Examples with ContextualAuthorizationManager org.xwiki.security.authorization.ContextualAuthorizationManager used on opensource projects

Example 1 with ContextualAuthorizationManager

use of org.xwiki.security.authorization.ContextualAuthorizationManager in project xwiki-platform by xwiki.

the class RefactoringScriptServiceTest method moveWithPR.

@Test
public void moveWithPR() throws Exception {
    MoveRequest request = new MoveRequest();
    request.setCheckRights(false);
    DocumentReference bobReference = new DocumentReference("wiki", "Users", "Bob");
    request.setUserReference(bobReference);
    ContextualAuthorizationManager authorization = this.mocker.getInstance(ContextualAuthorizationManager.class);
    when(authorization.hasAccess(Right.PROGRAM)).thenReturn(true);
    getService().move(request);
    assertFalse(request.isCheckRights());
    assertEquals(bobReference, request.getUserReference());
}

Example 2 with ContextualAuthorizationManager

use of org.xwiki.security.authorization.ContextualAuthorizationManager in project xwiki-platform by xwiki.

the class SecureGroovyCompilationCustomizerTest method executeWithSecureCustomizerWhenProgrammingRights.

@Test
public void executeWithSecureCustomizerWhenProgrammingRights() throws Exception {
    final ConfigurationSource source = registerMockComponent(ConfigurationSource.class);
    final ContextualAuthorizationManager cam = registerMockComponent(ContextualAuthorizationManager.class);
    getMockery().checking(new Expectations() {

        {
            oneOf(source).getProperty("groovy.compilationCustomizers", Collections.emptyList());
            will(returnValue(Arrays.asList("secure")));
            oneOf(cam).hasAccess(Right.PROGRAM);
            will(returnValue(true));
        }
    });
    ScriptEngineManager manager = new ScriptEngineManager();
    ScriptEngineFactory groovyScriptEngineFactory = getComponentManager().getInstance(ScriptEngineFactory.class, "groovy");
    manager.registerEngineName("groovy", groovyScriptEngineFactory);
    final ScriptEngine engine = manager.getEngineByName("groovy");
    // Verify that the Secure AST Customizer is not active by running a Groovy script that raise an exception
    // when the Secure AST Customizer is active
    engine.eval("synchronized(this) { }");
}

Example 3 with ContextualAuthorizationManager

use of org.xwiki.security.authorization.ContextualAuthorizationManager in project xwiki-platform by xwiki.

the class SecureGroovyCompilationCustomizerTest method setUpWhenNoProgrammingRights.

private void setUpWhenNoProgrammingRights() throws Exception {
    final ConfigurationSource source = registerMockComponent(ConfigurationSource.class);
    final ContextualAuthorizationManager cam = registerMockComponent(ContextualAuthorizationManager.class);
    getMockery().checking(new Expectations() {

        {
            oneOf(source).getProperty("groovy.compilationCustomizers", Collections.emptyList());
            will(returnValue(Arrays.asList("secure")));
            oneOf(cam).hasAccess(Right.PROGRAM);
            will(returnValue(false));
        }
    });
    ScriptEngineManager manager = new ScriptEngineManager();
    ScriptEngineFactory groovyScriptEngineFactory = getComponentManager().getInstance(ScriptEngineFactory.class, "groovy");
    manager.registerEngineName("groovy", groovyScriptEngineFactory);
    this.engine = manager.getEngineByName("groovy");
}

Example 4 with ContextualAuthorizationManager

use of org.xwiki.security.authorization.ContextualAuthorizationManager in project xwiki-platform by xwiki.

the class XWikiDocument method executeValidationScript.

private boolean executeValidationScript(XWikiContext context, String validationScript) {
    try {
        ContextualAuthorizationManager authorization = Utils.getComponent(ContextualAuthorizationManager.class);
        DocumentReference validationScriptReference = getCurrentDocumentReferenceResolver().resolve(validationScript, getDocumentReference());
        // Make sure target document is allowed to execute Groovy
        // TODO: this check should probably be right in XWiki#parseGroovyFromPage
        authorization.checkAccess(Right.PROGRAM, validationScriptReference);
        XWikiValidationInterface validObject = (XWikiValidationInterface) context.getWiki().parseGroovyFromPage(validationScript, context);
        return validObject.validateDocument(this, context);
    } catch (Throwable e) {
        XWikiValidationStatus.addExceptionToContext(getFullName(), "", e, context);
        return false;
    }
}

Example 5 with ContextualAuthorizationManager

use of org.xwiki.security.authorization.ContextualAuthorizationManager in project xwiki-platform by xwiki.

the class BaseClass method executeValidationScript.

private boolean executeValidationScript(BaseObject obj, String validationScript, XWikiContext context) {
    try {
        ContextualAuthorizationManager authorization = Utils.getComponent(ContextualAuthorizationManager.class);
        DocumentReference validationScriptReference = getCurrentDocumentReferenceResolver().resolve(validationScript, getDocumentReference());
        // Make sure target document is allowed to execute Groovy
        // TODO: this check should probably be right in XWiki#parseGroovyFromPage
        authorization.checkAccess(Right.PROGRAM, validationScriptReference);
        XWikiValidationInterface validObject = (XWikiValidationInterface) context.getWiki().parseGroovyFromPage(validationScript, context);
        return validObject.validateObject(obj, context);
    } catch (Throwable e) {
        XWikiValidationStatus.addExceptionToContext(getName(), "", e, context);
        return false;
    }
}