From 474907fa7f798d10a77dc083784daf37f15be067 Mon Sep 17 00:00:00 2001 From: serge-rider Date: Thu, 28 May 2020 22:28:05 +0300 Subject: [PATCH 1/2] Fixed in user management --- .../io/cloudbeaver/server/CBSecurityController.java | 12 +++++++++++- .../service/admin/WebServiceBindingAdmin.java | 4 ++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java index 5241b4d6f4..329378a003 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java @@ -76,6 +76,7 @@ class CBSecurityController implements DBWSecurityController { @Override public void deleteUser(String userId) throws DBCException { try (Connection dbCon = database.openConnection()) { + deleteAuthSubject(dbCon, userId); JDBCUtils.executeStatement(dbCon, "DELETE FROM CB_USER WHERE USER_ID=?", userId); } catch (SQLException e) { throw new DBCException("Error deleting user from database", e); @@ -106,7 +107,9 @@ class CBSecurityController implements DBWSecurityController { @Override public WebRole[] getUserRoles(String userId) throws DBCException { try (Connection dbCon = database.openConnection()) { - try (PreparedStatement dbStat = dbCon.prepareStatement("SELECT * FROM CB_USER_ROLE WHERE USER_ID=?")) { + try (PreparedStatement dbStat = dbCon.prepareStatement( + "SELECT R.* FROM CB_USER_ROLE UR,CB_ROLE R " + + "WHERE UR.USER_ID=? AND UR.ROLE_ID=R.ROLE_ID")) { dbStat.setString(1, userId); List roles = new ArrayList<>(); try (ResultSet dbResult = dbStat.executeQuery()) { @@ -357,6 +360,7 @@ class CBSecurityController implements DBWSecurityController { @Override public void deleteRole(String roleId) throws DBCException { try (Connection dbCon = database.openConnection()) { + deleteAuthSubject(dbCon, roleId); JDBCUtils.executeStatement(dbCon, "DELETE FROM CB_ROLE WHERE ROLE_ID=?", roleId); } catch (SQLException e) { throw new DBCException("Error deleting role from database", e); @@ -558,5 +562,11 @@ class CBSecurityController implements DBWSecurityController { } } + private void deleteAuthSubject(Connection dbCon, String subjectId) throws SQLException { + try (PreparedStatement dbStat = dbCon.prepareStatement("DELETE FROM CB_AUTH_SUBJECT WHERE SUBJECT_ID=?")) { + dbStat.setString(1, subjectId); + dbStat.execute(); + } + } } diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java index 8d278796bf..3f59d6b95c 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/WebServiceBindingAdmin.java @@ -50,9 +50,9 @@ public class WebServiceBindingAdmin extends WebServiceBindingBase getService(env).deleteRole(getWebSession(env), env.getArgument("roleId"))); model.getQueryType().dataFetcher("grantUserRole", - env -> getService(env).grantUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("userId"))); + env -> getService(env).grantUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("roleId"))); model.getQueryType().dataFetcher("revokeUserRole", - env -> getService(env).revokeUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("userId"))); + env -> getService(env).revokeUserRole(getWebSession(env), env.getArgument("userId"), env.getArgument("roleId"))); model.getQueryType().dataFetcher("setRolePermissions", env -> getService(env).setRolePermissions(getWebSession(env), env.getArgument("roleId"), env.getArgument("permissions"))); model.getQueryType().dataFetcher("setUserCredentials", From 83c38103a57f281c371497a5ee224791116beec9 Mon Sep 17 00:00:00 2001 From: serge-rider Date: Thu, 28 May 2020 22:45:07 +0300 Subject: [PATCH 2/2] User and role delete checks --- .../cloudbeaver/service/admin/impl/WebServiceAdmin.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java index f9393dd1c9..1cd742b847 100644 --- a/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java +++ b/server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/impl/WebServiceAdmin.java @@ -31,6 +31,7 @@ import io.cloudbeaver.service.admin.AdminUserInfo; import io.cloudbeaver.service.admin.DBWServiceAdmin; import org.jkiss.code.NotNull; import org.jkiss.utils.ArrayUtils; +import org.jkiss.utils.CommonUtils; import java.util.ArrayList; import java.util.Arrays; @@ -104,6 +105,9 @@ public class WebServiceAdmin implements DBWServiceAdmin { @Override public boolean deleteUser(@NotNull WebSession webSession, String userName) throws DBWebException { + if (CommonUtils.equalObjects(userName, webSession.getUser().getUserId())) { + throw new DBWebException("You cannot delete yourself"); + } try { CBPlatform.getInstance().getApplication().getSecurityController().deleteUser(userName); return true; @@ -130,6 +134,10 @@ public class WebServiceAdmin implements DBWServiceAdmin { @Override public boolean deleteRole(@NotNull WebSession webSession, String roleId) throws DBWebException { try { + WebRole[] userRoles = CBPlatform.getInstance().getApplication().getSecurityController().getUserRoles(webSession.getUser().getUserId()); + if (Arrays.stream(userRoles).anyMatch(webRole -> webRole.getRoleId().equals(roleId))) { + throw new DBWebException("You can not delete your own role"); + } CBPlatform.getInstance().getApplication().getSecurityController().deleteRole(roleId); return true; } catch (Exception e) {