Author: aparfonov Date: 2010-06-04 10:51:34 -0400 (Fri, 04 Jun 2010) New Revision: 2494 Modified: core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/ConversationState.java core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/Identity.java Log: EXOJCR-770 : need 'modifyIdentity' permission to be able modify memeberships or roles Modified: core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/ConversationState.java =================================================================== --- core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/ConversationState.java 2010-06-04 13:47:36 UTC (rev 2493) +++ core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/ConversationState.java 2010-06-04 14:51:34 UTC (rev 2494) @@ -23,7 +23,7 @@ /** * Created by The eXo Platform SAS . - * + * * @author Gennady Azarenkov * @version $Id: $ */ @@ -31,6 +31,8 @@ public class ConversationState { + private static final RuntimePermission SET_CURRENT_STATE_PERMISSION = new RuntimePermission("setCurrentState"); + /** * "subject". */ @@ -67,11 +69,17 @@ /** * Preset current ConversationState. - * + * * @param state ConversationState */ public static void setCurrent(ConversationState state) { + SecurityManager security = System.getSecurityManager(); + if (security != null) + { + security.checkPermission(SET_CURRENT_STATE_PERMISSION); + } + current.set(state); } @@ -85,12 +93,13 @@ /** * sets attribute. - * + * * @param key * @param value */ public void setAttribute(String name, Object value) { + // TODO : need check is it allowed to set any attributes this.attributes.put(name, value); } @@ -113,7 +122,7 @@ /** * removes attribute. - * + * * @param key */ public void removeAttribute(String name) Modified: core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/Identity.java =================================================================== --- core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/Identity.java 2010-06-04 13:47:36 UTC (rev 2493) +++ core/branches/2.3-SEC/exo.core.component.security.core/src/main/java/org/exoplatform/services/security/Identity.java 2010-06-04 14:51:34 UTC (rev 2494) @@ -20,15 +20,17 @@ import java.util.Collection; import java.util.HashSet; +import java.util.Iterator; import java.util.Set; import javax.security.auth.Subject; /** - * Created by The eXo Platform SAS .<br/> User Session encapsulates user's - * principals such as name, groups along with JAAS subject (useful in J2EE - * environment) as well as other optional attributes - * + * Created by The eXo Platform SAS .<br/> + * User Session encapsulates user's principals such as name, groups along with + * JAAS subject (useful in J2EE environment) as well as other optional + * attributes + * * @author Gennady Azarenkov * @version $Id: $ */ @@ -36,6 +38,10 @@ public class Identity { + private static final RuntimePermission SET_SUBJECT_PERMISSION = new RuntimePermission("setSubject"); + + private static final RuntimePermission MODIFY_IDENTITY_PERMISSION = new RuntimePermission("modifyIdentity"); + /** * User's identifier. */ @@ -84,8 +90,8 @@ public Identity(String userId, Collection<MembershipEntry> memberships, Collection<String> roles) { this.userId = userId; - this.memberships = new HashSet<MembershipEntry>(memberships); - this.roles = roles; + this.memberships = new SecureSet<MembershipEntry>(memberships); + this.roles = new SecureSet<String>(roles); } /** @@ -118,7 +124,7 @@ /** * Check is user member of group. - * + * * @param group the group. * @return true if user has any membershipType for given group, false * otherwise. @@ -133,6 +139,7 @@ */ public Set<String> getGroups() { + // TODO : Need to protect group's set ?? Set<String> groups = new HashSet<String>(); for (MembershipEntry m : memberships) { @@ -146,7 +153,7 @@ */ public void setMemberships(Collection<MembershipEntry> memberships) { - this.memberships = new HashSet<MembershipEntry>(memberships); + this.memberships = new SecureSet<MembershipEntry>(memberships); } /** @@ -159,12 +166,12 @@ /** * Sets the roles for J2EE environment using. - * + * * @param roles the roles. */ public void setRoles(Collection<String> roles) { - this.roles = roles; + this.roles = new SecureSet<String>(roles); } /** @@ -188,12 +195,17 @@ */ public void setSubject(Subject subject) { + SecurityManager security = System.getSecurityManager(); + if (security != null) + { + security.checkPermission(SET_SUBJECT_PERMISSION); + } this.subject = subject; } /** * Check is given {@link MembershipEntry} presents in user's memberships. - * + * * @param checkMe the MembershipEntry. * @return true if presents false otherwise. */ @@ -202,4 +214,146 @@ return memberships.contains(checkMe); } + private static class SecureSet<T> implements Set<T> + { + + final Set<T> set; + + SecureSet() + { + this.set = new HashSet<T>(); + } + + SecureSet(Collection<T> set) + { + this.set = new HashSet<T>(set); + } + + public boolean add(T e) + { + checkPermission(); + return set.add(e); + } + + public boolean addAll(Collection<? extends T> elements) + { + if (elements == null) + { + throw new NullPointerException(); + } + checkPermission(); + return elements.size() > 0; + } + + public void clear() + { + checkPermission(); + set.clear(); + } + + public boolean contains(Object o) + { + return set.contains(o); + } + + public boolean containsAll(Collection<?> coll) + { + return set.containsAll(coll); + } + + public boolean equals(Object o) + { + return o == this || set.equals(o); + } + + public int hashCode() + { + return set.hashCode(); + } + + public boolean isEmpty() + { + return set.isEmpty(); + } + + public Iterator<T> iterator() + { + return new Iterator<T>() + { + Iterator<? extends T> i = set.iterator(); + + public boolean hasNext() + { + return i.hasNext(); + } + + public T next() + { + return i.next(); + } + + public void remove() + { + checkPermission(); + i.remove(); + } + }; + } + + public boolean remove(Object o) + { + checkPermission(); + return set.remove(o); + } + + public boolean removeAll(Collection<?> pds) + { + if (pds == null) + { + throw new NullPointerException(); + } + checkPermission(); + return set.removeAll(pds); + } + + public boolean retainAll(Collection<?> pds) + { + if (pds == null) + { + throw new NullPointerException(); + } + checkPermission(); + return set.retainAll(pds); + } + + public int size() + { + return set.size(); + } + + public Object[] toArray() + { + return set.toArray(); + } + + public <T> T[] toArray(T[] a) + { + return set.toArray(a); + } + + public String toString() + { + return set.toString(); + } + + protected void checkPermission() + { + SecurityManager security = System.getSecurityManager(); + if (security != null) + { + security.checkPermission(MODIFY_IDENTITY_PERMISSION); + } + } + } + }