Examples with Right org.xwiki.security.authorization.Right used on opensource projects

Example 16 with Right

use of org.xwiki.security.authorization.Right in project xwiki-platform by xwiki.

the class XWikiCachingRightService method checkAccess.

@Override
public boolean checkAccess(String action, XWikiDocument doc, XWikiContext context) throws XWikiException {
    Right right = actionToRight(action);
    EntityReference entityReference = doc.getDocumentReference();
    LOGGER.debug("checkAccess for action [{}] on entity [{}].", right, entityReference);
    authenticateUser(context);
    if (contextualAuthorizationManager.hasAccess(right, entityReference)) {
        return true;
    }
    // delete, since it would prevent most user to do anything.
    if (context.getUserReference() == null && !DELETE_ACTION.equals(action) && !LOGIN_ACTION.equals(action)) {
        LOGGER.debug("Redirecting unauthenticated user to login, since it have been denied [{}] on [{}].", right, entityReference);
        showLogin(context);
    }
    return false;
}

Example 17 with Right

use of org.xwiki.security.authorization.Right in project xwiki-platform by xwiki.

the class CreateActionRequestHandler method loadAvailableTemplateProviders.

/**
 * @param spaceReference the space to check if there are available templates for
 * @param context the context of the current request
 * @param templateClassReference the reference to the template provider class
 * @return the available template providers for the passed space, as {@link Document}s
 */
private List<Document> loadAvailableTemplateProviders(SpaceReference spaceReference, DocumentReference templateClassReference, XWikiContext context) {
    List<Document> templates = new ArrayList<>();
    try {
        QueryManager queryManager = Utils.getComponent((Type) QueryManager.class, "secure");
        Query query = queryManager.createQuery("from doc.object(XWiki.TemplateProviderClass) as template " + "where doc.fullName not like 'XWiki.TemplateProviderTemplate' " + "order by template.name", Query.XWQL);
        // TODO: Extend the above query to include a filter on the type and allowed spaces properties so we can
        // remove the java code below, thus improving performance by not loading all the documents, but only the
        // documents we need.
        List<XWikiDocument> recommendedTemplates = new ArrayList<>();
        List<String> templateProviderDocNames = query.execute();
        for (String templateProviderName : templateProviderDocNames) {
            // get the document and template provider object
            DocumentReference reference = getCurrentMixedResolver().resolve(templateProviderName);
            // Verify that the current user has the view right on the Template document
            if (!getAuthManager().hasAccess(Right.VIEW, reference)) {
                continue;
            }
            XWikiDocument templateDoc = context.getWiki().getDocument(reference, context);
            BaseObject templateObject = templateDoc.getXObject(templateClassReference);
            // Check the template provider's visibility restrictions.
            if (isTemplateProviderAllowedInSpace(templateObject, spaceReference, TP_VISIBILITY_RESTRICTIONS_PROPERTY)) {
                List<String> creationRestrictions = getTemplateProviderRestrictions(templateObject, TP_CREATION_RESTRICTIONS_PROPERTY);
                if (creationRestrictions.size() > 0 && isTemplateProviderAllowedInSpace(templateObject, spaceReference, TP_CREATION_RESTRICTIONS_PROPERTY)) {
                    // Consider providers that have creations restrictions matching the current space as
                    // "recommended" and handle them separately.
                    recommendedTemplates.add(templateDoc);
                } else {
                    // Other visible providers.
                    templates.add(new Document(templateDoc, context));
                }
            }
        }
        EntityReferenceSerializer<String> localSerializer = Utils.getComponent(EntityReferenceSerializer.TYPE_STRING, LOCAL_SERIALIZER_HINT);
        String spaceStringReference = localSerializer.serialize(spaceReference);
        // Sort the recommended providers and promote the most specific ones.
        recommendedTemplates.sort(Comparator.comparing((XWikiDocument templateProviderDocument) -> {
            BaseObject templateProviderObject = templateProviderDocument.getXObject(templateClassReference);
            // Look at any set creation restrictions.
            List<String> restrictions = getTemplateProviderRestrictions(templateProviderObject, TP_CREATION_RESTRICTIONS_PROPERTY);
            // Return the longest (max) matching restriction reference size as being the most specific.
            return restrictions.stream().filter(restriction -> matchesRestriction(spaceStringReference, restriction)).mapToInt(restriction -> {
                SpaceReferenceResolver<String> spaceResolver = Utils.getComponent(SpaceReferenceResolver.TYPE_STRING);
                SpaceReference restrictionSpaceReference = spaceResolver.resolve(restriction);
                // The specificity score.
                int specificity = restrictionSpaceReference.getReversedReferenceChain().size();
                return specificity;
            }).max().orElse(0);
        }).reversed());
        this.recommendedTemplateProviders = recommendedTemplates.stream().map(recommendedTemplate -> new Document(recommendedTemplate, context)).collect(Collectors.toList());
        // Give priority to the providers that that specify creation restrictions
        templates.addAll(0, recommendedTemplateProviders);
    } catch (Exception e) {
        LOGGER.warn("There was an error getting the available templates for space {0}", spaceReference, e);
    }
    return templates;
}