diff --git a/src/main/java/de/thm/arsnova/security/ApplicationPermissionEvaluator.java b/src/main/java/de/thm/arsnova/security/ApplicationPermissionEvaluator.java index 2706e32d652f468cfc81d011480ae195b8a26e1c..6239be2ca2927d16487bee3fdefbf85d7b6d0d49 100644 --- a/src/main/java/de/thm/arsnova/security/ApplicationPermissionEvaluator.java +++ b/src/main/java/de/thm/arsnova/security/ApplicationPermissionEvaluator.java @@ -58,8 +58,9 @@ public class ApplicationPermissionEvaluator implements PermissionEvaluator { final Object permission ) { final String username = getUsername(authentication); - - if ( + if (checkAdminPermission(username)) { + return true; + } else if ( targetDomainObject instanceof Session && checkSessionPermission(username, ((Session) targetDomainObject).getKeyword(), permission) ) { @@ -75,14 +76,10 @@ public class ApplicationPermissionEvaluator implements PermissionEvaluator { final String targetType, final Object permission ) { - /** TODO only allow accounts from arsnova db **/ final String username = getUsername(authentication); - String[] splittedAdminNames = adminAccounts.split(","); - if (Arrays.asList(splittedAdminNames).contains(username)) { + if (checkAdminPermission(username)) { return true; - } - - if ( + } else if ( "session".equals(targetType) && checkSessionPermission(username, targetId, permission)) { return true; @@ -100,6 +97,15 @@ public class ApplicationPermissionEvaluator implements PermissionEvaluator { return false; } + private boolean checkAdminPermission(final String username) { + /** TODO only allow accounts from arsnova db **/ + String[] splittedAdminNames = adminAccounts.split(","); + if (Arrays.asList(splittedAdminNames).contains(username)) { + return true; + } + return false; + } + private boolean checkSessionPermission( final String username, final Serializable targetId,