACCESS_DENIED;
            Set<String> scopes = clientAuthentication.getScope();
            for (String scope : scopes) {
                if (attribute.getAttribute().toUpperCase().equals((scopePrefix + scope).toUpperCase())) {
                    return ACCESS_GRANTED;
                }
            }
            if (result == ACCESS_DENIED && throwException) {
                InsufficientScopeException failure = new InsufficientScopeException("Insufficient scope for this resource", Collections.singleton(attribute.getAttribute().substring(scopePrefix.length())));
                throw new AccessDeniedException(failure.getMessage(), failure);
            }
        }
    }
    return result;
}