[gatein-issues] [JBoss JIRA] Commented: (GTNPORTAL-1163) Missing permission check on displayed item in 'portalnavigation' node 's page
[
https://jira.jboss.org/jira/browse/GTNPORTAL-1163?page=com.atlassian.jira...
]
Minh Hoang TO commented on GTNPORTAL-1163:
------------------------------------------
At the moment, cheking edit layout and edit navigation permissions simultaneously is quite
complex as PortalConfig and PageNavigation are not linked together. The 'find'
methods in DataStorage do not allow us to get the couple <PortalConfig,
PageNavigation> within one query.
For this issue, i suggest two solutions
1. Remove the 'Edit Layout' link (which is not really useful), then the
UISiteManagement plays the same roles as UIGroupNavigationManagement and could be merged
into a single class. Some ugly Java code in UIPortalComposer could be thrown away too!
2. Define a wrapper of PortalConfig and PageNavigation, and ofcourse methods to load this
wrapper in DataStorage. That should be st like
SiteConfig{
PortalConfig siteLayout;
PageNavigation siteNavigation;
public boolean couldEditSiteNavigation()
public boolean couldEditSiteLayout()
}
Personally, i vote for (1).
Missing permission check on displayed item in
'portalnavigation' node 's page
-----------------------------------------------------------------------------
Key: GTNPORTAL-1163
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1163
Project: GateIn Portal
Issue Type: Bug
Affects Versions: 3.0.0-GA
Reporter: Minh Hoang TO
Assignee: Minh Hoang TO
When user clicks on 'Site' node, the page content shows portal sites for which
he/she has edit permission either on navigation or layout. The current Java code check
only edit permissions on PortalConfig
// Get portals without edit permission
UserACL userACL = getApplicationComponent(UserACL.class);
Iterator<PortalConfig> iterPortals = tempArrayList.iterator();
PortalConfig portalConfig;
while (iterPortals.hasNext())
{
portalConfig = iterPortals.next();
if (!userACL.hasEditPermission(portalConfig))
{
iterPortals.remove();
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira