opensource/cloudbeaver
3
0
Fork 0
mirror of https://github.com/dbeaver/cloudbeaver.git synced 2026-09-24 16:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Auth permissions read fix

Browse Source
This commit is contained in:
serge-rider
2020-05-12 17:59:21 +03:00
parent 633d649ac5
commit b794c4a566
2 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java
+6 -1
View File
@@ -184,7 +184,12 @@ public class WebSession {
private void refreshSessionAuth() throws DBCException {
CBApplication application = CBPlatform.getInstance().getApplication();
if (this.user == null) {
sessionPermissions = application.getSecurityController().getSubjectPermissions(application.getAppConfiguration().getAnonymousUserRole());
if (application.getAppConfiguration().isAnonymousAccessEnabled()) {
sessionPermissions = application.getSecurityController().getSubjectPermissions(
application.getAppConfiguration().getAnonymousUserRole());
} else {
sessionPermissions = Collections.emptySet();
}
} else {
sessionPermissions = application.getSecurityController().getUserPermissions(this.user.getUserId());
}
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java
+2 -2
View File
@@ -377,7 +377,7 @@ class CBSecurityController implements DBWSecurityController {
try (Connection dbCon = database.openConnection()) {
Set<String> permissions = new HashSet<>();
try (PreparedStatement dbStat = dbCon.prepareStatement(
"SELECT UNIQUE AP.PERMISSION_ID FROM CB_AUTH_PERMISSIONS AP,CB_USER_ROLE UR\n" +
"SELECT DISTINCT AP.PERMISSION_ID FROM CB_AUTH_PERMISSIONS AP,CB_USER_ROLE UR\n" +
"WHERE UR.ROLE_ID=AP.SUBJECT_ID AND UR.USER_ID=?")) {
dbStat.setString(1, userId);
try (ResultSet dbResult = dbStat.executeQuery()) {
@@ -397,7 +397,7 @@ class CBSecurityController implements DBWSecurityController {
permissions.addAll(getSubjectPermissions(userId));
return permissions;
} catch (SQLException e) {
throw new DBCException("Error saving role in database", e);
throw new DBCException("Error reading user permissions", e);
}
}