Changeset 3097

Timestamp:

Feb 5, 2007, 11:49:55 AM (16 years ago)

Author:

Nicklas Nordborg

Message:

Fixed permission check problem that caused a query to return items the logged in user didn't have
access to. Reverted the previous change since it is no longer needed.

Location:

trunk

Files:

• src/core/net/sf/basedb/core/QueryRuntimeFilterFactory.java (modified) (1 diff)
• www/lims/platemappings/list_mappings.jsp (modified) (2 diffs)

trunk/src/core/net/sf/basedb/core/QueryRuntimeFilterFactory.java

@@ -186 +186 @@
     public void enableFilters(QueryRuntimeFilterManager manager, EntityQuery query, DbControl dc)
     {
-      if (dc.getSessionControl().isDenied(query.getItemPermission(), query.getItemType()))
+      if (!dc.getSessionControl().hasPermission(query.getItemPermission(), query.getItemType()))
       {
         // No items should be returned if a user doesn't have access

trunk/www/lims/platemappings/list_mappings.jsp

@@ -25 +25 @@
   @version 2.0
 --%>
-<%@ page session="false"
+<%@ page
   import="net.sf.basedb.core.SessionControl"
   import="net.sf.basedb.core.DbControl"
@@ -221 +221 @@
       Enumeration<String, String> geometries = new Enumeration<String, String>();
       ItemResultList<PlateGeometry> plateGeometries = geometryQuery.list(dc);
-      if (sc.hasPermission(Permission.READ, Item.PLATEGEOMETRY))
-      {
-        for (PlateGeometry pg : plateGeometries)
-        {
-          geometries.add(Integer.toString(pg.getId()), HTML.encodeTags(pg.getName()));
-        }
+      for (PlateGeometry pg : plateGeometries)
+      {
+        geometries.add(Integer.toString(pg.getId()), HTML.encodeTags(pg.getName()));
       }
       %>