svn commit: r1559572 - in /openmeetings/trunk/singlewebapp/src: db/java/org/apache/openmeetings/db/dao/user/ db/java/org/apache/openmeetings/db/entity/user/ web/java/org/apache/openmeetings/web/util/

[solomax]

Author: solomax
Date: Sun Jan 19 19:55:53 2014
New Revision: 1559572

URL: http://svn.apache.org/r1559572
Log:
[OPENMEETINGS-870] security check is updated

Modified:
    
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/dao/user/OrganisationUserDao.java
    
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/entity/user/Organisation_Users.java
    
openmeetings/trunk/singlewebapp/src/web/java/org/apache/openmeetings/web/util/RecordingResourceReference.java

Modified: 
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/dao/user/OrganisationUserDao.java
URL: 
http://svn.apache.org/viewvc/openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/dao/user/OrganisationUserDao.java?rev=1559572&r1=1559571&r2=1559572&view=diff
==============================================================================
--- 
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/dao/user/OrganisationUserDao.java
 (original)
+++ 
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/dao/user/OrganisationUserDao.java
 Sun Jan 19 19:55:53 2014
@@ -78,6 +78,11 @@ public class OrganisationUserDao impleme
                return orgUserList;
        }
 
+       public boolean isUserInOrganization(long orgId, long userId) {
+               return null != em.createNamedQuery("isUserInOrganization", 
Organisation_Users.class)
+                               .setParameter("orgId", 
orgId).setParameter("userId", userId).getSingleResult();
+       }
+       
        public long count() {
                throw new RuntimeException("Should not be used");
        }

Modified: 
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/entity/user/Organisation_Users.java
URL: 
http://svn.apache.org/viewvc/openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/entity/user/Organisation_Users.java?rev=1559572&r1=1559571&r2=1559572&view=diff
==============================================================================
--- 
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/entity/user/Organisation_Users.java
 (original)
+++ 
openmeetings/trunk/singlewebapp/src/db/java/org/apache/openmeetings/db/entity/user/Organisation_Users.java
 Sun Jan 19 19:55:53 2014
@@ -46,6 +46,7 @@ import org.simpleframework.xml.Root;
        , @NamedQuery(name="countOrganisationUsers", query="SELECT COUNT(c) 
FROM Organisation_Users c WHERE c.organisation.organisation_id = :id")
        , @NamedQuery(name="getOrganisationUsersById", query="SELECT c FROM 
Organisation_Users c WHERE c.organisation_users_id = :id")
        , @NamedQuery(name="getOrganisationUsersByOrgId", query="SELECT c FROM 
Organisation_Users c WHERE c.organisation.organisation_id = :id")
+       , @NamedQuery(name="isUserInOrganization", query="SELECT c FROM 
Organisation_Users c WHERE c.organisation.organisation_id = :orgId AND 
c.user.user_id = :userId")
 })
 @Table(name = "organisation_users")
 @Root(name="user_organisation")

Modified: 
openmeetings/trunk/singlewebapp/src/web/java/org/apache/openmeetings/web/util/RecordingResourceReference.java
URL: 
http://svn.apache.org/viewvc/openmeetings/trunk/singlewebapp/src/web/java/org/apache/openmeetings/web/util/RecordingResourceReference.java?rev=1559572&r1=1559571&r2=1559572&view=diff
==============================================================================
--- 
openmeetings/trunk/singlewebapp/src/web/java/org/apache/openmeetings/web/util/RecordingResourceReference.java
 (original)
+++ 
openmeetings/trunk/singlewebapp/src/web/java/org/apache/openmeetings/web/util/RecordingResourceReference.java
 Sun Jan 19 19:55:53 2014
@@ -33,9 +33,8 @@ import javax.servlet.http.HttpServletRes
 
 import org.apache.commons.io.input.BoundedInputStream;
 import org.apache.openmeetings.db.dao.record.FlvRecordingDao;
-import org.apache.openmeetings.db.dao.user.UserDao;
+import org.apache.openmeetings.db.dao.user.OrganisationUserDao;
 import org.apache.openmeetings.db.entity.record.FlvRecording;
-import org.apache.openmeetings.db.entity.user.Organisation_Users;
 import org.apache.openmeetings.web.app.WebSession;
 import org.apache.wicket.protocol.http.servlet.ResponseIOException;
 import org.apache.wicket.request.mapper.parameter.PageParameters;
@@ -181,11 +180,8 @@ public abstract class RecordingResourceR
                if (r.getOwnerId() == null || getUserId() == r.getOwnerId()) {
                        return r;
                }
-               //FIXME UGLY need to be optimized
-               for (Organisation_Users ou : 
getBean(UserDao.class).get(getUserId()).getOrganisation_users()) {
-                       if 
(ou.getOrganisation().getOrganisation_id().equals(r.getOrganization_id())) {
-                               return r;
-                       }
+               if 
(getBean(OrganisationUserDao.class).isUserInOrganization(r.getOrganization_id(),
 getUserId())) {
+                       return r;
                }
                //TODO investigate if these checks are enough
                return null;