From 4d50d4b583458dadf4fef29162a548e7d60c00d5 Mon Sep 17 00:00:00 2001 From: mifoscontributer Date: Sat, 15 Jun 2013 16:00:34 +0530 Subject: [PATCH] Don't Allow other office user to Update the client Restrict other office user to update group or client details --- ...AbstractPlatformAccessDeniedException.java | 32 +++++++++++++++++++ .../exception/PermissionDeniedException.java | 11 +++++++ .../portfolio/client/domain/Client.java | 4 +++ ...WritePlatformServiceJpaRepositoryImpl.java | 15 ++++++++- .../portfolio/group/domain/Group.java | 4 +++ ...WritePlatformServiceJpaRepositoryImpl.java | 15 +++++++++ 6 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 mifosng-provider/src/main/java/org/mifosplatform/infrastructure/core/exception/AbstractPlatformAccessDeniedException.java create mode 100644 mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/exception/PermissionDeniedException.java diff --git a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/core/exception/AbstractPlatformAccessDeniedException.java b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/core/exception/AbstractPlatformAccessDeniedException.java new file mode 100644 index 000000000..e7776c7b9 --- /dev/null +++ b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/core/exception/AbstractPlatformAccessDeniedException.java @@ -0,0 +1,32 @@ +package org.mifosplatform.infrastructure.core.exception; + +/** + * A {@link RuntimeException} thrown when the authenticated user don't have + * enough permissions to access. + */ +public abstract class AbstractPlatformAccessDeniedException extends RuntimeException { + + private final String globalisationMessageCode; + private final String defaultUserMessage; + private final Object[] defaultUserMessageArgs; + + public AbstractPlatformAccessDeniedException(final String globalisationMessageCode, final String defaultUserMessage, + final Object... defaultUserMessageArgs) { + this.globalisationMessageCode = globalisationMessageCode; + this.defaultUserMessage = defaultUserMessage; + this.defaultUserMessageArgs = defaultUserMessageArgs; + } + + public String getGlobalisationMessageCode() { + return this.globalisationMessageCode; + } + + public String getDefaultUserMessage() { + return this.defaultUserMessage; + } + + public Object[] getDefaultUserMessageArgs() { + return this.defaultUserMessageArgs; + } + +} diff --git a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/exception/PermissionDeniedException.java b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/exception/PermissionDeniedException.java new file mode 100644 index 000000000..98d12b815 --- /dev/null +++ b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/exception/PermissionDeniedException.java @@ -0,0 +1,11 @@ +package org.mifosplatform.infrastructure.security.exception; + +import org.mifosplatform.infrastructure.core.exception.AbstractPlatformAccessDeniedException; + +public class PermissionDeniedException extends AbstractPlatformAccessDeniedException { + + public PermissionDeniedException(final String code, final String defaultMessage, final Long userId) { + super(code, defaultMessage, userId); + } + +} diff --git a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/domain/Client.java b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/domain/Client.java index b8408c84a..d1b8d763c 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/domain/Client.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/domain/Client.java @@ -389,5 +389,9 @@ public final class Client extends AbstractPersistable { public void setDisplayName(String displayName) { this.displayName = displayName; } + + public Office getOffice() { + return this.office; + } } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java index 52cf5ad4b..eba0db3d9 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java @@ -16,6 +16,7 @@ import org.mifosplatform.infrastructure.core.api.JsonCommand; import org.mifosplatform.infrastructure.core.data.CommandProcessingResult; import org.mifosplatform.infrastructure.core.data.CommandProcessingResultBuilder; import org.mifosplatform.infrastructure.core.exception.PlatformDataIntegrityException; +import org.mifosplatform.infrastructure.security.exception.PermissionDeniedException; import org.mifosplatform.infrastructure.security.service.PlatformSecurityContext; import org.mifosplatform.organisation.office.domain.Office; import org.mifosplatform.organisation.office.domain.OfficeRepository; @@ -32,6 +33,7 @@ import org.mifosplatform.portfolio.group.domain.GroupRepository; import org.mifosplatform.portfolio.group.exception.GroupNotFoundException; import org.mifosplatform.portfolio.note.domain.Note; import org.mifosplatform.portfolio.note.domain.NoteRepository; +import org.mifosplatform.useradministration.domain.AppUser; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -160,11 +162,22 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP public CommandProcessingResult updateClient(final Long clientId, final JsonCommand command) { try { - context.authenticatedUser(); + AppUser user =context.authenticatedUser(); this.fromApiJsonDeserializer.validateForUpdate(command.json()); final Client clientForUpdate = this.clientRepository.findOneWithNotFoundDetection(clientId); + final String clientHierarchy = clientForUpdate.getOffice().getHierarchy(); + + //Don't allow other office user to update + final Office loginUserOffice = user.getOffice(); + final String userHierarchy = loginUserOffice.getHierarchy(); + + if (!clientHierarchy.startsWith(userHierarchy)) { + final String code = "error.msg.not.enough.permissions.to.access.resource"; + final String defaultMessage = "The User with id "+user.getId()+" don't have permission to update this client"; + throw new PermissionDeniedException(code, defaultMessage, user.getId()); + } final Map changes = clientForUpdate.update(command); diff --git a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/domain/Group.java b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/domain/Group.java index d397ce7d8..baa305742 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/domain/Group.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/domain/Group.java @@ -370,4 +370,8 @@ public final class Group extends AbstractPersistable { public void setParent(final Group parent) { this.parent = parent; } + + public Office getOffice() { + return this.office; + } } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/GroupingTypesWritePlatformServiceJpaRepositoryImpl.java b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/GroupingTypesWritePlatformServiceJpaRepositoryImpl.java index 9a6935811..3cc819aad 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/GroupingTypesWritePlatformServiceJpaRepositoryImpl.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/GroupingTypesWritePlatformServiceJpaRepositoryImpl.java @@ -21,6 +21,7 @@ import org.mifosplatform.infrastructure.core.api.JsonCommand; import org.mifosplatform.infrastructure.core.data.CommandProcessingResult; import org.mifosplatform.infrastructure.core.data.CommandProcessingResultBuilder; import org.mifosplatform.infrastructure.core.exception.PlatformDataIntegrityException; +import org.mifosplatform.infrastructure.security.exception.PermissionDeniedException; import org.mifosplatform.infrastructure.security.service.PlatformSecurityContext; import org.mifosplatform.organisation.office.domain.Office; import org.mifosplatform.organisation.office.domain.OfficeRepository; @@ -45,6 +46,7 @@ import org.mifosplatform.portfolio.loanaccount.domain.Loan; import org.mifosplatform.portfolio.loanaccount.domain.LoanRepository; import org.mifosplatform.portfolio.note.domain.Note; import org.mifosplatform.portfolio.note.domain.NoteRepository; +import org.mifosplatform.useradministration.domain.AppUser; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -213,8 +215,21 @@ public class GroupingTypesWritePlatformServiceJpaRepositoryImpl implements Group private CommandProcessingResult updateGroupingType(final Long groupId, final JsonCommand command, final GroupTypes groupingType) { try { + AppUser user = this.context.authenticatedUser(); final Group groupForUpdate = this.groupRepository.findOneWithNotFoundDetection(groupId); final Long officeId = groupForUpdate.officeId(); + final Office groupOffice = groupForUpdate.getOffice(); + final String groupHierarchy = groupOffice.getHierarchy(); + + //Don't allow other office user to update + final Office loginUserOffice = this.context.authenticatedUser().getOffice(); + final String userHierarchy = loginUserOffice.getHierarchy(); + + if (!groupHierarchy.startsWith(userHierarchy)) { + final String code = "error.msg.not.enough.permissions.to.access.resource"; + final String defaultMessage = "The User with id "+user.getId()+" don't have permission to update this "+ groupingType.getValue(); + throw new PermissionDeniedException(code, defaultMessage, user.getId()); + } final Map actualChanges = groupForUpdate.update(command);