1 package net.sourceforge.blogentis.modules.actions;
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25 import net.sourceforge.blogentis.turbine.BlogParameterParser;
26 import net.sourceforge.blogentis.turbine.SecureBlogAction;
27 import net.sourceforge.blogentis.utils.BlogConstants;
28
29 import org.apache.turbine.om.security.Group;
30 import org.apache.turbine.om.security.Role;
31 import org.apache.turbine.om.security.User;
32 import org.apache.turbine.services.security.TurbineSecurity;
33 import org.apache.turbine.util.RunData;
34 import org.apache.turbine.util.security.AccessControlList;
35 import org.apache.turbine.util.security.DataBackendException;
36 import org.apache.turbine.util.security.UnknownEntityException;
37 import org.apache.velocity.context.Context;
38
39 public class BlogUserMod extends SecureBlogAction {
40
41 protected User getUser(RunData data)
42 throws DataBackendException, UnknownEntityException {
43 User user = null;
44 String userName = data.getParameters().getString("userName", null);
45 if (userName == null) {
46 data.setMessage("Parameter userId was missing from the request");
47 return null;
48 }
49 user = TurbineSecurity.getUser(userName);
50 if (user == null) {
51 data.setMessage("Could not find the given user");
52 }
53 return user;
54 }
55
56 protected Role getRole(RunData data, String paramName)
57 throws DataBackendException, UnknownEntityException {
58 Role role = null;
59 String roleName = data.getParameters().getString(paramName, null);
60 if (roleName == null) {
61 data.setMessage("Parameter roleName was missing from the request");
62 return null;
63 }
64 role = TurbineSecurity.getRoleByName(roleName);
65 if (role == null) {
66 data.setMessage("Could not find the given role");
67 }
68 return role;
69 }
70
71 protected Role getRole(RunData data)
72 throws DataBackendException, UnknownEntityException {
73 return getRole(data, "roleName");
74 }
75
76 protected Group getGroup(RunData data)
77 throws DataBackendException, UnknownEntityException {
78 BlogParameterParser bparam = (BlogParameterParser)(data.getParameters());
79 return TurbineSecurity.getGroupByName(bparam.getBlog().getName());
80 }
81
82 public void doAdd(RunData data, Context context)
83 throws Exception {
84 User user = getUser(data);
85 Role role = getRole(data);
86 Group group = getGroup(data);
87 if (user == null || role == null || group == null)
88 return;
89 if (TurbineSecurity.getACL(user).hasRole(role, group)) {
90 data.setMessage(user.getFirstName() + " " + user.getLastName()
91 + " can already " + role.getName());
92 return;
93 }
94 TurbineSecurity.grant(user, group, role);
95 }
96
97 public void doUpdate(RunData data, Context context)
98 throws DataBackendException, UnknownEntityException {
99 User user = getUser(data);
100 Role oldRole = getRole(data);
101 Role newRole = getRole(data, "newRoleName");
102 Group group = getGroup(data);
103 AccessControlList acl = TurbineSecurity.getACL(user);
104 if (!acl.hasRole(oldRole, group)) {
105 data.setMessage(user.getFirstName() + " " + user.getLastName()
106 + " cannot " + oldRole.getName());
107 return;
108 }
109 if (acl.hasRole(newRole, group)) {
110 data.setMessage(user.getFirstName() + " " + user.getLastName()
111 + " can already " + newRole.getName());
112 return;
113 }
114 TurbineSecurity.grant(user, group, newRole);
115 TurbineSecurity.revoke(user, group, oldRole);
116 }
117
118 public void doRemove(RunData data, Context context)
119 throws DataBackendException, UnknownEntityException {
120 User user = getUser(data);
121 Role role = getRole(data);
122 Group group = getGroup(data);
123 if (user == null || role == null || group == null)
124 return;
125 if (!TurbineSecurity.getACL(user).hasRole(role, group)) {
126 data.setMessage(user.getFirstName() + " " + user.getLastName()
127 + " cannot " + role.getName());
128 return;
129 }
130 TurbineSecurity.revoke(user, group, role);
131 }
132
133 public void doPerform(RunData data, Context context)
134 throws Exception {
135 data.setMessage("Hmm... Unknown action requested!");
136 }
137
138 protected String[] getPermissions() {
139 return new String[]{BlogConstants.PERM_ADMIN_BLOG};
140 }
141 }