diff --git a/src/main/java/de/thm/arsnova/entities/InterposedQuestion.java b/src/main/java/de/thm/arsnova/entities/InterposedQuestion.java index a08b136ae2b43be9ca73e7cb3bd0a97b3a6323a1..116535266e958aefde1dedbf3ab09084fe5f650f 100644 --- a/src/main/java/de/thm/arsnova/entities/InterposedQuestion.java +++ b/src/main/java/de/thm/arsnova/entities/InterposedQuestion.java @@ -98,4 +98,8 @@ public class InterposedQuestion { public void setCreator(String creator) { this.creator = creator; } + + public boolean isCreator(User user) { + return user.getUsername().equals(creator); + } } diff --git a/src/main/java/de/thm/arsnova/services/QuestionService.java b/src/main/java/de/thm/arsnova/services/QuestionService.java index 2224949f81fb480bc5dbb1bccbd62f5ffde49862..406be88d01402d9de0d6e94e68476f14b225aee3 100644 --- a/src/main/java/de/thm/arsnova/services/QuestionService.java +++ b/src/main/java/de/thm/arsnova/services/QuestionService.java @@ -378,7 +378,9 @@ public class QuestionService implements IQuestionService, ApplicationEventPublis throw new NotFoundException(); } final Session session = databaseDao.getSessionFromKeyword(question.getSessionId()); - + if (!question.isCreator(user) && !session.isCreator(user)) { + throw new UnauthorizedException(); + } if (session.isCreator(user)) { databaseDao.markInterposedQuestionAsRead(question); } diff --git a/src/main/java/de/thm/arsnova/socket/ARSnovaSocketIOServer.java b/src/main/java/de/thm/arsnova/socket/ARSnovaSocketIOServer.java index 4f20db3ed622ea4c08bc05692f7a43aa18bab790..b7dbfd3c364bec9593f153efa5bdd74e2489535f 100644 --- a/src/main/java/de/thm/arsnova/socket/ARSnovaSocketIOServer.java +++ b/src/main/java/de/thm/arsnova/socket/ARSnovaSocketIOServer.java @@ -37,7 +37,9 @@ import de.thm.arsnova.events.NewInterposedQuestionEvent; import de.thm.arsnova.events.NewQuestionEvent; import de.thm.arsnova.events.NovaEvent; import de.thm.arsnova.events.NovaEventVisitor; +import de.thm.arsnova.exceptions.UnauthorizedException; import de.thm.arsnova.exceptions.NoContentException; +import de.thm.arsnova.exceptions.NotFoundException; import de.thm.arsnova.services.IFeedbackService; import de.thm.arsnova.services.IQuestionService; import de.thm.arsnova.services.ISessionService; @@ -161,7 +163,11 @@ public class ARSnovaSocketIOServer implements ApplicationListener<NovaEvent>, No de.thm.arsnova.entities.transport.InterposedQuestion question, AckRequest ackRequest) { final User user = userService.getUser2SocketId(client.getSessionId()); - questionService.readInterposedQuestionInternal(question.getId(), user); + try { + questionService.readInterposedQuestionInternal(question.getId(), user); + } catch (NotFoundException | UnauthorizedException e) { + LOGGER.error("Loading of question {} failed for user {} with exception {}", question.getId(), user, e.getMessage()); + } } });