safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-06 13:17:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

GUACAMOLE-220: Use effective permissions when deciding whether a user has permission to perform an action.

Browse Source
This commit is contained in:
Michael Jumper
2018-04-08 00:16:12 -07:00
parent 0a69630cbb
commit 199f518cdb
9 changed files with 37 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledChildDirectoryObjectService.java
View File

@@ -53,7 +53,8 @@ public abstract class ModeledChildDirectoryObjectService<InternalType extends Mo
/** /**
* Returns the permission set associated with the given user and related * Returns the permission set associated with the given user and related
* to the type of objects which can be parents of the child objects handled * to the type of objects which can be parents of the child objects handled
* by this directory object service. * by this directory object service, taking into account permission
* inheritance via user groups.
* *
* @param user * @param user
* The user whose permissions are being retrieved. * The user whose permissions are being retrieved.
@@ -66,7 +67,7 @@ public abstract class ModeledChildDirectoryObjectService<InternalType extends Mo
* @throws GuacamoleException * @throws GuacamoleException
* If permission to read the user's permissions is denied. * If permission to read the user's permissions is denied.
*/ */
protected abstract ObjectPermissionSet getParentPermissionSet( protected abstract ObjectPermissionSet getParentEffectivePermissionSet(
ModeledAuthenticatedUser user) throws GuacamoleException; ModeledAuthenticatedUser user) throws GuacamoleException;
/** /**
@@ -155,7 +156,7 @@ public abstract class ModeledChildDirectoryObjectService<InternalType extends Mo
Collection<String> modifiedParents = getModifiedParents(user, identifier, model); Collection<String> modifiedParents = getModifiedParents(user, identifier, model);
if (!modifiedParents.isEmpty()) { if (!modifiedParents.isEmpty()) {
ObjectPermissionSet permissionSet = getParentPermissionSet(user); ObjectPermissionSet permissionSet = getParentEffectivePermissionSet(user);
Collection<String> updateableParents = permissionSet.getAccessibleObjects( Collection<String> updateableParents = permissionSet.getAccessibleObjects(
Collections.singleton(ObjectPermission.Type.UPDATE), Collections.singleton(ObjectPermission.Type.UPDATE),
modifiedParents modifiedParents

13
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
View File

@@ -126,7 +126,8 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
/** /**
* Returns whether the given user has permission to create the type of * Returns whether the given user has permission to create the type of
* objects that this directory object service manages. * objects that this directory object service manages, taking into account
* permission inheritance through user groups.
* *
* @param user * @param user
* The user being checked. * The user being checked.
@@ -143,7 +144,8 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
/** /**
* Returns whether the given user has permission to perform a certain * Returns whether the given user has permission to perform a certain
* action on a specific object managed by this directory object service. * action on a specific object managed by this directory object service,
* taking into account permission inheritance through user groups.
* *
* @param user * @param user
* The user being checked. * The user being checked.
@@ -166,7 +168,7 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
throws GuacamoleException { throws GuacamoleException {
// Get object permissions // Get object permissions
ObjectPermissionSet permissionSet = getPermissionSet(user); ObjectPermissionSet permissionSet = getEffectivePermissionSet(user);
// Return whether permission is granted // Return whether permission is granted
return user.getUser().isAdministrator() return user.getUser().isAdministrator()
@@ -176,7 +178,8 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
/** /**
* Returns the permission set associated with the given user and related * Returns the permission set associated with the given user and related
* to the type of objects handled by this directory object service. * to the type of objects handled by this directory object service, taking
* into account permission inheritance via user groups.
* *
* @param user * @param user
* The user whose permissions are being retrieved. * The user whose permissions are being retrieved.
@@ -189,7 +192,7 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
* @throws GuacamoleException * @throws GuacamoleException
* If permission to read the user's permissions is denied. * If permission to read the user's permissions is denied.
*/ */
protected abstract ObjectPermissionSet getPermissionSet(ModeledAuthenticatedUser user) protected abstract ObjectPermissionSet getEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException; throws GuacamoleException;
/** /**

10
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
View File

@@ -131,26 +131,26 @@ public class ConnectionService extends ModeledChildDirectoryObjectService<Modele
throws GuacamoleException { throws GuacamoleException {
// Return whether user has explicit connection creation permission // Return whether user has explicit connection creation permission
SystemPermissionSet permissionSet = user.getUser().getSystemPermissions(); SystemPermissionSet permissionSet = user.getUser().getEffectivePermissions().getSystemPermissions();
return permissionSet.hasPermission(SystemPermission.Type.CREATE_CONNECTION); return permissionSet.hasPermission(SystemPermission.Type.CREATE_CONNECTION);
} }
@Override @Override
protected ObjectPermissionSet getPermissionSet(ModeledAuthenticatedUser user) protected ObjectPermissionSet getEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException { throws GuacamoleException {
// Return permissions related to connections // Return permissions related to connections
return user.getUser().getConnectionPermissions(); return user.getUser().getEffectivePermissions().getConnectionPermissions();
} }
@Override @Override
protected ObjectPermissionSet getParentPermissionSet(ModeledAuthenticatedUser user) protected ObjectPermissionSet getParentEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException { throws GuacamoleException {
// Connections are contained by connection groups // Connections are contained by connection groups
return user.getUser().getConnectionGroupPermissions(); return user.getUser().getEffectivePermissions().getConnectionGroupPermissions();
} }

10
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java
View File

@@ -112,26 +112,26 @@ public class ConnectionGroupService extends ModeledChildDirectoryObjectService<M
throws GuacamoleException { throws GuacamoleException {
// Return whether user has explicit connection group creation permission // Return whether user has explicit connection group creation permission
SystemPermissionSet permissionSet = user.getUser().getSystemPermissions(); SystemPermissionSet permissionSet = user.getUser().getEffectivePermissions().getSystemPermissions();
return permissionSet.hasPermission(SystemPermission.Type.CREATE_CONNECTION_GROUP); return permissionSet.hasPermission(SystemPermission.Type.CREATE_CONNECTION_GROUP);
} }
@Override @Override
protected ObjectPermissionSet getPermissionSet(ModeledAuthenticatedUser user) protected ObjectPermissionSet getEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException { throws GuacamoleException {
// Return permissions related to connection groups // Return permissions related to connection groups
return user.getUser().getConnectionGroupPermissions(); return user.getUser().getEffectivePermissions().getConnectionGroupPermissions();
} }
@Override @Override
protected ObjectPermissionSet getParentPermissionSet(ModeledAuthenticatedUser user) protected ObjectPermissionSet getParentEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException { throws GuacamoleException {
// Connection groups are contained by other connection groups // Connection groups are contained by other connection groups
return user.getUser().getConnectionGroupPermissions(); return user.getUser().getEffectivePermissions().getConnectionGroupPermissions();
} }

4
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/permission/AbstractPermissionService.java
View File

@@ -45,7 +45,7 @@ public abstract class AbstractPermissionService<PermissionSetType extends Permis
* Determines whether the given user can read the permissions currently * Determines whether the given user can read the permissions currently
* granted to the given target user. If the reading user and the target * granted to the given target user. If the reading user and the target
* user are not the same, then explicit READ or SYSTEM_ADMINISTER access is * user are not the same, then explicit READ or SYSTEM_ADMINISTER access is
* required. * required. Permission inheritance via user groups is taken into account.
* *
* @param user * @param user
* The user attempting to read permissions. * The user attempting to read permissions.
@@ -72,7 +72,7 @@ public abstract class AbstractPermissionService<PermissionSetType extends Permis
return true; return true;
// Can read permissions on target user if explicit READ is granted // Can read permissions on target user if explicit READ is granted
ObjectPermissionSet userPermissionSet = user.getUser().getUserPermissions(); ObjectPermissionSet userPermissionSet = user.getUser().getEffectivePermissions().getUserPermissions();
return userPermissionSet.hasPermission(ObjectPermission.Type.READ, targetUser.getIdentifier()); return userPermissionSet.hasPermission(ObjectPermission.Type.READ, targetUser.getIdentifier());
} }

3
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/permission/ModeledObjectPermissionService.java
View File

@@ -67,6 +67,7 @@ public abstract class ModeledObjectPermissionService
* depends on whether the current user is a system administrator, whether * depends on whether the current user is a system administrator, whether
* they have explicit UPDATE permission on the target user, and whether * they have explicit UPDATE permission on the target user, and whether
* they have explicit ADMINISTER permission on all affected objects. * they have explicit ADMINISTER permission on all affected objects.
* Permission inheritance via user groups is taken into account.
* *
* @param user * @param user
* The user who is changing permissions. * The user who is changing permissions.
@@ -95,7 +96,7 @@ public abstract class ModeledObjectPermissionService
return true; return true;
// Verify user has update permission on the target user // Verify user has update permission on the target user
ObjectPermissionSet userPermissionSet = user.getUser().getUserPermissions(); ObjectPermissionSet userPermissionSet = user.getUser().getEffectivePermissions().getUserPermissions();
if (!userPermissionSet.hasPermission(ObjectPermission.Type.UPDATE, targetUser.getIdentifier())) if (!userPermissionSet.hasPermission(ObjectPermission.Type.UPDATE, targetUser.getIdentifier()))
return false; return false;

10
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java
View File

@@ -112,26 +112,26 @@ public class SharingProfileService
throws GuacamoleException { throws GuacamoleException {
// Return whether user has explicit sharing profile creation permission // Return whether user has explicit sharing profile creation permission
SystemPermissionSet permissionSet = user.getUser().getSystemPermissions(); SystemPermissionSet permissionSet = user.getUser().getEffectivePermissions().getSystemPermissions();
return permissionSet.hasPermission(SystemPermission.Type.CREATE_SHARING_PROFILE); return permissionSet.hasPermission(SystemPermission.Type.CREATE_SHARING_PROFILE);
} }
@Override @Override
protected ObjectPermissionSet getPermissionSet(ModeledAuthenticatedUser user) protected ObjectPermissionSet getEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException { throws GuacamoleException {
// Return permissions related to sharing profiles // Return permissions related to sharing profiles
return user.getUser().getSharingProfilePermissions(); return user.getUser().getEffectivePermissions().getSharingProfilePermissions();
} }
@Override @Override
protected ObjectPermissionSet getParentPermissionSet(ModeledAuthenticatedUser user) protected ObjectPermissionSet getParentEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException { throws GuacamoleException {
// Sharing profiles are children of connections // Sharing profiles are children of connections
return user.getUser().getConnectionPermissions(); return user.getUser().getEffectivePermissions().getConnectionPermissions();
} }

5
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java
View File

@@ -333,7 +333,8 @@ public class ModeledUser extends ModeledDirectoryObject<UserModel> implements Us
/** /**
* Returns whether this user is a system administrator, and thus is not * Returns whether this user is a system administrator, and thus is not
* restricted by permissions. * restricted by permissions, taking into account permission inheritance
* via user groups.
* *
* @return * @return
* true if this user is a system administrator, false otherwise. * true if this user is a system administrator, false otherwise.
@@ -343,7 +344,7 @@ public class ModeledUser extends ModeledDirectoryObject<UserModel> implements Us
* status. * status.
*/ */
public boolean isAdministrator() throws GuacamoleException { public boolean isAdministrator() throws GuacamoleException {
SystemPermissionSet systemPermissionSet = getSystemPermissions(); SystemPermissionSet systemPermissionSet = getEffectivePermissions().getSystemPermissions();
return systemPermissionSet.hasPermission(SystemPermission.Type.ADMINISTER); return systemPermissionSet.hasPermission(SystemPermission.Type.ADMINISTER);
} }

6
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
View File

@@ -216,17 +216,17 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
throws GuacamoleException { throws GuacamoleException {
// Return whether user has explicit user creation permission // Return whether user has explicit user creation permission
SystemPermissionSet permissionSet = user.getUser().getSystemPermissions(); SystemPermissionSet permissionSet = user.getUser().getEffectivePermissions().getSystemPermissions();
return permissionSet.hasPermission(SystemPermission.Type.CREATE_USER); return permissionSet.hasPermission(SystemPermission.Type.CREATE_USER);
} }
@Override @Override
protected ObjectPermissionSet getPermissionSet(ModeledAuthenticatedUser user) protected ObjectPermissionSet getEffectivePermissionSet(ModeledAuthenticatedUser user)
throws GuacamoleException { throws GuacamoleException {
// Return permissions related to users // Return permissions related to users
return user.getUser().getUserPermissions(); return user.getUser().getEffectivePermissions().getUserPermissions();
} }