From b794c4a5669cd2971ebf58bbe5cb885fb1b062a0 Mon Sep 17 00:00:00 2001 From: serge-rider Date: Tue, 12 May 2020 17:59:21 +0300 Subject: [PATCH] Auth permissions read fix --- .../src/io/cloudbeaver/model/session/WebSession.java | 7 ++++++- .../src/io/cloudbeaver/server/CBSecurityController.java | 4 ++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java index cf29b9533d..1f31ed19e7 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java @@ -184,7 +184,12 @@ public class WebSession { private void refreshSessionAuth() throws DBCException { CBApplication application = CBPlatform.getInstance().getApplication(); if (this.user == null) { - sessionPermissions = application.getSecurityController().getSubjectPermissions(application.getAppConfiguration().getAnonymousUserRole()); + if (application.getAppConfiguration().isAnonymousAccessEnabled()) { + sessionPermissions = application.getSecurityController().getSubjectPermissions( + application.getAppConfiguration().getAnonymousUserRole()); + } else { + sessionPermissions = Collections.emptySet(); + } } else { sessionPermissions = application.getSecurityController().getUserPermissions(this.user.getUserId()); } diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java index 32fe65101e..0b15e2353b 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java @@ -377,7 +377,7 @@ class CBSecurityController implements DBWSecurityController { try (Connection dbCon = database.openConnection()) { Set permissions = new HashSet<>(); try (PreparedStatement dbStat = dbCon.prepareStatement( - "SELECT UNIQUE AP.PERMISSION_ID FROM CB_AUTH_PERMISSIONS AP,CB_USER_ROLE UR\n" + + "SELECT DISTINCT AP.PERMISSION_ID FROM CB_AUTH_PERMISSIONS AP,CB_USER_ROLE UR\n" + "WHERE UR.ROLE_ID=AP.SUBJECT_ID AND UR.USER_ID=?")) { dbStat.setString(1, userId); try (ResultSet dbResult = dbStat.executeQuery()) { @@ -397,7 +397,7 @@ class CBSecurityController implements DBWSecurityController { permissions.addAll(getSubjectPermissions(userId)); return permissions; } catch (SQLException e) { - throw new DBCException("Error saving role in database", e); + throw new DBCException("Error reading user permissions", e); } }