snoopdave commented on code in PR #222:
URL: https://github.com/apache/roller/pull/222#discussion_r4419687473
##########
app/src/main/java/org/apache/roller/weblogger/ui/struts2/ajax/UserDataServlet.java:
##########
@@ -106,8 +106,10 @@ public void doGet(HttpServletRequest request,
HttpServletResponse response)
Weblogger roller = WebloggerFactory.getWeblogger();
try {
UserManager umgr = roller.getUserManager();
- List<User> users = umgr.getUsersStartingWith(startsWith,
- enabledOnly, offset, length);
+ // only admins, who see email addresses, may search by them
+ List<User> users = admin
+ ? umgr.getUsersStartingWith(startsWith, enabledOnly,
offset, length)
+ : umgr.getUsersWithUserNameStartingWith(startsWith,
enabledOnly, offset, length);
Review Comment:
🤖Claude: fixed by forcing `enabled=true` and capping `length` at
`MAX_LENGTH` (50) for callers who are not global admins; admins keep the
parameters they send. Two new cases in `UserDataServletTest` cover both, and
CHANGES.md mentions it (275327050).
##########
app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAUserManagerImpl.java:
##########
@@ -289,6 +289,36 @@ public List<User> getUsersStartingWith(String startsWith,
Boolean enabled,
return query.getResultList();
}
+ @Override
+ public List<User> getUsersWithUserNameStartingWith(String startsWith,
Boolean enabled,
+ int offset, int length) throws WebloggerException {
+ TypedQuery<User> query;
+ if (enabled != null) {
+ query =
strategy.getNamedQuery("User.getByEnabled&UserNameStartsWith", User.class);
+ query.setParameter(1, enabled);
+ query.setParameter(2, likePrefix(startsWith == null ? "" :
startsWith));
+ } else {
+ query = strategy.getNamedQuery("User.getByUserNameStartsWith",
User.class);
+ query.setParameter(1, likePrefix(startsWith == null ? "" :
startsWith));
+ }
+ if (offset != 0) {
+ query.setFirstResult(offset);
+ }
+ if (length != -1) {
+ query.setMaxResults(length);
+ }
+ return query.getResultList();
+ }
+
+ /**
+ * LIKE pattern that matches values starting with the given text. The
+ * named queries use '!' as the escape character, so '%' and '_' in the
+ * text match only themselves.
+ */
+ static String likePrefix(String startsWith) {
Review Comment:
🤖Claude: fixed by adding `JPAUserManagerLikePrefixTest` with those three
cases plus `a_b` and `!%` (275327050).
##########
app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAUserManagerImpl.java:
##########
@@ -289,6 +289,36 @@ public List<User> getUsersStartingWith(String startsWith,
Boolean enabled,
return query.getResultList();
}
+ @Override
+ public List<User> getUsersWithUserNameStartingWith(String startsWith,
Boolean enabled,
Review Comment:
🤖Claude: fixed by moving the query choice and paging into one private
`findUsersStartingWith(startsWith, matchEmail, enabled, offset, length)`; both
public methods call it (275327050).
##########
app/src/main/java/org/apache/roller/weblogger/business/UserManager.java:
##########
@@ -162,6 +162,18 @@ List<User> getUsers(
*/
List<User> getUsersStartingWith(String startsWith,
Boolean enabled, int offset, int length) throws WebloggerException;
+
+ /**
+ * Lookup users whose usernames start with a string.
+ *
+ * @param startsWith String to match userNames against
+ * @param enabled True for only enabled, false for disabled, null for
all
+ * @param offset Offset into results (for paging)
+ * @param length Max to return (for paging)
+ * @return List of (up to length) users that match startsWith string
+ */
+ List<User> getUsersWithUserNameStartingWith(String startsWith,
Review Comment:
🤖Claude: fixed by adding to the `getUsersStartingWith` javadoc that it
matches email addresses, so only callers who may see them (global admins)
should use it, with a link to `getUsersWithUserNameStartingWith`. Also fixed
the "enalbed" typo there (275327050).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
