@Test public void preHandle_wrongPrivileges() throws Exception { AcmPluginPrivilege privilege = new AcmPluginPrivilege(); privilege.setPrivilegeName("privilegeName"); AcmPluginUrlPrivilege urlPrivilege = new AcmPluginUrlPrivilege(); urlPrivilege.setHttpMethod(HttpMethod.GET); urlPrivilege.setUrl("/url"); urlPrivilege.setRequiredPrivilege(privilege); AcmPlugin plugin = new AcmPlugin(); plugin.setUrlPrivileges(Arrays.asList(urlPrivilege)); acmPluginManager.registerPlugin(plugin); expect(mockRequest.getSession(false)).andReturn(mockSession); Map<String, Boolean> userPrivs = new HashMap<>(); userPrivs.put("anotherPrivilege", Boolean.TRUE); expect(mockSession.getAttribute("acm_privileges")).andReturn(userPrivs); expect(mockRequest.getServletPath()).andReturn("/url").atLeastOnce(); expect(mockRequest.getMethod()).andReturn(HttpMethod.GET.name()); replayAll(); try { unit.preHandle(mockRequest, mockResponse, null); fail("Expecting AcmNotAuthorizedException but did not happen"); } catch (AcmNotAuthorizedException exception) { } verifyAll(); }
@Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws AcmNotAuthorizedException { String method = request.getMethod(); String url = request.getServletPath(); log.debug("Checking user privilege for url: {} {}", method, url); HttpSession session = request.getSession(false); if (session == null) { return true; } Map<String, Boolean> userPrivileges = (Map<String, Boolean>) session.getAttribute("acm_privileges"); if (userPrivileges == null) { throw new AcmNotAuthorizedException(request.getServletPath()); } else { List<AcmPluginUrlPrivilege> urlPrivileges = getAcmPluginManager().getUrlPrivileges(); boolean hasPrivilege = determinePrivilege(method, url, userPrivileges, urlPrivileges); if (!hasPrivilege) { throw new AcmNotAuthorizedException(request.getServletPath()); } } return true; }
AcmPluginRoleBasedAccessInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws AcmNotAuthorizedException { String method = request.getMethod(); String url = request.getServletPath(); log.debug("Checking user privilege for url: {} {}", method, url); HttpSession session = request.getSession(false); if (session == null) { return true; } Map<String, Boolean> userPrivileges = (Map<String, Boolean>) session.getAttribute("acm_privileges"); if (userPrivileges == null) { throw new AcmNotAuthorizedException(request.getServletPath()); } else { List<AcmPluginUrlPrivilege> urlPrivileges = getAcmPluginManager().getUrlPrivileges(); boolean hasPrivilege = determinePrivilege(method, url, userPrivileges, urlPrivileges); if (!hasPrivilege) { throw new AcmNotAuthorizedException(request.getServletPath()); } } return true; } }
AcmPluginRoleBasedAccessInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws AcmNotAuthorizedException { String method = request.getMethod(); String url = request.getServletPath(); log.debug("Checking user privilege for url: {} {}", method, url); HttpSession session = request.getSession(false); if (session == null) { return true; } Map<String, Boolean> userPrivileges = (Map<String, Boolean>) session.getAttribute("acm_privileges"); if (userPrivileges == null) { throw new AcmNotAuthorizedException(request.getServletPath()); } else { List<AcmPluginUrlPrivilege> urlPrivileges = getAcmPluginManager().getUrlPrivileges(); boolean hasPrivilege = determinePrivilege(method, url, userPrivileges, urlPrivileges); if (!hasPrivilege) { throw new AcmNotAuthorizedException(request.getServletPath()); } } return true; }  }
AcmPluginRoleBasedAccessInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws AcmNotAuthorizedException { String method = request.getMethod(); String url = request.getServletPath(); log.debug("Checking user privilege for url: {} {}", method, url); HttpSession session = request.getSession(false); if (session == null) { return true; } Map<String, Boolean> userPrivileges = (Map<String, Boolean>) session.getAttribute("acm_privileges"); if (userPrivileges == null) { throw new AcmNotAuthorizedException(request.getServletPath()); } else { List<AcmPluginUrlPrivilege> urlPrivileges = getAcmPluginManager().getUrlPrivileges(); boolean hasPrivilege = determinePrivilege(method, url, userPrivileges, urlPrivileges); if (!hasPrivilege) { throw new AcmNotAuthorizedException(request.getServletPath()); } } return true; }  @Override boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler); AcmPluginManager getAcmPluginManager(); void setAcmPluginManager(AcmPluginManager acmPluginManager); }
AcmPluginRoleBasedAccessInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws AcmNotAuthorizedException { String method = request.getMethod(); String url = request.getServletPath(); log.debug("Checking user privilege for url: {} {}", method, url); HttpSession session = request.getSession(false); if (session == null) { return true; } Map<String, Boolean> userPrivileges = (Map<String, Boolean>) session.getAttribute("acm_privileges"); if (userPrivileges == null) { throw new AcmNotAuthorizedException(request.getServletPath()); } else { List<AcmPluginUrlPrivilege> urlPrivileges = getAcmPluginManager().getUrlPrivileges(); boolean hasPrivilege = determinePrivilege(method, url, userPrivileges, urlPrivileges); if (!hasPrivilege) { throw new AcmNotAuthorizedException(request.getServletPath()); } } return true; }  @Override boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler); AcmPluginManager getAcmPluginManager(); void setAcmPluginManager(AcmPluginManager acmPluginManager);  }