diff options
| author | James Moger <james.moger@gitblit.com> | 2013-05-02 22:59:02 -0400 |
|---|---|---|
| committer | James Moger <james.moger@gitblit.com> | 2013-05-02 22:59:02 -0400 |
| commit | 9715e11fe30eccafa4c8272316883c80ba036a6e (patch) | |
| tree | 764c6466caf919a6c008dea79d9a4c3ec4773702 /src/main/java/com/gitblit/models/UserModel.java | |
| parent | d5ee557ef1370b5b9953dca1c8d3b14d0bd68a98 (diff) | |
| download | gitblit-9715e11fe30eccafa4c8272316883c80ba036a6e.tar.gz gitblit-9715e11fe30eccafa4c8272316883c80ba036a6e.zip | |
Improve permission determination when repo is frozen or is not bare
Diffstat (limited to 'src/main/java/com/gitblit/models/UserModel.java')
| -rw-r--r-- | src/main/java/com/gitblit/models/UserModel.java | 47 |
1 files changed, 38 insertions, 9 deletions
diff --git a/src/main/java/com/gitblit/models/UserModel.java b/src/main/java/com/gitblit/models/UserModel.java index 5750d46a..e4c659c1 100644 --- a/src/main/java/com/gitblit/models/UserModel.java +++ b/src/main/java/com/gitblit/models/UserModel.java @@ -278,18 +278,31 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> ap.registrantType = RegistrantType.USER;
ap.permission = AccessPermission.NONE;
ap.mutable = false;
+
+ // determine maximum permission for the repository
+ final AccessPermission maxPermission =
+ (repository.isFrozen || !repository.isBare) ?
+ AccessPermission.CLONE : AccessPermission.REWIND;
if (AccessRestrictionType.NONE.equals(repository.accessRestriction)) {
// anonymous rewind
ap.permissionType = PermissionType.ANONYMOUS;
- ap.permission = AccessPermission.REWIND;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
return ap;
}
// administrator
if (canAdmin()) {
ap.permissionType = PermissionType.ADMINISTRATOR;
- ap.permission = AccessPermission.REWIND;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
if (!canAdmin) {
// administator permission from team membership
for (TeamModel team : teams) {
@@ -305,13 +318,21 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> // repository owner - either specified owner or personal repository
if (repository.isOwner(username) || repository.isUsersPersonalRepository(username)) {
ap.permissionType = PermissionType.OWNER;
- ap.permission = AccessPermission.REWIND;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
return ap;
}
if (AuthorizationControl.AUTHENTICATED.equals(repository.authorizationControl) && isAuthenticated) {
// AUTHENTICATED is a shortcut for authorizing all logged-in users RW+ access
- ap.permission = AccessPermission.REWIND;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
return ap;
}
@@ -322,7 +343,11 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> AccessPermission p = permissions.get(repository.name.toLowerCase());
if (p != null && repository.accessRestriction.isValidPermission(p)) {
ap.permissionType = PermissionType.EXPLICIT;
- ap.permission = p;
+ if (p.atMost(maxPermission)) {
+ ap.permission = p;
+ } else {
+ ap.permission = maxPermission;
+ }
ap.mutable = true;
return ap;
}
@@ -334,7 +359,11 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> if (p != null && repository.accessRestriction.isValidPermission(p)) {
// take first match
ap.permissionType = PermissionType.REGEX;
- ap.permission = p;
+ if (p.atMost(maxPermission)) {
+ ap.permission = p;
+ } else {
+ ap.permission = maxPermission;
+ }
ap.source = key;
return ap;
}
@@ -345,7 +374,7 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> // try to find a team match
for (TeamModel team : teams) {
RegistrantAccessPermission p = team.getRepositoryPermission(repository);
- if (p.permission.exceeds(ap.permission) && PermissionType.ANONYMOUS != p.permissionType) {
+ if (p.permission.atMost(maxPermission) && p.permission.exceeds(ap.permission) && PermissionType.ANONYMOUS != p.permissionType) {
// use highest team permission that is not an implicit permission
ap.permission = p.permission;
ap.source = team.name;
@@ -370,8 +399,8 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> ap.permissionType = PermissionType.ANONYMOUS;
break;
case NONE:
- // implied REWIND or CLONE if frozen
- ap.permission = repository.isFrozen ? AccessPermission.CLONE : AccessPermission.REWIND;
+ // implied REWIND or CLONE
+ ap.permission = maxPermission;
ap.permissionType = PermissionType.ANONYMOUS;
break;
}
|