safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-07 05:31:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent foot shooting.

Browse Source
This commit is contained in:
Michael Jumper
2013-03-04 00:09:30 -08:00
parent 8f43da42bf
commit 4bcadac53b
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
extensions/guacamole-auth-mysql/src/main/java/net/sourceforge/guacamole/net/auth/mysql/UserDirectory.java
View File

@@ -517,14 +517,21 @@ public class UserDirectory implements Directory<String, net.sourceforge.guacamol
* @param user_id The ID of the user whose permissions should be updated. * @param user_id The ID of the user whose permissions should be updated.
* @param permissions The permissions the given user should no longer have * @param permissions The permissions the given user should no longer have
* when this operation completes. * when this operation completes.
* @throws GuacamoleException If the permissions specified could not be
* removed due to system restrictions.
*/ */
private void deleteSystemPermissions(int user_id, private void deleteSystemPermissions(int user_id,
Collection<SystemPermission> permissions) { Collection<SystemPermission> permissions)
throws GuacamoleException {
// If no permissions given, stop now // If no permissions given, stop now
if (permissions.isEmpty()) if (permissions.isEmpty())
return; return;
// Prevent self-de-adminifying
if (user_id == this.user_id)
throw new GuacamoleClientException("Removing your own administrative permissions is not allowed.");
// Build list of requested system permissions // Build list of requested system permissions
List<String> systemPermissionTypes = new ArrayList<String>(); List<String> systemPermissionTypes = new ArrayList<String>();
for (SystemPermission permission : permissions) for (SystemPermission permission : permissions)
@@ -575,6 +582,10 @@ public class UserDirectory implements Directory<String, net.sourceforge.guacamol
// Get user pending deletion // Get user pending deletion
MySQLUser user = userService.retrieveUser(identifier); MySQLUser user = userService.retrieveUser(identifier);
// Prevent self-deletion
if (user.getUserID() == this.user_id)
throw new GuacamoleClientException("Deleting your own user is not allowed.");
// Validate current user has permission to remove the specified user // Validate current user has permission to remove the specified user
permissionCheckService.verifyUserAccess(this.user_id, permissionCheckService.verifyUserAccess(this.user_id,
user.getUserID(), user.getUserID(),