Changeset 7205

Timestamp:

Oct 19, 2016, 8:46:15 AM (5 years ago)

Author:

Nicklas Nordborg

Message:

References #2033: Permissions for annotating items may be incorrectly implemented

Check for USE permission on the annotation type before creating, modifying or deleting an annotation.

Location:

trunk/src/core/net/sf/basedb/core

Files:

• Annotation.java (modified) (2 diffs)
• AnnotationSet.java (modified) (2 diffs)

trunk/src/core/net/sf/basedb/core/Annotation.java

@@ -195 +195 @@
     READ permission is granted if the logged in user has READ permission on 
     the associated item and annotation type. CREATE, WRITE and DELETE permissions
-    are granted if the logged in user has WRITE permission on the associated item.
+    are granted if the logged in user has WRITE permission on the associated item
+    and USE permission on the annotation type. USE permission (needed for inheriting)
+    is granted if the logged in user has USE permission on the associated item.
   */
   @Override
@@ -202 +204 @@
   {
     AnnotationSet as = getAnnotationSet();
+    AnnotationType at = null;
     if (!disableATPermissionCheck)
     {
-      AnnotationType at = getAnnotationType();
-    }
-    if (as.hasPermission(Permission.WRITE))
+      at = getAnnotationType();
+    }
+    if (as.hasPermission(Permission.WRITE) && (at == null || at.hasPermission(Permission.USE)))
     {
       granted |= Permission.grant(Permission.CREATE, Permission.READ, Permission.WRITE, Permission.DELETE);

trunk/src/core/net/sf/basedb/core/AnnotationSet.java

@@ -558 +558 @@
       // Create a new annotation
       checkPermission(Permission.WRITE);
+      annotationType.checkPermission(Permission.USE);
       // AnnotatableProxy items allow annotations of all types
       boolean isAnnotatableProxy = AnnotatableProxy.class.isAssignableFrom(getItemType().getItemClass());
@@ -709 +710 @@
     checkPermission(Permission.WRITE);
     if (annotationType == null) throw new InvalidUseOfNullException("annotationType");
+    annotationType.checkPermission(Permission.USE);
     
     DbControl dc = getDbControl();