Protect guest repositories from being changed anonymously

Author: radkovo

FitLayoutWebService/src/main/java/cz/vutbr/fit/layout/web/data/UserInfo.java

@@ -22,7 +22,7 @@ public class UserInfo
 {
     /**
      * The user ID used for an unathorized user. This is not used when the REST endpoind is
-     * disabled for anonymous sers.
+     * disabled for anonymous users.
      */
     public static String ANONYMOUS_USER = "guest";
 
@@ -108,5 +108,10 @@ public void setExpires(Date expires)
     {
         this.expires = expires;
     }
+
+    public Set<String> getRoles()
+    {
+        return roles;
+    }
 
 }

FitLayoutWebService/src/main/java/cz/vutbr/fit/layout/web/ejb/StorageProviderMulti.java

@@ -125,7 +125,7 @@ public RepositoryInfo getRepositoryInfo(UserInfo user, String repoId)
     {
         if (isReady())
         {
-            return findUserRepository(user.getUserId(), repoId);
+            return findUserRepository(user.getUserId(), repoId, true);
         }
         else
             return null;
@@ -203,9 +203,13 @@ private void createRepositoryWithId(String id, String owner, RepositoryInfo info
     public RepositoryInfo updateRepository(UserInfo user, String repoId, RepositoryInfo info)
             throws RepositoryException
     {
+        final boolean isadmin = (user.getRoles() != null && user.getRoles().contains("admin"));
+        if (!isadmin && user.isAnonymous())
+            return null; // only admin can modify guest repositories
+        
         if (isReady())
         {
-            RepositoryInfo current = findUserRepository(user.getUserId(), repoId);
+            RepositoryInfo current = findUserRepository(user.getUserId(), repoId, isadmin);
             if (current != null)
             {
                 current.updateWith(info);
@@ -267,11 +271,19 @@ private RepositoryInfo findRepository(String uuid)
         }
     }
 
-    private RepositoryInfo findUserRepository(String userId, String repoId)
+    /**
+     * Finds the user repositor and gets the info.
+     * 
+     * @param userId the repository user ID
+     * @param repoId the repository ID
+     * @param allowAnonymous try to look for anonymous user repository if the user's repository does not exist?
+     * @return the repository info or {@code null} if it does not exist
+     */
+    private RepositoryInfo findUserRepository(String userId, String repoId, boolean allowAnonymous)
     {
         var info = manager.getRepositoryInfo(userId + SEP + repoId);
         //if the repository is not defined for the user, try to find it for anonymous guest
-        if (info == null && !UserInfo.ANONYMOUS_USER.equals(userId))
+        if (info == null && allowAnonymous && !UserInfo.ANONYMOUS_USER.equals(userId))
             info = manager.getRepositoryInfo(UserInfo.ANONYMOUS_USER + SEP + repoId);
 
         if (info != null)