diff --git a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/PlatformSecurityContext.java b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/PlatformSecurityContext.java index 9c99fb8e0..4e0053c78 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/PlatformSecurityContext.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/PlatformSecurityContext.java @@ -12,4 +12,6 @@ public interface PlatformSecurityContext { AppUser authenticatedUser(); void validateAccessRights(String resourceOfficeHierarchy); + + String officeHierarcy(); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/SpringSecurityPlatformSecurityContext.java b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/SpringSecurityPlatformSecurityContext.java index 2096725de..5e732562c 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/SpringSecurityPlatformSecurityContext.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/security/service/SpringSecurityPlatformSecurityContext.java @@ -46,4 +46,9 @@ public class SpringSecurityPlatformSecurityContext implements PlatformSecurityCo "The user doesn't have enough permissions to access the resource."); } } + + @Override + public String officeHierarcy() { + return authenticatedUser().getOffice().getHierarchy(); + } } diff --git a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientReadPlatformServiceImpl.java b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientReadPlatformServiceImpl.java index ce8e39e8f..01b1f8eea 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientReadPlatformServiceImpl.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/client/service/ClientReadPlatformServiceImpl.java @@ -93,14 +93,18 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService @Override public Page retrieveAll(final SearchParameters searchParameters) { - final AppUser currentUser = this.context.authenticatedUser(); - final String hierarchy = currentUser.getOffice().getHierarchy(); - final String hierarchySearchString = hierarchy + "%"; + final String hierarchy = this.context.officeHierarcy(); + String hierarchySearchString = hierarchy + "%"; + + if (searchParameters.isScopedByOfficeHierarchy()) { + this.context.validateAccessRights(searchParameters.getHierarchy()); + hierarchySearchString = searchParameters.getHierarchy(); + } final StringBuilder sqlBuilder = new StringBuilder(200); sqlBuilder.append("select SQL_CALC_FOUND_ROWS "); sqlBuilder.append(this.clientMapper.schema()); - sqlBuilder.append(" where o.hierarchy like ? or transferToOffice.hierarchy like ?"); + sqlBuilder.append(" where (o.hierarchy like ? or transferToOffice.hierarchy like ?) "); final String extraCriteria = buildSqlStringFromClientCriteria(searchParameters); @@ -136,7 +140,6 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService final String displayName = searchParameters.getName(); final String firstname = searchParameters.getFirstname(); final String lastname = searchParameters.getLastname(); - final String hierarchy = searchParameters.getHierarchy(); String extraCriteria = ""; if (sqlSearch != null) { @@ -166,8 +169,8 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService extraCriteria += " and lastname like " + ApiParameterHelper.sqlEncodeString(lastname); } - if (hierarchy != null) { - extraCriteria += " and o.hierarchy like " + ApiParameterHelper.sqlEncodeString(hierarchy + "%"); + if (searchParameters.isScopedByOfficeHierarchy()) { + extraCriteria += " and o.hierarchy like " + ApiParameterHelper.sqlEncodeString(searchParameters.getHierarchy() + "%"); } if (StringUtils.isNotBlank(extraCriteria)) { diff --git a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/SearchParameters.java b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/SearchParameters.java index 11e4bde88..b41a4c373 100644 --- a/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/SearchParameters.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/portfolio/group/service/SearchParameters.java @@ -112,6 +112,18 @@ public final class SearchParameters { return this.officeId != null && this.officeId != 0; } + public boolean isLimited() { + return this.limit != null && this.limit.intValue() > 0; + } + + public boolean isOffset() { + return this.offset != null; + } + + public boolean isScopedByOfficeHierarchy() { + return StringUtils.isNotBlank(this.hierarchy); + } + public String getSqlSearch() { return this.sqlSearch; } @@ -155,12 +167,4 @@ public final class SearchParameters { public String getSortOrder() { return this.sortOrder; } - - public boolean isLimited() { - return this.limit != null && this.limit.intValue() > 0; - } - - public boolean isOffset() { - return this.offset != null; - } } \ No newline at end of file