CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 46 Packages Projects Releases Wiki Activity

user can only list permitted addit. field data

Browse Source
This commit is contained in:
John Woodlock
2012-08-27 17:32:04 +10:00
parent fbbede83f3
commit e80119ca71
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mifosng-provider/src/main/java/org/mifosng/platform/ReadExtraDataAndReportingServiceImpl.java
+15 -5
View File
@@ -321,14 +321,24 @@ public class ReadExtraDataAndReportingServiceImpl implements
db_connection = dataSource.getConnection(); db_connection = dataSource.getConnection();
db_statement = db_connection.createStatement(); db_statement = db_connection.createStatement();
String whereClause; String andClause;
if (type == null) { if (type == null) {
whereClause = ""; andClause = "";
} else { } else {
whereClause = "where t.`name` = '" + type + "'"; andClause = " and t.`name` = '" + type + "'";
} }
String sql = "select d.id, d.`name` as 'set', t.`name` as 'type' from stretchydata_dataset d join stretchydata_datasettype t on t.id = d.datasettype_id " String sql = "select d.id, d.`name` as 'set', t.`name` as 'type' "
+ whereClause + " order by d.`name`"; + " from stretchydata_dataset d join stretchydata_datasettype t on t.id = d.datasettype_id "
+ " where exists"
+ " (select 'f'"
+ " from m_appuser_role ur "
+ " join m_role r on r.id = ur.role_id"
+ " left join m_role_permission rp on rp.role_id = r.id"
+ " left join m_permission p on p.id = rp.permission_id"
+ " where ur.appuser_id = "
+ context.authenticatedUser().getId()
+ " and (r.name = 'Super User' or r.name = 'Read Only') or p.code = concat('CAN_READ_', t.`name`, '_x', d.`name`)) "
+ andClause + " order by d.`name`";
ResultSet rs = db_statement.executeQuery(sql); ResultSet rs = db_statement.executeQuery(sql);