Commit @01fa7dc6aadbcad0abe7d92d38552dfb1d6339b5

Keesun Baik 2015-03-13

ProjectTransfer: fixed bug

Problem: AccessControl is allowed all requests to site admin or member of the project in isProjectResourceAllowed method,
so a user of a project that should be transfered to other user or group, can accept the transfer request.

Solution: Changed isProjectResourceAllowed method to check the current user can accept the project-tansfer request
prior to check the current use is admin of the group or member of the project.

@01fa7dc6aadbcad0abe7d92d38552dfb1d6339b5

6339c73

01fa7dc

app/utils/AccessControl.java

--- app/utils/AccessControl.java

+++ app/utils/AccessControl.java


      * @return true if the user has the permission
      */
     private static boolean isProjectResourceAllowed(User user, Project project, Resource resource, Operation operation) {
-        if (OrganizationUser.isAdmin(project.organization, user)) {
-            return true;
-        }
-
-        if (user.isSiteManager()
-                || user.isManagerOf(project)
-                || isAllowedIfAuthor(user, resource)
-                || isAllowedIfAssignee(user, resource)
-                || isAllowedIfGroupMember(project, user)) {
+        if (user.isSiteManager()) {
             return true;
         }
 

             }
         }
 
+        if (OrganizationUser.isAdmin(project.organization, user)) {
+            return true;
+        }
+
+        if (user.isManagerOf(project)
+                || isAllowedIfAuthor(user, resource)
+                || isAllowedIfAssignee(user, resource)
+                || isAllowedIfGroupMember(project, user)) {
+            return true;
+        }
+
         // Some resource's permission depends on their container.
         switch(resource.getType()) {
             case ISSUE_STATE:

Add a comment

Open 0
Closed 0

List

...	...	@@ -226,15 +226,7 @@
226	226	* @return true if the user has the permission
227	227	*/
228	228	private static boolean isProjectResourceAllowed(User user, Project project, Resource resource, Operation operation) {
229		- if (OrganizationUser.isAdmin(project.organization, user)) {
230		- return true;
231		- }
232		-
233		- if (user.isSiteManager()
234		- \|\| user.isManagerOf(project)
235		- \|\| isAllowedIfAuthor(user, resource)
236		- \|\| isAllowedIfAssignee(user, resource)
237		- \|\| isAllowedIfGroupMember(project, user)) {
	229	+ if (user.isSiteManager()) {
238	230	return true;
239	231	}
240	232
...	...	@@ -255,6 +247,17 @@
255	247	}
256	248	}
257	249
	250	+ if (OrganizationUser.isAdmin(project.organization, user)) {
	251	+ return true;
	252	+ }
	253	+
	254	+ if (user.isManagerOf(project)
	255	+ \|\| isAllowedIfAuthor(user, resource)
	256	+ \|\| isAllowedIfAssignee(user, resource)
	257	+ \|\| isAllowedIfGroupMember(project, user)) {
	258	+ return true;
	259	+ }
	260	+
258	261	// Some resource's permission depends on their container.
259	262	switch(resource.getType()) {
260	263	case ISSUE_STATE:

Delete comment