@Test public void preHandle_shouldAllowCustomWhitelistedControllersForNonSuperUser() throws Exception { TestUtils.saveGlobalProperty(EmrConstants.GP_CONTROLLER_WHITELIST, "org.openmrs.web.controller.patient,org.openmrs.web.controller.visit"); Context.becomeUser("butch"); Assert.assertThat(interceptor.preHandle(request, response, new PatientDashboardController()), is(true)); }
@Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { String controllerPackage = handler.getClass().getPackage().getName(); for (String whitelisted : getControllerWhitelist()) { if (controllerPackage.startsWith(whitelisted)) { return true; } } User authenticatedUser = Context.getAuthenticatedUser(); boolean allowRequest = authenticatedUser != null && authenticatedUser.hasPrivilege(SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE); if (!allowRequest) { log.warn("Prevented request to " + request.getRequestURI() + " by user without '" + SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE + "' privilege"); kenyaUi.notifyError(request.getSession(), "Invalid external page access"); response.sendRedirect(request.getContextPath() + "/login.htm"); } return allowRequest; }
EmrExternalUrlInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { String controllerPackage = handler.getClass().getPackage().getName(); for (String whitelisted : getControllerWhitelist()) { if (controllerPackage.startsWith(whitelisted)) { return true; } } User authenticatedUser = Context.getAuthenticatedUser(); boolean allowRequest = authenticatedUser != null && authenticatedUser.hasPrivilege(SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE); if (!allowRequest) { log.warn("Prevented request to " + request.getRequestURI() + " by user without '" + SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE + "' privilege"); kenyaUi.notifyError(request.getSession(), "Invalid external page access"); response.sendRedirect(request.getContextPath() + "/login.htm"); } return allowRequest; } }
EmrExternalUrlInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { String controllerPackage = handler.getClass().getPackage().getName(); for (String whitelisted : getControllerWhitelist()) { if (controllerPackage.startsWith(whitelisted)) { return true; } } User authenticatedUser = Context.getAuthenticatedUser(); boolean allowRequest = authenticatedUser != null && authenticatedUser.hasPrivilege(SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE); if (!allowRequest) { log.warn("Prevented request to " + request.getRequestURI() + " by user without '" + SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE + "' privilege"); kenyaUi.notifyError(request.getSession(), "Invalid external page access"); response.sendRedirect(request.getContextPath() + "/login.htm"); } return allowRequest; }  }
EmrExternalUrlInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { String controllerPackage = handler.getClass().getPackage().getName(); for (String whitelisted : getControllerWhitelist()) { if (controllerPackage.startsWith(whitelisted)) { return true; } } User authenticatedUser = Context.getAuthenticatedUser(); boolean allowRequest = authenticatedUser != null && authenticatedUser.hasPrivilege(SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE); if (!allowRequest) { log.warn("Prevented request to " + request.getRequestURI() + " by user without '" + SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE + "' privilege"); kenyaUi.notifyError(request.getSession(), "Invalid external page access"); response.sendRedirect(request.getContextPath() + "/login.htm"); } return allowRequest; }  @Override boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler); }
EmrExternalUrlInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { String controllerPackage = handler.getClass().getPackage().getName(); for (String whitelisted : getControllerWhitelist()) { if (controllerPackage.startsWith(whitelisted)) { return true; } } User authenticatedUser = Context.getAuthenticatedUser(); boolean allowRequest = authenticatedUser != null && authenticatedUser.hasPrivilege(SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE); if (!allowRequest) { log.warn("Prevented request to " + request.getRequestURI() + " by user without '" + SecurityMetadata._Privilege.VIEW_LEGACY_INTERFACE + "' privilege"); kenyaUi.notifyError(request.getSession(), "Invalid external page access"); response.sendRedirect(request.getContextPath() + "/login.htm"); } return allowRequest; }  @Override boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler);  }