mirror of
https://github.com/gyurix1968/guacamole-client.git
synced 2025-09-06 05:07:41 +00:00
GUACAMOLE-538: Merge support for system-level "AUDIT" permission.
This commit is contained in:
Mike Jumper
GitHub
@@ -483,8 +483,8 @@ public class ConnectionService extends ModeledChildDirectoryObjectService<Modele
|
||||
|
||||
List<ConnectionRecordModel> searchResults;
|
||||
|
||||
// Bypass permission checks if the user is privileged
|
||||
if (user.isPrivileged())
|
||||
// Bypass permission checks if the user is privileged or has System-level audit permissions
|
||||
if (user.isPrivileged() || user.getUser().getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.AUDIT))
|
||||
searchResults = connectionRecordMapper.search(identifier,
|
||||
recordIdentifier, requiredContents, sortPredicates, limit);
|
||||
|
||||
|
||||
@@ -611,8 +611,8 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
|
||||
|
||||
List<ActivityRecordModel> searchResults;
|
||||
|
||||
// Bypass permission checks if the user is privileged
|
||||
if (user.isPrivileged())
|
||||
// Bypass permission checks if the user is privileged or has System-level audit permissions
|
||||
if (user.isPrivileged() || user.getUser().getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.AUDIT))
|
||||
searchResults = userRecordMapper.search(username, recordIdentifier,
|
||||
requiredContents, sortPredicates, limit);
|
||||
|
||||
|
||||
@@ -459,6 +459,7 @@ CREATE TABLE `guacamole_system_permission` (
|
||||
'CREATE_SHARING_PROFILE',
|
||||
'CREATE_USER',
|
||||
'CREATE_USER_GROUP',
|
||||
'AUDIT',
|
||||
'ADMINISTER') NOT NULL,
|
||||
|
||||
PRIMARY KEY (`entity_id`,`permission`),
|
||||
@@ -611,3 +612,4 @@ CREATE TABLE guacamole_user_password_history (
|
||||
REFERENCES `guacamole_user` (`user_id`) ON DELETE CASCADE
|
||||
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
|
||||
|
||||
|
||||
@@ -51,3 +51,4 @@ FROM (
|
||||
JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'
|
||||
JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER'
|
||||
JOIN guacamole_user ON guacamole_user.entity_id = affected.entity_id;
|
||||
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
--
|
||||
-- Licensed to the Apache Software Foundation (ASF) under one
|
||||
-- or more contributor license agreements. See the NOTICE file
|
||||
-- distributed with this work for additional information
|
||||
-- regarding copyright ownership. The ASF licenses this file
|
||||
-- to you under the Apache License, Version 2.0 (the
|
||||
-- "License"); you may not use this file except in compliance
|
||||
-- with the License. You may obtain a copy of the License at
|
||||
--
|
||||
-- http://www.apache.org/licenses/LICENSE-2.0
|
||||
--
|
||||
-- Unless required by applicable law or agreed to in writing,
|
||||
-- software distributed under the License is distributed on an
|
||||
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
-- KIND, either express or implied. See the License for the
|
||||
-- specific language governing permissions and limitations
|
||||
-- under the License.
|
||||
--
|
||||
|
||||
--
|
||||
-- Add new system-level permission
|
||||
--
|
||||
|
||||
ALTER TABLE `guacamole_system_permission`
|
||||
MODIFY `permission` enum('CREATE_CONNECTION',
|
||||
'CREATE_CONNECTION_GROUP',
|
||||
'CREATE_SHARING_PROFILE',
|
||||
'CREATE_USER',
|
||||
'CREATE_USER_GROUP',
|
||||
'AUDIT',
|
||||
'ADMINISTER') NOT NULL;
|
||||
|
||||
@@ -56,6 +56,7 @@ CREATE TYPE guacamole_system_permission_type AS ENUM(
|
||||
'CREATE_SHARING_PROFILE',
|
||||
'CREATE_USER',
|
||||
'CREATE_USER_GROUP',
|
||||
'AUDIT',
|
||||
'ADMINISTER'
|
||||
);
|
||||
|
||||
|
||||
@@ -53,3 +53,4 @@ FROM (
|
||||
JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'
|
||||
JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER'
|
||||
JOIN guacamole_user ON guacamole_user.entity_id = affected.entity_id;
|
||||
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
--
|
||||
-- Licensed to the Apache Software Foundation (ASF) under one
|
||||
-- or more contributor license agreements. See the NOTICE file
|
||||
-- distributed with this work for additional information
|
||||
-- regarding copyright ownership. The ASF licenses this file
|
||||
-- to you under the Apache License, Version 2.0 (the
|
||||
-- "License"); you may not use this file except in compliance
|
||||
-- with the License. You may obtain a copy of the License at
|
||||
--
|
||||
-- http://www.apache.org/licenses/LICENSE-2.0
|
||||
--
|
||||
-- Unless required by applicable law or agreed to in writing,
|
||||
-- software distributed under the License is distributed on an
|
||||
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
-- KIND, either express or implied. See the License for the
|
||||
-- specific language governing permissions and limitations
|
||||
-- under the License.
|
||||
--
|
||||
|
||||
--
|
||||
-- Add new system-level audit permission
|
||||
--
|
||||
|
||||
ALTER TYPE guacamole_system_permission_type
|
||||
ADD VALUE 'AUDIT'
|
||||
BEFORE 'ADMINISTER';
|
||||
|
||||
@@ -77,6 +77,7 @@ CREATE RULE [guacamole_system_permission_list] AS @list IN (
|
||||
'CREATE_SHARING_PROFILE',
|
||||
'CREATE_USER',
|
||||
'CREATE_USER_GROUP',
|
||||
'AUDIT',
|
||||
'ADMINISTER'
|
||||
);
|
||||
GO
|
||||
|
||||
@@ -61,3 +61,4 @@ JOIN [guacamole_entity] ON [permissions].[username] = [guacamole_enti
|
||||
JOIN [guacamole_entity] [affected] ON [permissions].[affected_username] = [affected].[name] AND [guacamole_entity].[type] = 'USER'
|
||||
JOIN [guacamole_user] ON [guacamole_user].[entity_id] = [affected].[entity_id];
|
||||
GO
|
||||
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
--
|
||||
-- Licensed to the Apache Software Foundation (ASF) under one
|
||||
-- or more contributor license agreements. See the NOTICE file
|
||||
-- distributed with this work for additional information
|
||||
-- regarding copyright ownership. The ASF licenses this file
|
||||
-- to you under the Apache License, Version 2.0 (the
|
||||
-- "License"); you may not use this file except in compliance
|
||||
-- with the License. You may obtain a copy of the License at
|
||||
--
|
||||
-- http://www.apache.org/licenses/LICENSE-2.0
|
||||
--
|
||||
-- Unless required by applicable law or agreed to in writing,
|
||||
-- software distributed under the License is distributed on an
|
||||
-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
-- KIND, either express or implied. See the License for the
|
||||
-- specific language governing permissions and limitations
|
||||
-- under the License.
|
||||
--
|
||||
|
||||
--
|
||||
-- Add new system-level audit permission
|
||||
--
|
||||
|
||||
EXEC sp_unbindrule 'guacamole_system_permission';
|
||||
DROP RULE [guacamole_system_permission_list];
|
||||
GO
|
||||
|
||||
CREATE RULE [guacamole_system_permission_list] AS @list IN (
|
||||
'CREATE_CONNECTION',
|
||||
'CREATE_CONNECTION_GROUP',
|
||||
'CREATE_SHARING_PROFILE',
|
||||
'CREATE_USER',
|
||||
'CREATE_USER_GROUP',
|
||||
'AUDIT',
|
||||
'ADMINISTER'
|
||||
);
|
||||
GO
|
||||
|
||||
EXEC sp_bindrule
|
||||
'guacamole_system_permission_list',
|
||||
'guacamole_system_permission';
|
||||
GO
|
||||
|
||||
Reference in New Issue
Block a user