@Test public void testHasPatchPermissionAuthFails() throws Exception { List<Operation> ops = new ArrayList<Operation>(); ReplaceOperation passwordOperation = new ReplaceOperation("/password", "testpass"); ops.add(passwordOperation); ReplaceOperation canLoginOperation = new ReplaceOperation("/canLogin", false); ops.add(canLoginOperation); Patch patch = new Patch(ops); assertFalse(ePersonRestPermissionEvaluatorPlugin .hasPatchPermission(authentication, null, null, patch)); }
@Override public boolean hasPatchPermission(Authentication authentication, Serializable targetId, String targetType, Patch patch) { List<Operation> operations = patch.getOperations(); Request currentRequest = requestService.getCurrentRequest(); if (currentRequest != null) { HttpServletRequest httpServletRequest = currentRequest.getHttpServletRequest(); if (operations.size() > 0 && StringUtils.equalsIgnoreCase(operations.get(0).getOp(), "replace") && StringUtils.equalsIgnoreCase(operations.get(0).getPath(), "/password") && StringUtils.isNotBlank(httpServletRequest.getParameter("token"))) { return true; } } if (!hasPermission(authentication, targetId, targetType, "WRITE")) { return false; } for (Operation op: operations) { if (!(op.getPath().contentEquals(EPersonPasswordReplaceOperation.OPERATION_PASSWORD_CHANGE) || (op.getPath().startsWith(DSpaceObjectMetadataPatchUtils.OPERATION_METADATA_PATH)))) { return false; } } return true; }
EPersonRestPermissionEvaluatorPlugin extends RestObjectPermissionEvaluatorPlugin { @Override public boolean hasPatchPermission(Authentication authentication, Serializable targetId, String targetType, Patch patch) { List<Operation> operations = patch.getOperations(); Request currentRequest = requestService.getCurrentRequest(); if (currentRequest != null) { HttpServletRequest httpServletRequest = currentRequest.getHttpServletRequest(); if (operations.size() > 0 && StringUtils.equalsIgnoreCase(operations.get(0).getOp(), "replace") && StringUtils.equalsIgnoreCase(operations.get(0).getPath(), "/password") && StringUtils.isNotBlank(httpServletRequest.getParameter("token"))) { return true; } } if (!hasPermission(authentication, targetId, targetType, "WRITE")) { return false; } for (Operation op: operations) { if (!(op.getPath().contentEquals(EPersonPasswordReplaceOperation.OPERATION_PASSWORD_CHANGE) || (op.getPath().startsWith(DSpaceObjectMetadataPatchUtils.OPERATION_METADATA_PATH)))) { return false; } } return true; } }
EPersonRestPermissionEvaluatorPlugin extends RestObjectPermissionEvaluatorPlugin { @Override public boolean hasPatchPermission(Authentication authentication, Serializable targetId, String targetType, Patch patch) { List<Operation> operations = patch.getOperations(); Request currentRequest = requestService.getCurrentRequest(); if (currentRequest != null) { HttpServletRequest httpServletRequest = currentRequest.getHttpServletRequest(); if (operations.size() > 0 && StringUtils.equalsIgnoreCase(operations.get(0).getOp(), "replace") && StringUtils.equalsIgnoreCase(operations.get(0).getPath(), "/password") && StringUtils.isNotBlank(httpServletRequest.getParameter("token"))) { return true; } } if (!hasPermission(authentication, targetId, targetType, "WRITE")) { return false; } for (Operation op: operations) { if (!(op.getPath().contentEquals(EPersonPasswordReplaceOperation.OPERATION_PASSWORD_CHANGE) || (op.getPath().startsWith(DSpaceObjectMetadataPatchUtils.OPERATION_METADATA_PATH)))) { return false; } } return true; }  }
EPersonRestPermissionEvaluatorPlugin extends RestObjectPermissionEvaluatorPlugin { @Override public boolean hasPatchPermission(Authentication authentication, Serializable targetId, String targetType, Patch patch) { List<Operation> operations = patch.getOperations(); Request currentRequest = requestService.getCurrentRequest(); if (currentRequest != null) { HttpServletRequest httpServletRequest = currentRequest.getHttpServletRequest(); if (operations.size() > 0 && StringUtils.equalsIgnoreCase(operations.get(0).getOp(), "replace") && StringUtils.equalsIgnoreCase(operations.get(0).getPath(), "/password") && StringUtils.isNotBlank(httpServletRequest.getParameter("token"))) { return true; } } if (!hasPermission(authentication, targetId, targetType, "WRITE")) { return false; } for (Operation op: operations) { if (!(op.getPath().contentEquals(EPersonPasswordReplaceOperation.OPERATION_PASSWORD_CHANGE) || (op.getPath().startsWith(DSpaceObjectMetadataPatchUtils.OPERATION_METADATA_PATH)))) { return false; } } return true; }  @Override boolean hasDSpacePermission(Authentication authentication, Serializable targetId,
                                 String targetType, DSpaceRestPermission permission); @Override boolean hasPatchPermission(Authentication authentication, Serializable targetId, String targetType,
                                      Patch patch); }
EPersonRestPermissionEvaluatorPlugin extends RestObjectPermissionEvaluatorPlugin { @Override public boolean hasPatchPermission(Authentication authentication, Serializable targetId, String targetType, Patch patch) { List<Operation> operations = patch.getOperations(); Request currentRequest = requestService.getCurrentRequest(); if (currentRequest != null) { HttpServletRequest httpServletRequest = currentRequest.getHttpServletRequest(); if (operations.size() > 0 && StringUtils.equalsIgnoreCase(operations.get(0).getOp(), "replace") && StringUtils.equalsIgnoreCase(operations.get(0).getPath(), "/password") && StringUtils.isNotBlank(httpServletRequest.getParameter("token"))) { return true; } } if (!hasPermission(authentication, targetId, targetType, "WRITE")) { return false; } for (Operation op: operations) { if (!(op.getPath().contentEquals(EPersonPasswordReplaceOperation.OPERATION_PASSWORD_CHANGE) || (op.getPath().startsWith(DSpaceObjectMetadataPatchUtils.OPERATION_METADATA_PATH)))) { return false; } } return true; }  @Override boolean hasDSpacePermission(Authentication authentication, Serializable targetId,
                                 String targetType, DSpaceRestPermission permission); @Override boolean hasPatchPermission(Authentication authentication, Serializable targetId, String targetType,
                                      Patch patch);  }