GUAC-1001: Treat queries with empty permission filter lists as unfiltered.

This commit is contained in:
Michael Jumper
2015-01-22 16:37:25 -08:00
parent adc745da43
commit 0893493893
2 changed files with 12 additions and 4 deletions

View File

@@ -297,10 +297,10 @@ public class ConnectionGroupRESTService {
* The ID of the connection group to retrieve. * The ID of the connection group to retrieve.
* *
* @param permissions * @param permissions
* If specified, limit the returned list to only those connections for * If specified and non-empty, limit the returned list to only those
* which the current user has any of the given permissions. Otherwise, * connections for which the current user has any of the given
* all visible connections are returned. Connection groups are * permissions. Otherwise, all visible connections are returned.
* unaffected by this parameter. * Connection groups are unaffected by this parameter.
* *
* @return * @return
* The requested connection group, including all descendants. * The requested connection group, including all descendants.
@@ -319,6 +319,10 @@ public class ConnectionGroupRESTService {
UserContext userContext = authenticationService.getUserContext(authToken); UserContext userContext = authenticationService.getUserContext(authToken);
// Do not filter on permissions if no permissions are specified
if (permissions != null && permissions.isEmpty())
permissions = null;
// Retrieve requested connection group and all descendants // Retrieve requested connection group and all descendants
APIConnectionGroup connectionGroup = retrieveConnectionGroup(userContext, connectionGroupID, true, permissions); APIConnectionGroup connectionGroup = retrieveConnectionGroup(userContext, connectionGroupID, true, permissions);
if (connectionGroup == null) if (connectionGroup == null)

View File

@@ -176,6 +176,10 @@ public class UserRESTService {
UserContext userContext = authenticationService.getUserContext(authToken); UserContext userContext = authenticationService.getUserContext(authToken);
User self = userContext.self(); User self = userContext.self();
// Do not filter on permissions if no permissions are specified
if (permissions != null && permissions.isEmpty())
permissions = null;
// An admin user has access to any user // An admin user has access to any user
boolean isAdmin = self.hasPermission(new SystemPermission(SystemPermission.Type.ADMINISTER)); boolean isAdmin = self.hasPermission(new SystemPermission(SystemPermission.Type.ADMINISTER));