Skip to content
Snippets Groups Projects

F fsm

Merged Timm Fitschen requested to merge f-fsm into dev
7 files
+ 147
83
Compare changes
  • Side-by-side
  • Inline

Files

@@ -27,10 +27,14 @@ import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.List;
import org.apache.shiro.SecurityUtils;
import org.caosdb.server.database.DatabaseUtils;
import org.caosdb.server.database.access.Access;
import org.caosdb.server.database.backend.interfaces.RetrieveAllImpl;
import org.caosdb.server.database.exceptions.TransactionException;
import org.caosdb.server.entity.Role;
import org.caosdb.server.permissions.EntityACL;
import org.caosdb.server.permissions.EntityPermission;
public class MySQLRetrieveAll extends MySQLTransaction implements RetrieveAllImpl {
@@ -38,17 +42,20 @@ public class MySQLRetrieveAll extends MySQLTransaction implements RetrieveAllImp
super(access);
}
public static final String STMT_GET_ALL_HEAD = "Select id from entities where id > 99";
public static final String STMT_GET_ALL_HEAD =
"SELECT e.id AS ID, a.acl AS ACL FROM entities AS e JOIN entity_acl AS a ON (e.acl = a.id) WHERE e.id > 99";
public static final String STMT_ENTITY_WHERE_CLAUSE =
" AND ( role=? OR role='"
" AND ( e.role='"
+ Role.Record
+ "' OR e.role='"
+ Role.RecordType
+ "' OR role='"
+ "' OR e.role='"
+ Role.Property
+ "' OR role='"
+ "' OR e.role='"
+ Role.File
+ "'"
+ " )";
public static final String STMT_OTHER_ROLES = " AND role=?";
public static final String STMT_OTHER_ROLES = " AND e.role=?";
@Override
public List<Integer> execute(final String role) throws TransactionException {
@@ -58,10 +65,7 @@ public class MySQLRetrieveAll extends MySQLTransaction implements RetrieveAllImp
+ (role.equalsIgnoreCase("ENTITY") ? STMT_ENTITY_WHERE_CLAUSE : STMT_OTHER_ROLES);
final PreparedStatement stmt = prepareStatement(STMT_GET_ALL);
if (role.equalsIgnoreCase("ENTITY")) {
stmt.setString(1, Role.Record.toString());
} else {
if (!role.equalsIgnoreCase("ENTITY")) {
stmt.setString(1, role);
}
@@ -69,7 +73,11 @@ public class MySQLRetrieveAll extends MySQLTransaction implements RetrieveAllImp
try {
final ArrayList<Integer> ret = new ArrayList<Integer>();
while (rs.next()) {
ret.add(rs.getInt(1));
String acl = DatabaseUtils.bytes2UTF8(rs.getBytes("ACL"));
if (EntityACL.deserialize(acl)
.isPermitted(SecurityUtils.getSubject(), EntityPermission.RETRIEVE_ENTITY)) {
ret.add(rs.getInt("ID"));
}
}
return ret;
} finally {
Loading