From: Lukasz Jarocki <lukasz.jarocki@sonarsource.com>
Date: Fri, 26 May 2023 13:56:26 +0000 (+0200)
Subject: SONAR-18856 permissions system now correctly validates subportfolios
X-Git-Tag: 10.1.0.73491~159
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=b63b8f6cc0b75e4b504ba6a098fc1b059e7069f1;p=sonarqube.git

SONAR-18856 permissions system now correctly validates subportfolios
---

diff --git a/server/sonar-db-dao/src/main/java/org/sonar/db/entity/EntityDto.java b/server/sonar-db-dao/src/main/java/org/sonar/db/entity/EntityDto.java
index 03e0b564dc3..ab4db5a449a 100644
--- a/server/sonar-db-dao/src/main/java/org/sonar/db/entity/EntityDto.java
+++ b/server/sonar-db-dao/src/main/java/org/sonar/db/entity/EntityDto.java
@@ -36,7 +36,7 @@ public class EntityDto {
   protected String authUuid;
 
   public String getAuthUuid() {
-    if (qualifier.equals("SVW")) {
+    if ("SVW".equals(qualifier)) {
       return authUuid;
     }
     return uuid;
diff --git a/server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java b/server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java
index 44ee9a5e252..62276076f39 100644
--- a/server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java
+++ b/server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java
@@ -103,7 +103,7 @@ public abstract class AbstractUserSession implements UserSession {
 
   @Override
   public final boolean hasEntityPermission(String permission, EntityDto entity) {
-    return hasProjectUuidPermission(permission, entity.getUuid());
+    return hasProjectUuidPermission(permission, entity.getAuthUuid());
   }
 
   @Override
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/setting/ws/SetActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/setting/ws/SetActionIT.java
index 8003484b19c..24510b7afc2 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/setting/ws/SetActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/setting/ws/SetActionIT.java
@@ -153,6 +153,20 @@ public class SetActionIT {
     assertThat(settingsChangeNotifier.wasCalled).isFalse();
   }
 
+  @Test
+  public void persist_new_subportfolio_setting() {
+    propertyDb.insertProperty(newGlobalPropertyDto("my.key", "my global value"), null, null, null, null);
+    ComponentDto portfolio = db.components().insertPrivatePortfolio();
+    ComponentDto subportfolio = db.components().insertSubportfolio(portfolio);
+    logInAsProjectAdministrator(portfolio);
+
+    callForProjectSettingByKey("my.key", "my project value", subportfolio.getKey());
+
+    assertGlobalSetting("my.key", "my global value");
+    assertComponentSetting("my.key", "my project value", subportfolio.uuid());
+    assertThat(settingsChangeNotifier.wasCalled).isFalse();
+  }
+
   @Test
   public void persist_project_property_with_project_admin_permission() {
     ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();