diff options
| author | James Moger <james.moger@gitblit.com> | 2013-05-02 09:57:19 -0400 |
|---|---|---|
| committer | James Moger <james.moger@gitblit.com> | 2013-05-02 09:57:19 -0400 |
| commit | 9a6a428bad30be341e4df2c6b0f77d9b9e9881ca (patch) | |
| tree | 3692726839115c6c7588e5f9d64db420e29d4035 /src/main/java/com/gitblit/models | |
| parent | 302df69068e0e67993fbf38abfc2f5e266d35c68 (diff) | |
| download | gitblit-9a6a428bad30be341e4df2c6b0f77d9b9e9881ca.tar.gz gitblit-9a6a428bad30be341e4df2c6b0f77d9b9e9881ca.zip | |
Improve effective permission determination
Diffstat (limited to 'src/main/java/com/gitblit/models')
| -rw-r--r-- | src/main/java/com/gitblit/models/TeamModel.java | 36 | ||||
| -rw-r--r-- | src/main/java/com/gitblit/models/UserModel.java | 36 |
2 files changed, 64 insertions, 8 deletions
diff --git a/src/main/java/com/gitblit/models/TeamModel.java b/src/main/java/com/gitblit/models/TeamModel.java index 9587ca7a..8e0d5d5c 100644 --- a/src/main/java/com/gitblit/models/TeamModel.java +++ b/src/main/java/com/gitblit/models/TeamModel.java @@ -197,6 +197,13 @@ public class TeamModel implements Serializable, Comparable<TeamModel> { ap.permission = AccessPermission.NONE;
ap.mutable = false;
+ if (AccessRestrictionType.NONE.equals(repository.accessRestriction)) {
+ // anonymous rewind
+ ap.permissionType = PermissionType.ANONYMOUS;
+ ap.permission = AccessPermission.REWIND;
+ return ap;
+ }
+
if (canAdmin) {
ap.permissionType = PermissionType.ADMINISTRATOR;
ap.permission = AccessPermission.REWIND;
@@ -206,7 +213,7 @@ public class TeamModel implements Serializable, Comparable<TeamModel> { if (permissions.containsKey(repository.name.toLowerCase())) {
// exact repository permission specified
AccessPermission p = permissions.get(repository.name.toLowerCase());
- if (p != null) {
+ if (p != null && repository.accessRestriction.isValidPermission(p)) {
ap.permissionType = PermissionType.EXPLICIT;
ap.permission = p;
ap.mutable = true;
@@ -217,7 +224,7 @@ public class TeamModel implements Serializable, Comparable<TeamModel> { for (String key : permissions.keySet()) {
if (StringUtils.matchesIgnoreCase(repository.name, key)) {
AccessPermission p = permissions.get(key);
- if (p != null) {
+ if (p != null && repository.accessRestriction.isValidPermission(p)) {
// take first match
ap.permissionType = PermissionType.REGEX;
ap.permission = p;
@@ -227,6 +234,31 @@ public class TeamModel implements Serializable, Comparable<TeamModel> { }
}
}
+
+ // still no explicit or regex, check for implicit permissions
+ if (AccessPermission.NONE == ap.permission) {
+ switch (repository.accessRestriction) {
+ case VIEW:
+ // no implicit permissions possible
+ break;
+ case CLONE:
+ // implied view permission
+ ap.permission = AccessPermission.VIEW;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ case PUSH:
+ // implied clone permission
+ ap.permission = AccessPermission.CLONE;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ case NONE:
+ // implied REWIND or CLONE if frozen
+ ap.permission = repository.isFrozen ? AccessPermission.CLONE : AccessPermission.REWIND;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ }
+ }
+
return ap;
}
diff --git a/src/main/java/com/gitblit/models/UserModel.java b/src/main/java/com/gitblit/models/UserModel.java index bec011d9..5750d46a 100644 --- a/src/main/java/com/gitblit/models/UserModel.java +++ b/src/main/java/com/gitblit/models/UserModel.java @@ -281,7 +281,7 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> if (AccessRestrictionType.NONE.equals(repository.accessRestriction)) {
// anonymous rewind
- ap.permissionType = PermissionType.ADMINISTRATOR;
+ ap.permissionType = PermissionType.ANONYMOUS;
ap.permission = AccessPermission.REWIND;
return ap;
}
@@ -320,7 +320,7 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> if (permissions.containsKey(repository.name.toLowerCase())) {
// exact repository permission specified, use it
AccessPermission p = permissions.get(repository.name.toLowerCase());
- if (p != null) {
+ if (p != null && repository.accessRestriction.isValidPermission(p)) {
ap.permissionType = PermissionType.EXPLICIT;
ap.permission = p;
ap.mutable = true;
@@ -331,7 +331,7 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> for (String key : permissions.keySet()) {
if (StringUtils.matchesIgnoreCase(repository.name, key)) {
AccessPermission p = permissions.get(key);
- if (p != null) {
+ if (p != null && repository.accessRestriction.isValidPermission(p)) {
// take first match
ap.permissionType = PermissionType.REGEX;
ap.permission = p;
@@ -345,13 +345,37 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel> // try to find a team match
for (TeamModel team : teams) {
RegistrantAccessPermission p = team.getRepositoryPermission(repository);
- if (p.permission.exceeds(ap.permission)) {
- // use highest team permission
+ if (p.permission.exceeds(ap.permission) && PermissionType.ANONYMOUS != p.permissionType) {
+ // use highest team permission that is not an implicit permission
ap.permission = p.permission;
ap.source = team.name;
ap.permissionType = PermissionType.TEAM;
}
- }
+ }
+
+ // still no explicit, regex, or team match, check for implicit permissions
+ if (AccessPermission.NONE == ap.permission) {
+ switch (repository.accessRestriction) {
+ case VIEW:
+ // no implicit permissions possible
+ break;
+ case CLONE:
+ // implied view permission
+ ap.permission = AccessPermission.VIEW;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ case PUSH:
+ // implied clone permission
+ ap.permission = AccessPermission.CLONE;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ case NONE:
+ // implied REWIND or CLONE if frozen
+ ap.permission = repository.isFrozen ? AccessPermission.CLONE : AccessPermission.REWIND;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ }
+ }
return ap;
}
|