From 3a4346492477db1fbb5a1326e6ae2b4a68bbc982 Mon Sep 17 00:00:00 2001
From: Paul-Christian Volkmer <paul-christian.volkmer@mni.thm.de>
Date: Wed, 21 May 2014 13:09:42 +0200
Subject: [PATCH] Use pre/post authorization for QuestionService were possible
---
.../de/thm/arsnova/services/QuestionService.java | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/src/main/java/de/thm/arsnova/services/QuestionService.java b/src/main/java/de/thm/arsnova/services/QuestionService.java
index b68df961..320ac562 100644
--- a/src/main/java/de/thm/arsnova/services/QuestionService.java
+++ b/src/main/java/de/thm/arsnova/services/QuestionService.java
@@ -146,16 +146,15 @@ public class QuestionService implements IQuestionService {
}
@Override
- @PreAuthorize("isAuthenticated()")
+ @PreAuthorize("isAuthenticated() and hasPermission(#question.getSessionKeyword(), 'session', 'owner')")
public void deleteQuestion(String questionId) {
Question question = databaseDao.getQuestion(questionId);
if (question == null) {
throw new NotFoundException();
}
- User user = userService.getCurrentUser();
Session session = databaseDao.getSession(question.getSessionKeyword());
- if (user == null || session == null || ! session.isCreator(user)) {
+ if (session == null) {
throw new UnauthorizedException();
}
databaseDao.deleteQuestionWithAnswers(question);
@@ -178,26 +177,24 @@ public class QuestionService implements IQuestionService {
}
@Override
- @PreAuthorize("isAuthenticated()")
+ @PreAuthorize("isAuthenticated() and hasPermission(#question.getSessionKeyword(), 'session', 'owner')")
public void deleteInterposedQuestion(String questionId) {
InterposedQuestion question = databaseDao.getInterposedQuestion(questionId);
if (question == null) {
throw new NotFoundException();
}
- User user = userService.getCurrentUser();
Session session = databaseDao.getSessionFromKeyword(question.getSessionId());
- if (user == null || session == null || ! session.isCreator(user)) {
+ if (session == null) {
throw new UnauthorizedException();
}
databaseDao.deleteInterposedQuestion(question);
}
@Override
- @PreAuthorize("isAuthenticated()")
+ @PreAuthorize("isAuthenticated() and hasPermission(#sessionKeyword, 'session', 'owner')")
public void deleteAllInterposedQuestions(String sessionKeyword) {
- User user = userService.getCurrentUser();
Session session = databaseDao.getSessionFromKeyword(sessionKeyword);
- if (user == null || session == null || ! session.isCreator(user)) {
+ if (session == null) {
throw new UnauthorizedException();
}
databaseDao.deleteAllInterposedQuestions(session);
--
GitLab