diff --git a/mifosng-db/migrations/core_db/V153__Insert_missed_permissions.sql b/mifosng-db/migrations/core_db/V153__Insert_missed_permissions.sql new file mode 100644 index 000000000..d257259dc --- /dev/null +++ b/mifosng-db/migrations/core_db/V153__Insert_missed_permissions.sql @@ -0,0 +1,9 @@ +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_ACCOUNTINGRULE', 'ACCOUNTINGRULE', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_JOURNALENTRY', 'JOURNALENTRY', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_GLACCOUNT', 'GLACCOUNT', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_GLCLOSURE', 'GLCLOSURE', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('organisation', 'READ_HOLIDAY', 'HOLIDAY', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('jobs', 'READ_SCHEDULER', 'SCHEDULER', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('portfolio', 'READ_PRODUCTMIX', 'PRODUCTMIX', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('portfolio', 'READ_MEETING', 'MEETING', 'READ', 0); +INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('jobs', 'EXECUTEJOB_SCHEDULER', 'SCHEDULER', 'EXECUTEJOB', 0); \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerApiResource.java b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerApiResource.java index 6d197d0c5..d3c792465 100755 --- a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerApiResource.java @@ -18,6 +18,8 @@ import org.mifosplatform.infrastructure.core.serialization.ApiRequestJsonSeriali import org.mifosplatform.infrastructure.core.serialization.ToApiJsonSerializer; import org.mifosplatform.infrastructure.jobs.data.SchedulerDetailData; import org.mifosplatform.infrastructure.jobs.service.JobRegisterService; +import org.mifosplatform.infrastructure.security.exception.NoAuthorizationException; +import org.mifosplatform.infrastructure.security.service.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Component; @@ -25,13 +27,15 @@ import org.springframework.stereotype.Component; @Component public class SchedulerApiResource { + private final PlatformSecurityContext context; private final JobRegisterService jobRegisterService; private final ToApiJsonSerializer toApiJsonSerializer; private final ApiRequestParameterHelper apiRequestParameterHelper; @Autowired - public SchedulerApiResource(final JobRegisterService jobRegisterService, + public SchedulerApiResource(final PlatformSecurityContext context, final JobRegisterService jobRegisterService, final ToApiJsonSerializer toApiJsonSerializer, final ApiRequestParameterHelper apiRequestParameterHelper) { + this.context = context; this.jobRegisterService = jobRegisterService; this.toApiJsonSerializer = toApiJsonSerializer; this.apiRequestParameterHelper = apiRequestParameterHelper; @@ -41,6 +45,7 @@ public class SchedulerApiResource { @Consumes({ MediaType.APPLICATION_JSON }) @Produces({ MediaType.APPLICATION_JSON }) public String retrieveStatus(@Context final UriInfo uriInfo) { + this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME); final boolean isSchedulerRunning = this.jobRegisterService.isSchedulerRunning(); final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters()); final SchedulerDetailData schedulerDetailData = new SchedulerDetailData(isSchedulerRunning); @@ -52,6 +57,12 @@ public class SchedulerApiResource { @Consumes({ MediaType.APPLICATION_JSON }) @Produces({ MediaType.APPLICATION_JSON }) public Response changeSchedulerStatus(@QueryParam(SchedulerJobApiConstants.COMMAND) final String commandParam) { + // check the logged in user have permissions to update scheduler status + final boolean hasNotPermission = this.context.authenticatedUser().hasNotPermissionForAnyOf("ALL_FUNCTIONS", "UPDATE_SCHEDULER"); + if (hasNotPermission) { + final String authorizationMessage = "User has no authority to update scheduler status"; + throw new NoAuthorizationException(authorizationMessage); + } Response response = Response.status(400).build(); if (is(commandParam, SchedulerJobApiConstants.COMMAND_START_SCHEDULER)) { this.jobRegisterService.startScheduler(); diff --git a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiConstants.java b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiConstants.java index df47c60d3..947f8ca70 100755 --- a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiConstants.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiConstants.java @@ -7,6 +7,7 @@ import java.util.Set; public class SchedulerJobApiConstants { public static final String JOB_RESOURCE_NAME = "schedulerjob"; + public static final String SCHEDULER_RESOURCE_NAME = "SCHEDULER"; // response parameters public static final String jobIdentifierParamName = "jobId"; public static final String displayNameParamName = "displayName"; diff --git a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiResource.java b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiResource.java index 59372f055..0ef300d43 100755 --- a/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiResource.java @@ -29,6 +29,8 @@ import org.mifosplatform.infrastructure.jobs.data.JobDetailData; import org.mifosplatform.infrastructure.jobs.data.JobDetailHistoryData; import org.mifosplatform.infrastructure.jobs.service.JobRegisterService; import org.mifosplatform.infrastructure.jobs.service.SchedulerJobRunnerReadService; +import org.mifosplatform.infrastructure.security.exception.NoAuthorizationException; +import org.mifosplatform.infrastructure.security.service.PlatformSecurityContext; import org.mifosplatform.portfolio.group.service.SearchParameters; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Component; @@ -45,23 +47,27 @@ public class SchedulerJobApiResource { private final ToApiJsonSerializer toApiJsonSerializer; private final ToApiJsonSerializer jobHistoryToApiJsonSerializer; private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService; + private final PlatformSecurityContext context; @Autowired public SchedulerJobApiResource(final SchedulerJobRunnerReadService schedulerJobRunnerReadService, final JobRegisterService jobRegisterService, final ToApiJsonSerializer toApiJsonSerializer, final ApiRequestParameterHelper apiRequestParameterHelper, final ToApiJsonSerializer jobHistoryToApiJsonSerializer, - final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService) { + final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService, + final PlatformSecurityContext context) { this.schedulerJobRunnerReadService = schedulerJobRunnerReadService; this.jobRegisterService = jobRegisterService; this.toApiJsonSerializer = toApiJsonSerializer; this.jobHistoryToApiJsonSerializer = jobHistoryToApiJsonSerializer; this.apiRequestParameterHelper = apiRequestParameterHelper; this.commandsSourceWritePlatformService = commandsSourceWritePlatformService; + this.context = context; } @GET public String retrieveAll(@Context final UriInfo uriInfo) { + this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME); final List jobDetailDatas = this.schedulerJobRunnerReadService.findAllJobDeatils(); final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters()); return this.toApiJsonSerializer.serialize(settings, jobDetailDatas, SchedulerJobApiConstants.JOB_DETAIL_RESPONSE_DATA_PARAMETERS); @@ -70,6 +76,7 @@ public class SchedulerJobApiResource { @GET @Path("{" + SchedulerJobApiConstants.JOB_ID + "}") public String retrieveOne(@PathParam(SchedulerJobApiConstants.JOB_ID) final Long jobId, @Context final UriInfo uriInfo) { + this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME); final JobDetailData jobDetailData = this.schedulerJobRunnerReadService.retrieveOne(jobId); final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters()); return this.toApiJsonSerializer.serialize(settings, jobDetailData, SchedulerJobApiConstants.JOB_DETAIL_RESPONSE_DATA_PARAMETERS); @@ -80,6 +87,7 @@ public class SchedulerJobApiResource { public String retrieveHistory(@Context final UriInfo uriInfo, @PathParam(SchedulerJobApiConstants.JOB_ID) final Long jobId, @QueryParam("offset") final Integer offset, @QueryParam("limit") final Integer limit, @QueryParam("orderBy") final String orderBy, @QueryParam("sortOrder") final String sortOrder) { + this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME); final SearchParameters searchParameters = SearchParameters.forPagination(offset, limit, orderBy, sortOrder); final Page jobhistoryDetailData = this.schedulerJobRunnerReadService.retrieveJobHistory(jobId, searchParameters); @@ -92,6 +100,12 @@ public class SchedulerJobApiResource { @Path("{" + SchedulerJobApiConstants.JOB_ID + "}") public Response executeJob(@PathParam(SchedulerJobApiConstants.JOB_ID) final Long jobId, @QueryParam(SchedulerJobApiConstants.COMMAND) final String commandParam) { + // check the logged in user have permissions to execute scheduler jobs + final boolean hasNotPermission = this.context.authenticatedUser().hasNotPermissionForAnyOf("ALL_FUNCTIONS", "EXECUTEJOB_SCHEDULER"); + if (hasNotPermission) { + final String authorizationMessage = "User has no authority to execute scheduler jobs"; + throw new NoAuthorizationException(authorizationMessage); + } Response response = Response.status(400).build(); if (is(commandParam, SchedulerJobApiConstants.COMMAND_EXECUTE_JOB)) { this.jobRegisterService.executeJob(jobId);