[JBoss JIRA] Created: (GTNPORTAL-1163) Missing permission check on displayed item in 'portalnavigation' node 's page
6:31 a.m.
Missing permission check on displayed item in 'portalnavigation' node 's page
-----------------------------------------------------------------------------
Key: GTNPORTAL-1163
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1163
Project: GateIn Portal
Issue Type: Bug
Affects Versions: 3.0.0-GA
Reporter: Minh Hoang TO
When user clicks on 'Site' node, the page content shows portal sites for which
he/she has edit permission either on navigation or layout. The current Java code check
only edit permissions on PortalConfig
// Get portals without edit permission
UserACL userACL = getApplicationComponent(UserACL.class);
Iterator<PortalConfig> iterPortals = tempArrayList.iterator();
PortalConfig portalConfig;
while (iterPortals.hasNext())
{
portalConfig = iterPortals.next();
if (!userACL.hasEditPermission(portalConfig))
{
iterPortals.remove();
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:34 a.m.
New subject: [JBoss JIRA] Updated: (GTNPORTAL-1163) Missing permission check on displayed item in 'portalnavigation' node 's page
[
https://jira.jboss.org/jira/browse/GTNPORTAL-1163?page=com.atlassian.jira...
]
Minh Hoang TO updated GTNPORTAL-1163:
-------------------------------------
Assignee: Minh Hoang TO
Missing permission check on displayed item in
'portalnavigation' node 's page
-----------------------------------------------------------------------------
Key: GTNPORTAL-1163
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1163
Project: GateIn Portal
Issue Type: Bug
Affects Versions: 3.0.0-GA
Reporter: Minh Hoang TO
Assignee: Minh Hoang TO
When user clicks on 'Site' node, the page content shows portal sites for which
he/she has edit permission either on navigation or layout. The current Java code check
only edit permissions on PortalConfig
// Get portals without edit permission
UserACL userACL = getApplicationComponent(UserACL.class);
Iterator<PortalConfig> iterPortals = tempArrayList.iterator();
PortalConfig portalConfig;
while (iterPortals.hasNext())
{
portalConfig = iterPortals.next();
if (!userACL.hasEditPermission(portalConfig))
{
iterPortals.remove();
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:48 a.m.
New subject: [JBoss JIRA] Updated: (GTNPORTAL-1163) Missing permission check on displayed items in 'portalnavigation' node 's page
[
https://jira.jboss.org/jira/browse/GTNPORTAL-1163?page=com.atlassian.jira...
]
Minh Hoang TO updated GTNPORTAL-1163:
-------------------------------------
Summary: Missing permission check on displayed items in 'portalnavigation'
node 's page (was: Missing permission check on displayed item in
'portalnavigation' node 's page)
Missing permission check on displayed items in
'portalnavigation' node 's page
-------------------------------------------------------------------------------
Key: GTNPORTAL-1163
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1163
Project: GateIn Portal
Issue Type: Bug
Affects Versions: 3.0.0-GA
Reporter: Minh Hoang TO
Assignee: Minh Hoang TO
When user clicks on 'Site' node, the page content shows portal sites for which
he/she has edit permission either on navigation or layout. The current Java code check
only edit permissions on PortalConfig
// Get portals without edit permission
UserACL userACL = getApplicationComponent(UserACL.class);
Iterator<PortalConfig> iterPortals = tempArrayList.iterator();
PortalConfig portalConfig;
while (iterPortals.hasNext())
{
portalConfig = iterPortals.next();
if (!userACL.hasEditPermission(portalConfig))
{
iterPortals.remove();
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:48 a.m.
New subject: [JBoss JIRA] Commented: (GTNPORTAL-1163) Missing permission check on displayed item in 'portalnavigation' node 's page
[
https://jira.jboss.org/jira/browse/GTNPORTAL-1163?page=com.atlassian.jira...
]
Minh Hoang TO commented on GTNPORTAL-1163:
------------------------------------------
At the moment, cheking edit layout and edit navigation permissions simultaneously is quite
complex as PortalConfig and PageNavigation are not linked together. The 'find'
methods in DataStorage do not allow us to get the couple <PortalConfig,
PageNavigation> within one query.
For this issue, i suggest two solutions
1. Remove the 'Edit Layout' link (which is not really useful), then the
UISiteManagement plays the same roles as UIGroupNavigationManagement and could be merged
into a single class. Some ugly Java code in UIPortalComposer could be thrown away too!
2. Define a wrapper of PortalConfig and PageNavigation, and ofcourse methods to load this
wrapper in DataStorage. That should be st like
SiteConfig{
PortalConfig siteLayout;
PageNavigation siteNavigation;
public boolean couldEditSiteNavigation()
public boolean couldEditSiteLayout()
}
Personally, i vote for (1).
Missing permission check on displayed item in
'portalnavigation' node 's page
-----------------------------------------------------------------------------
Key: GTNPORTAL-1163
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1163
Project: GateIn Portal
Issue Type: Bug
Affects Versions: 3.0.0-GA
Reporter: Minh Hoang TO
Assignee: Minh Hoang TO
When user clicks on 'Site' node, the page content shows portal sites for which
he/she has edit permission either on navigation or layout. The current Java code check
only edit permissions on PortalConfig
// Get portals without edit permission
UserACL userACL = getApplicationComponent(UserACL.class);
Iterator<PortalConfig> iterPortals = tempArrayList.iterator();
PortalConfig portalConfig;
while (iterPortals.hasNext())
{
portalConfig = iterPortals.next();
if (!userACL.hasEditPermission(portalConfig))
{
iterPortals.remove();
}
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:32 p.m.
New subject: [JBoss JIRA] (GTNPORTAL-1163) Missing permission check on displayed items in 'portalnavigation' node 's page
[
https://issues.jboss.org/browse/GTNPORTAL-1163?page=com.atlassian.jira.pl...
]
Boleslaw Dawidowicz closed GTNPORTAL-1163.
------------------------------------------
Resolution: Out of Date
Should be verified in gatein master and reopened if still valid
Missing permission check on displayed items in
'portalnavigation' node 's page
-------------------------------------------------------------------------------
Key: GTNPORTAL-1163
URL: https://issues.jboss.org/browse/GTNPORTAL-1163
Project: GateIn Portal
Issue Type: Bug
Affects Versions: 3.0.0-GA
Reporter: Minh Hoang TO
Assignee: Minh Hoang TO
When user clicks on 'Site' node, the page content shows portal sites for which
he/she has edit permission either on navigation or layout. The current Java code check
only edit permissions on PortalConfig
// Get portals without edit permission
UserACL userACL = getApplicationComponent(UserACL.class);
Iterator<PortalConfig> iterPortals = tempArrayList.iterator();
PortalConfig portalConfig;
while (iterPortals.hasNext())
{
portalConfig = iterPortals.next();
if (!userACL.hasEditPermission(portalConfig))
{
iterPortals.remove();
}
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4354
days inactive
5167
days old
4 comments
2 participants
participants (2)
-
Boleslaw Dawidowicz (JIRA) -
Minh Hoang TO (JIRA)