Differences
This shows you the differences between two versions of the page.
|
java:new-app-v3 [14/05/2019 13:05] Anthony Arents [Presentation (Conversion)] |
java:new-app-v3 [11/03/2025 16:51] (current) Anthony Arents [EXT JS 6] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== New Java Web Applications ====== | ====== New Java Web Applications ====== | ||
| - | **End of life sometime after 2019.** Life will be prolonged by major and minor updates to ALL frameworks and libraries\\ | + | **End of life sometime after 2020.** Life will be prolonged by major and minor updates to ALL frameworks and libraries\\ |
| (by progressively updating the app whenever a new version comes out for libraries we rely on, we can prevent spending days/weeks/months on a rewrite in the future) | (by progressively updating the app whenever a new version comes out for libraries we rely on, we can prevent spending days/weeks/months on a rewrite in the future) | ||
| Line 12: | Line 12: | ||
| * Spring (latest) | * Spring (latest) | ||
| * Spring Security (latest) | * Spring Security (latest) | ||
| - | * Hibernate (latest 5.3) | + | * Hibernate (latest 5.4) |
| * Javamelody (latest, developer tool, used for statistics) | * Javamelody (latest, developer tool, used for statistics) | ||
| * ExtJS (frontend latest) or Bootstrap+JQuery | * ExtJS (frontend latest) or Bootstrap+JQuery | ||
| Line 174: | Line 174: | ||
| <javax.elapi>3.0.0</javax.elapi> | <javax.elapi>3.0.0</javax.elapi> | ||
| - | <spring>5.1.6.RELEASE</spring> | + | <spring>5.2.0.RELEASE</spring> |
| - | <springsecurity>5.1.5.RELEASE</springsecurity> | + | <springsecurity>5.2.0.RELEASE</springsecurity> |
| - | <mysql>8.0.16</mysql> | + | <mysql>8.0.17</mysql> |
| - | <dbcp>2.6.0</dbcp> | + | <dbcp>2.7.0</dbcp> |
| - | <hibernate>5.4.2.Final</hibernate> | + | <hibernate>5.4.6.Final</hibernate> |
| - | <hibernate.validator>6.0.16.Final</hibernate.validator> | + | <hibernate.validator>6.0.17.Final</hibernate.validator> |
| - | <jackson>2.9.8</jackson> | + | <jackson>2.10.0</jackson> |
| <apache.taglibs>1.2.5</apache.taglibs> | <apache.taglibs>1.2.5</apache.taglibs> | ||
| - | <log4j>2.11.2</log4j> | + | <log4j>2.12.1</log4j> |
| <commons.lang>3.9</commons.lang> | <commons.lang>3.9</commons.lang> | ||
| - | <commons.text>1.6</commons.text> | + | <commons.text>1.8</commons.text> |
| <commons.io>2.6</commons.io> | <commons.io>2.6</commons.io> | ||
| - | <commons.beanutils>1.9.3</commons.beanutils> | + | <commons.beanutils>1.9.4</commons.beanutils> |
| <javax.mail>1.6.2</javax.mail> | <javax.mail>1.6.2</javax.mail> | ||
| <apache.poi>4.1.0</apache.poi> | <apache.poi>4.1.0</apache.poi> | ||
| - | <javamelody>1.77.0</javamelody> | + | <javamelody>1.79.0</javamelody> |
| <findbugs.helper>3.0.2</findbugs.helper> | <findbugs.helper>3.0.2</findbugs.helper> | ||
| - | <jsoup>1.11.3</jsoup> | + | <jsoup>1.12.1</jsoup> |
| - | <auth0.jwt>3.8.0</auth0.jwt> | + | <im4java>1.4.0</im4java> |
| - | <metadataextractor>2.11.0</metadataextractor> | + | <auth0.jwt>3.8.3</auth0.jwt> |
| + | <metadataextractor>2.12.0</metadataextractor> | ||
| + | <stax2api>4.2</stax2api> | ||
| <maven.compiler.source>1.8</maven.compiler.source> | <maven.compiler.source>1.8</maven.compiler.source> | ||
| Line 201: | Line 203: | ||
| <report.plugin.maven.inforeports>3.0.0</report.plugin.maven.inforeports> | <report.plugin.maven.inforeports>3.0.0</report.plugin.maven.inforeports> | ||
| <report.plugin.maven.jxr>3.0.0</report.plugin.maven.jxr> | <report.plugin.maven.jxr>3.0.0</report.plugin.maven.jxr> | ||
| - | <report.plugin.maven.javadoc>3.1.0</report.plugin.maven.javadoc> | + | <report.plugin.maven.javadoc>3.1.1</report.plugin.maven.javadoc> |
| - | <report.plugin.maven.checkstyle>3.0.0</report.plugin.maven.checkstyle> | + | <report.plugin.maven.checkstyle>3.1.0</report.plugin.maven.checkstyle> |
| - | <report.plugin.maven.checkstyle.checkstyleversion>8.20</report.plugin.maven.checkstyle.checkstyleversion> | + | <report.plugin.maven.checkstyle.checkstyleversion>8.25</report.plugin.maven.checkstyle.checkstyleversion> |
| <checkstyle.config.location>checkstyle.xml</checkstyle.config.location> | <checkstyle.config.location>checkstyle.xml</checkstyle.config.location> | ||
| <report.plugin.maven.pmd>3.12.0</report.plugin.maven.pmd> | <report.plugin.maven.pmd>3.12.0</report.plugin.maven.pmd> | ||
| - | <report.plugin.maven.pmd.pmdversion>6.14.0</report.plugin.maven.pmd.pmdversion> | + | <report.plugin.maven.pmd.pmdversion>6.18.0</report.plugin.maven.pmd.pmdversion> |
| <report.plugin.maven.surefire>3.0.0-M3</report.plugin.maven.surefire> | <report.plugin.maven.surefire>3.0.0-M3</report.plugin.maven.surefire> | ||
| <report.plugin.codehaus.findbugs>3.0.5</report.plugin.codehaus.findbugs> | <report.plugin.codehaus.findbugs>3.0.5</report.plugin.codehaus.findbugs> | ||
| Line 212: | Line 214: | ||
| <report.plugin.codehaus.versions>2.7</report.plugin.codehaus.versions> | <report.plugin.codehaus.versions>2.7</report.plugin.codehaus.versions> | ||
| - | <build.plugin.maven.site>3.7.1</build.plugin.maven.site> | + | <build.plugin.maven.site>3.8.2</build.plugin.maven.site> |
| <build.plugin.maven.compiler>3.8.1</build.plugin.maven.compiler> | <build.plugin.maven.compiler>3.8.1</build.plugin.maven.compiler> | ||
| <build.plugin.maven.deploy>3.0.0-M1</build.plugin.maven.deploy> | <build.plugin.maven.deploy>3.0.0-M1</build.plugin.maven.deploy> | ||
| Line 218: | Line 220: | ||
| <build.plugin.maven.install>3.0.0-M1</build.plugin.maven.install> | <build.plugin.maven.install>3.0.0-M1</build.plugin.maven.install> | ||
| <build.plugin.maven.dependency>3.1.1</build.plugin.maven.dependency> | <build.plugin.maven.dependency>3.1.1</build.plugin.maven.dependency> | ||
| - | <build.plugin.maven.war>3.2.2</build.plugin.maven.war> | + | <build.plugin.maven.war>3.2.3</build.plugin.maven.war> |
| <build.plugin.maven.resources>3.1.0</build.plugin.maven.resources> | <build.plugin.maven.resources>3.1.0</build.plugin.maven.resources> | ||
| <build.plugin.maven.surefire>3.0.0-M3</build.plugin.maven.surefire> | <build.plugin.maven.surefire>3.0.0-M3</build.plugin.maven.surefire> | ||
| Line 687: | Line 689: | ||
| This will set most of your dependencies straight, \\ | This will set most of your dependencies straight, \\ | ||
| - | the parent pom ensures all projects use UTF-8 encoding for files & sets some maven plugins. | + | Be sure to check the graph to solve the dependency conflicts. \\ |
| + | The parent pom ensures all projects use UTF-8 encoding for files & sets some maven plugins. | ||
| ==== Checkstyle configuration ==== | ==== Checkstyle configuration ==== | ||
| Line 760: | Line 763: | ||
| <!-- See http://checkstyle.sf.net/config_misc.html --> | <!-- See http://checkstyle.sf.net/config_misc.html --> | ||
| <module name="RegexpSingleline"> | <module name="RegexpSingleline"> | ||
| - | <property name="format" value="\s+$"/> | + | <property name="format" value="\s+$"/> |
| - | <property name="minimum" value="0"/> | + | <property name="minimum" value="0"/> |
| - | <property name="maximum" value="0"/> | + | <property name="maximum" value="0"/> |
| - | <property name="message" value="Line has trailing spaces."/> | + | <property name="message" value="Line has trailing spaces."/> |
| + | </module> | ||
| + | |||
| + | <!-- Checks for Size Violations. --> | ||
| + | <!-- See http://checkstyle.sf.net/config_sizes.html --> | ||
| + | <module name="LineLength"> | ||
| + | <property name="max" value="120"/> | ||
| </module> | </module> | ||
| Line 801: | Line 810: | ||
| <module name="UnusedImports"> | <module name="UnusedImports"> | ||
| <property name="processJavadoc" value="false"/> | <property name="processJavadoc" value="false"/> | ||
| - | </module> | ||
| - | |||
| - | <!-- Checks for Size Violations. --> | ||
| - | <!-- See http://checkstyle.sf.net/config_sizes.html --> | ||
| - | <module name="LineLength"> | ||
| - | <property name="max" value="120"/> | ||
| </module> | </module> | ||
| <module name="MethodLength"/> | <module name="MethodLength"/> | ||
| Line 891: | Line 894: | ||
| <groupId>org.apache.tika</groupId> | <groupId>org.apache.tika</groupId> | ||
| <artifactId>tika-parsers</artifactId> | <artifactId>tika-parsers</artifactId> | ||
| - | <version>1.20</version> | + | <version>1.22</version> |
| </dependency> | </dependency> | ||
| </code> | </code> | ||
| Line 900: | Line 903: | ||
| <groupId>org.hibernate</groupId> | <groupId>org.hibernate</groupId> | ||
| <artifactId>hibernate-search-orm</artifactId> | <artifactId>hibernate-search-orm</artifactId> | ||
| - | <version>5.14.0.Final</version> | + | <version>5.11.3.Final</version> |
| </dependency> | </dependency> | ||
| </code> | </code> | ||
| Line 909: | Line 912: | ||
| <groupId>org.hibernate</groupId> | <groupId>org.hibernate</groupId> | ||
| <artifactId>hibernate-validator</artifactId> | <artifactId>hibernate-validator</artifactId> | ||
| - | <version>5.4.2.Final</version> | + | <version>5.4.3.Final</version> |
| </dependency> | </dependency> | ||
| </code> | </code> | ||
| Line 918: | Line 921: | ||
| <groupId>org.hibernate</groupId> | <groupId>org.hibernate</groupId> | ||
| <artifactId>hibernate-validator</artifactId> | <artifactId>hibernate-validator</artifactId> | ||
| - | <version>6.0.11.Final</version> | + | <version>6.0.17.Final</version> |
| </dependency> | </dependency> | ||
| </code> | </code> | ||
| Line 927: | Line 930: | ||
| <groupId>org.jsoup</groupId> | <groupId>org.jsoup</groupId> | ||
| <artifactId>jsoup</artifactId> | <artifactId>jsoup</artifactId> | ||
| - | <version>1.11.3</version> | + | <version>1.12.1</version> |
| </dependency> | </dependency> | ||
| </code> | </code> | ||
| Line 1306: | Line 1309: | ||
| @Override | @Override | ||
| - | public void configure(final WebSecurity web) throws Exception { | + | public void configure(final WebSecurity web) { |
| web.ignoring().antMatchers("/static/**", "/classic/**", "/app/**", "/production/**", "/Merke/**"); | web.ignoring().antMatchers("/static/**", "/classic/**", "/app/**", "/production/**", "/Merke/**"); | ||
| } | } | ||
| Line 4558: | Line 4561: | ||
| [[https://docs.spring.io/spring-security/site/docs/current/reference/html/el-access.html]] | [[https://docs.spring.io/spring-security/site/docs/current/reference/html/el-access.html]] | ||
| + | ==== Method Security (aka do it yourself) ==== | ||
| + | |||
| + | <code>@methodSecurity.hasLoginAccess(#id)</code> | ||
| + | |||
| + | <code java MethodSecurity.java>package be.mentoringsystems.merke.security; | ||
| + | |||
| + | import be.mentoringsystems.merke.model.QueryParams; | ||
| + | import be.mentoringsystems.merke.model.db.Attendance; | ||
| + | import be.mentoringsystems.merke.model.db.Certificate; | ||
| + | import be.mentoringsystems.merke.model.db.Context; | ||
| + | import be.mentoringsystems.merke.model.db.File; | ||
| + | import be.mentoringsystems.merke.model.db.Login; | ||
| + | import be.mentoringsystems.merke.model.db.Remark; | ||
| + | import be.mentoringsystems.merke.model.db.Vendor; | ||
| + | import be.mentoringsystems.merke.model.db.VendorRequest; | ||
| + | import be.mentoringsystems.merke.model.db.Vendorstall; | ||
| + | import be.mentoringsystems.merke.model.db.VendorstallPlacement; | ||
| + | import be.mentoringsystems.merke.model.dto.AttendanceDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.CertificateDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.FileDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.LoginDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.RemarkDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.VendorDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.VendorRequestDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.VendorstallDTO; | ||
| + | import be.mentoringsystems.merke.model.dto.VendorstallPlacementDTO; | ||
| + | import be.mentoringsystems.merke.service.AttendanceService; | ||
| + | import be.mentoringsystems.merke.service.CertificateService; | ||
| + | import be.mentoringsystems.merke.service.ContextService; | ||
| + | import be.mentoringsystems.merke.service.FileService; | ||
| + | import be.mentoringsystems.merke.service.LoginService; | ||
| + | import be.mentoringsystems.merke.service.RemarkService; | ||
| + | import be.mentoringsystems.merke.service.VendorRequestService; | ||
| + | import be.mentoringsystems.merke.service.VendorService; | ||
| + | import be.mentoringsystems.merke.service.VendorstallPlacementService; | ||
| + | import be.mentoringsystems.merke.service.VendorstallService; | ||
| + | import java.util.UUID; | ||
| + | import org.springframework.beans.factory.annotation.Autowired; | ||
| + | import org.springframework.security.access.AccessDeniedException; | ||
| + | import org.springframework.stereotype.Component; | ||
| + | |||
| + | /** | ||
| + | * | ||
| + | * @author anthonyarents | ||
| + | */ | ||
| + | @Component("methodSecurity") | ||
| + | public class MethodSecurity { | ||
| + | |||
| + | @Autowired | ||
| + | private transient LoginService loginService; | ||
| + | @Autowired | ||
| + | private transient VendorService vendorService; | ||
| + | @Autowired | ||
| + | private transient VendorstallService vendorstallService; | ||
| + | @Autowired | ||
| + | private transient VendorstallPlacementService vendorstallPlacementService; | ||
| + | @Autowired | ||
| + | private transient AttendanceService attendanceService; | ||
| + | @Autowired | ||
| + | private transient CertificateService certificateService; | ||
| + | @Autowired | ||
| + | private transient FileService fileService; | ||
| + | @Autowired | ||
| + | private transient RemarkService remarkService; | ||
| + | @Autowired | ||
| + | private transient VendorRequestService vendorRequestService; | ||
| + | @Autowired | ||
| + | private transient ContextService contextService; | ||
| + | |||
| + | // QueryParams | ||
| + | public boolean vendorLimited(final QueryParams queryParams) throws AccessDeniedException { | ||
| + | final Login login = loginService.getCurrentLogin(); | ||
| + | |||
| + | if (!login.isAdmin() && !login.isMSAdmin() && !login.isFireman()) { | ||
| + | final Vendor vendor = vendorService.getByLoginId(login.getId()); | ||
| + | if (!vendor.getId().toString().equals(queryParams.getFilterValue("vendorId"))) { | ||
| + | return false; | ||
| + | } | ||
| + | } | ||
| + | |||
| + | return true; | ||
| + | } | ||
| + | |||
| + | // Attendance | ||
| + | public boolean hasAttendanceAccess(final AttendanceDTO dto, final UUID id) { | ||
| + | dto.setId(id); | ||
| + | return hasAttendanceAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasAttendanceAccess(final AttendanceDTO dto) { | ||
| + | boolean hasAccess = true; | ||
| + | if (dto.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(dto.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(dto.getVendorstallId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getId() != null) { | ||
| + | return hasAttendanceAccess(dto.getId()); | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | public boolean hasAttendanceAccess(final UUID id) { | ||
| + | boolean hasAccess = true; | ||
| + | Attendance obj = attendanceService.getById(id); | ||
| + | if (obj == null) { | ||
| + | hasAccess = false; | ||
| + | } else { | ||
| + | if (hasAccess && obj.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(obj.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && obj.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(obj.getVendorstallId()); | ||
| + | } | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | // Certificate | ||
| + | public boolean hasCertificateAccess(final CertificateDTO dto, final UUID id) { | ||
| + | dto.setId(id); | ||
| + | return hasCertificateAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasCertificateAccess(final CertificateDTO dto) { | ||
| + | boolean hasAccess = true; | ||
| + | if (dto.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(dto.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(dto.getVendorstallId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getId() != null) { | ||
| + | return hasCertificateAccess(dto.getId()); | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | public boolean hasCertificateAccess(final UUID id) { | ||
| + | boolean hasAccess = true; | ||
| + | Certificate obj = certificateService.getById(id); | ||
| + | if (obj == null) { | ||
| + | hasAccess = false; | ||
| + | } else { | ||
| + | if (hasAccess && obj.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(obj.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && obj.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(obj.getVendorstallId()); | ||
| + | } | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | // Certificate | ||
| + | public boolean hasFileAccess(final FileDTO dto, final UUID id) { | ||
| + | dto.setId(id); | ||
| + | return hasFileAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasFileAccess(final FileDTO dto) { | ||
| + | boolean hasAccess = true; | ||
| + | if (dto.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(dto.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(dto.getVendorstallId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getId() != null) { | ||
| + | return hasFileAccess(dto.getId()); | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | public boolean hasFileAccess(final UUID id) { | ||
| + | boolean hasAccess = true; | ||
| + | File obj = fileService.getById(id); | ||
| + | if (obj == null) { | ||
| + | hasAccess = false; | ||
| + | } else { | ||
| + | if (hasAccess && obj.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(obj.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && obj.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(obj.getVendorstallId()); | ||
| + | } | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | // Remark | ||
| + | public boolean hasRemarkAccess(final RemarkDTO dto, final UUID id) { | ||
| + | dto.setId(id); | ||
| + | return hasRemarkAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasRemarkAccess(final RemarkDTO dto) { | ||
| + | boolean hasAccess = true; | ||
| + | if (dto.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(dto.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(dto.getVendorstallId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getId() != null) { | ||
| + | return hasRemarkAccess(dto.getId()); | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | public boolean hasRemarkAccess(final UUID id) { | ||
| + | boolean hasAccess = true; | ||
| + | Remark obj = remarkService.getById(id); | ||
| + | if (obj == null) { | ||
| + | hasAccess = false; | ||
| + | } else { | ||
| + | if (hasAccess && obj.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(obj.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && obj.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(obj.getVendorstallId()); | ||
| + | } | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | // Vendor | ||
| + | public boolean hasVendorAccess(final VendorDTO dto, final UUID vendorId) { | ||
| + | dto.setId(vendorId); | ||
| + | return hasVendorAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorAccess(final VendorDTO dto) { | ||
| + | return hasVendorAccess(dto.getId()); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorAccess(final UUID vendorId) { | ||
| + | Login login = loginService.getCurrentLogin(); | ||
| + | return hasVendorAccess(login, vendorId); | ||
| + | } | ||
| + | |||
| + | // VendorRequest | ||
| + | public boolean hasVendorRequestAccess(final VendorRequestDTO dto, final UUID id) { | ||
| + | dto.setId(id); | ||
| + | return hasVendorRequestAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorRequestAccess(final VendorRequestDTO dto) { | ||
| + | boolean hasAccess = true; | ||
| + | if (dto.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(dto.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(dto.getVendorstallId()); | ||
| + | } | ||
| + | if (hasAccess && dto.getId() != null) { | ||
| + | return hasVendorRequestAccess(dto.getId()); | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorRequestAccess(final UUID id) { | ||
| + | boolean hasAccess = true; | ||
| + | VendorRequest obj = vendorRequestService.getById(id); | ||
| + | if (obj == null) { | ||
| + | hasAccess = false; | ||
| + | } else { | ||
| + | if (hasAccess && obj.getVendorId() != null) { | ||
| + | hasAccess = hasVendorAccess(obj.getVendorId()); | ||
| + | } | ||
| + | if (hasAccess && obj.getVendorstallId() != null) { | ||
| + | hasAccess = hasVendorstallAccess(obj.getVendorstallId()); | ||
| + | } | ||
| + | } | ||
| + | return hasAccess; | ||
| + | } | ||
| + | |||
| + | // Vendorstall | ||
| + | public boolean hasVendorstallAccess(final VendorstallDTO dto, final UUID vendorstallId) { | ||
| + | dto.setId(vendorstallId); | ||
| + | return hasVendorstallAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorstallAccess(final VendorstallDTO dto) { | ||
| + | return hasVendorstallAccess(dto.getId()); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorstallAccess(final UUID vendorstallId) { | ||
| + | Login login = loginService.getCurrentLogin(); | ||
| + | return hasVendorstallAccess(login, vendorstallId); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorstallPlacementAccess(final VendorstallPlacementDTO dto, final UUID vendorstallPlacementId) { | ||
| + | dto.setId(vendorstallPlacementId); | ||
| + | return hasVendorstallPlacementAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorstallPlacementAccess(final VendorstallPlacementDTO dto) { | ||
| + | return hasVendorstallPlacementAccess(dto.getId()); | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorstallPlacementAccess(final UUID vendorstallPlacementId) { | ||
| + | Login login = loginService.getCurrentLogin(); | ||
| + | return hasVendorstallPlacementAccess(login, vendorstallPlacementId); | ||
| + | } | ||
| + | |||
| + | public boolean hasLoginAccess(final LoginDTO dto, final UUID loginId) { | ||
| + | dto.setId(loginId); | ||
| + | return hasLoginAccess(dto); | ||
| + | } | ||
| + | |||
| + | public boolean hasLoginAccess(final LoginDTO dto) { | ||
| + | return hasLoginAccess(dto.getId()); | ||
| + | } | ||
| + | |||
| + | public boolean hasLoginAccess(final UUID loginId) { | ||
| + | Login login = loginService.getCurrentLogin(); | ||
| + | return hasLoginAccess(login, loginId); | ||
| + | } | ||
| + | |||
| + | public boolean hasLoginAccess(final Login login, final UUID loginId) { | ||
| + | if (login == null) { | ||
| + | return false; | ||
| + | } else if (login.isMSAdmin()) { | ||
| + | return true; | ||
| + | } else { | ||
| + | if (loginId == null) { | ||
| + | return false; | ||
| + | } else { | ||
| + | if (loginId.equals(login.getId())) { | ||
| + | return true; | ||
| + | } else { | ||
| + | if (login.getContextId() == null) { | ||
| + | return false; | ||
| + | } else { | ||
| + | final Context context = contextService.getById(login.getContextId()); | ||
| + | final Vendor v = vendorService.getByLoginId(loginId); | ||
| + | if (v != null && v.getContexts().contains(context)) { | ||
| + | return login.isAdmin() || login.isFireman() || login.isPolice(); | ||
| + | } else { | ||
| + | return false; | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | // HelperMethods | ||
| + | private boolean hasVendorAccess(final Login login, final UUID vendorId) { | ||
| + | if (login == null) { | ||
| + | return false; | ||
| + | } else if (login.isMSAdmin()) { | ||
| + | return true; | ||
| + | } else { | ||
| + | if (vendorId == null) { | ||
| + | return false; | ||
| + | } else { | ||
| + | Vendor v = vendorService.getById(vendorId); | ||
| + | if (v == null) { | ||
| + | return false; | ||
| + | } else { | ||
| + | if (v.getLoginId().equals(login.getId())) { | ||
| + | return true; | ||
| + | } else { | ||
| + | if (login.getContextId() == null) { | ||
| + | return false; | ||
| + | } else { | ||
| + | final Context context = contextService.getById(login.getContextId()); | ||
| + | if (v.getContexts().contains(context)) { | ||
| + | return login.isAdmin() || login.isFireman() || login.isPolice(); | ||
| + | } else { | ||
| + | return false; | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | private boolean hasVendorAdminAccess(final Login login, final Vendor vendor) { | ||
| + | if (vendor == null) { | ||
| + | return login.isMSAdmin(); | ||
| + | } else { | ||
| + | //TODO extra checks for vendor | ||
| + | return true; | ||
| + | } | ||
| + | } | ||
| + | |||
| + | public boolean hasVendorAdminAccess(final UUID vendorId) { | ||
| + | final Login login = loginService.getCurrentLogin(); | ||
| + | return hasVendorAdminAccess(login, vendorId); | ||
| + | } | ||
| + | |||
| + | private boolean hasVendorAdminAccess(final Login login, final UUID vendorId) { | ||
| + | if (login == null) { | ||
| + | return false; | ||
| + | } else if (login.isMSAdmin()) { | ||
| + | return true; | ||
| + | } else if (login.isAdmin()) { | ||
| + | if (vendorId == null) { | ||
| + | return true; // creating a new obj | ||
| + | } else { | ||
| + | final Vendor v = vendorService.getById(vendorId); | ||
| + | return hasVendorAdminAccess(login, v); | ||
| + | } | ||
| + | } else { | ||
| + | return false; | ||
| + | } | ||
| + | } | ||
| + | |||
| + | private boolean hasVendorstallAccess(final Login login, final UUID vendorstallId) { | ||
| + | if (login == null) { | ||
| + | return false; | ||
| + | } else if (login.isMSAdmin()) { | ||
| + | return true; | ||
| + | } else { | ||
| + | if (vendorstallId == null) { | ||
| + | return true; | ||
| + | } else { | ||
| + | final Vendorstall vendorstall = vendorstallService.getById(vendorstallId); | ||
| + | if (vendorstall == null) { | ||
| + | return false; | ||
| + | } else { | ||
| + | return hasVendorAccess(login, vendorstall.getVendorId()); | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | private boolean hasVendorstallPlacementAccess(final Login login, final UUID vendorstallPlacementId) { | ||
| + | if (login == null) { | ||
| + | return false; | ||
| + | } else if (login.isMSAdmin()) { | ||
| + | return true; | ||
| + | } else { | ||
| + | if (vendorstallPlacementId == null) { | ||
| + | return true; | ||
| + | } else { | ||
| + | final VendorstallPlacement vendorstallPlacement = vendorstallPlacementService.getById(vendorstallPlacementId); | ||
| + | if (vendorstallPlacement == null) { | ||
| + | return false; | ||
| + | } else { | ||
| + | return hasVendorstallAccess(login, vendorstallPlacement.getVendorstallId()); | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | } | ||
| + | </code> | ||
| ===== (Optional) CSRF - Cross site Request Forgery ===== | ===== (Optional) CSRF - Cross site Request Forgery ===== | ||
| Line 4576: | Line 5032: | ||
| ==== Controller ==== | ==== Controller ==== | ||
| - | <code java>package be.mentoringsystems.abstracts.presentation; | + | <code java CsrfController.java>package be.mentoringsystems.abstracts.presentation; |
| import org.springframework.security.web.csrf.CsrfToken; | import org.springframework.security.web.csrf.CsrfToken; | ||
| Line 4672: | Line 5128: | ||
| Add to pom: | Add to pom: | ||
| - | <code> | + | <code xml> |
| <auth0.jwt>3.4.1</auth0.jwt> | <auth0.jwt>3.4.1</auth0.jwt> | ||
| Line 4686: | Line 5142: | ||
| Helper classes | Helper classes | ||
| - | <code> | + | <code java JWSHelper.java>package be.mentoringsystems.merke.security; |
| - | package be.trustandchain.mobi.security; | + | |
| import com.auth0.jwt.JWT; | import com.auth0.jwt.JWT; | ||
| Line 4726: | Line 5181: | ||
| } | } | ||
| } | } | ||
| - | |||
| </code> | </code> | ||
| - | <code> | + | <code java JWTAuthenticationFilter.java>package be.mentoringsystems.merke.security; |
| - | package be.trustandchain.mobi.security; | + | |
| - | import be.trustandchain.mobi.model.db.Login; | + | import be.mentoringsystems.merke.model.db.Login; |
| - | import be.trustandchain.mobi.service.LoginService; | + | import be.mentoringsystems.merke.service.LoginService; |
| import java.io.IOException; | import java.io.IOException; | ||
| import javax.servlet.Filter; | import javax.servlet.Filter; | ||
| import javax.servlet.FilterChain; | import javax.servlet.FilterChain; | ||
| + | import javax.servlet.FilterConfig; | ||
| import javax.servlet.ServletException; | import javax.servlet.ServletException; | ||
| import javax.servlet.ServletRequest; | import javax.servlet.ServletRequest; | ||
| Line 4792: | Line 5246: | ||
| fc.doFilter(sr, sr1); | fc.doFilter(sr, sr1); | ||
| } | } | ||
| - | } | ||
| + | @Override | ||
| + | public void init(final FilterConfig fc) throws ServletException { | ||
| + | } | ||
| + | |||
| + | @Override | ||
| + | public void destroy() { | ||
| + | } | ||
| + | |||
| + | } | ||
| </code> | </code> | ||
| Add method to loginController: | Add method to loginController: | ||
| - | <code> | + | <code java> |
| @RequestMapping(value = "/authenticate", method = RequestMethod.POST) | @RequestMapping(value = "/authenticate", method = RequestMethod.POST) | ||
| public ApiDTO authenticate(@RequestParam(required = false) final String username, @RequestParam(required = false) final String | public ApiDTO authenticate(@RequestParam(required = false) final String username, @RequestParam(required = false) final String | ||
| Line 4827: | Line 5288: | ||
| Add transient jwt parameter to Login: | Add transient jwt parameter to Login: | ||
| - | + | <code java> | |
| private String jwt; | private String jwt; | ||
| Line 4837: | Line 5298: | ||
| this.jwt = jwt; | this.jwt = jwt; | ||
| } | } | ||
| - | + | </code> | |
| Add method to LoginServiceImpl if it doesn't exist: | Add method to LoginServiceImpl if it doesn't exist: | ||
| - | + | <code java> | |
| @Override | @Override | ||
| @Transactional(readOnly = true) | @Transactional(readOnly = true) | ||
| Line 4854: | Line 5315: | ||
| } | } | ||
| } | } | ||
| - | + | </code> | |
| Add filter to securityConfiguration | Add filter to securityConfiguration | ||
| - | <code> | + | <code java> |
| package be.trustandchain.mobi.config; | package be.trustandchain.mobi.config; | ||
| Line 5019: | Line 5480: | ||
| }</code> | }</code> | ||
| ==== Locale resolver ==== | ==== Locale resolver ==== | ||
| - | <code java>package be.mentoringsystems.paypermail.presentation.locale; | + | <code java CustomLocaleResolver.java>package be.mentoringsystems.merke.presentation.locale; |
| - | import be.mentoringsystems.paypermail.model.db.Login; | + | import be.mentoringsystems.merke.model.db.Login; |
| - | import be.mentoringsystems.paypermail.service.LoginService; | + | import be.mentoringsystems.merke.service.LoginService; |
| import java.util.Locale; | import java.util.Locale; | ||
| import javax.servlet.http.HttpServletRequest; | import javax.servlet.http.HttpServletRequest; | ||
| import org.springframework.beans.factory.annotation.Autowired; | import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.web.servlet.i18n.CookieLocaleResolver; | import org.springframework.web.servlet.i18n.CookieLocaleResolver; | ||
| + | import static org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE_REQUEST_ATTRIBUTE_NAME; | ||
| + | import static org.springframework.web.servlet.i18n.CookieLocaleResolver.TIME_ZONE_REQUEST_ATTRIBUTE_NAME; | ||
| /** | /** | ||
| Line 5036: | Line 5499: | ||
| @Autowired | @Autowired | ||
| private LoginService loginService; | private LoginService loginService; | ||
| - | + | ||
| @Override | @Override | ||
| - | public Locale resolveLocale(HttpServletRequest request) { | + | public Locale resolveLocale(final HttpServletRequest request) { |
| final Login login = loginService.getCurrentLogin(); | final Login login = loginService.getCurrentLogin(); | ||
| - | if(login != null) { | + | if (login != null) { |
| - | final Locale locale = new Locale(login.getLanguage()); // can be any other language parameter on login. | + | final Locale locale = new Locale(login.getLanguage()); |
| request.setAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME, locale); | request.setAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME, locale); | ||
| request.setAttribute(TIME_ZONE_REQUEST_ATTRIBUTE_NAME, determineDefaultTimeZone(request)); | request.setAttribute(TIME_ZONE_REQUEST_ATTRIBUTE_NAME, determineDefaultTimeZone(request)); | ||
| Line 5049: | Line 5512: | ||
| } | } | ||
| } | } | ||
| - | |||
| } | } | ||
| </code> | </code> | ||
| Line 5060: | Line 5522: | ||
| ===== Excel handling ===== | ===== Excel handling ===== | ||
| ==== ExportController ==== | ==== ExportController ==== | ||
| - | <code java>package be.mentoringsystems.merke.presentation; | + | <code java ExportController.java>package be.mentoringsystems.merke.presentation; |
| import be.mentoringsystems.merke.model.QueryParams; | import be.mentoringsystems.merke.model.QueryParams; | ||
| Line 5119: | Line 5581: | ||
| </code> | </code> | ||
| ==== ExcelView ==== | ==== ExcelView ==== | ||
| - | <code java>package be.mentoringsystems.merke.presentation.excel; | + | <code java VendorRequests.java>package be.mentoringsystems.merke.presentation.excel; |
| import be.mentoringsystems.merke.model.db.VendorRequest; | import be.mentoringsystems.merke.model.db.VendorRequest; | ||
| Line 5231: | Line 5693: | ||
| } | } | ||
| }</code> | }</code> | ||
| - | <code java>package be.mentoringsystems.merke.presentation.excel; | + | <code java Vendors.java>package be.mentoringsystems.merke.presentation.excel; |
| import be.mentoringsystems.merke.model.db.Category; | import be.mentoringsystems.merke.model.db.Category; | ||
| Line 5345: | Line 5807: | ||
| </code> | </code> | ||
| ==== ImportController ==== | ==== ImportController ==== | ||
| - | <code java>package be.mentoringsystems.merke.presentation; | + | <code java ImportController.java>package be.mentoringsystems.merke.presentation; |
| import be.mentoringsystems.merke.importer.VendorImporter; | import be.mentoringsystems.merke.importer.VendorImporter; | ||
| Line 5419: | Line 5881: | ||
| </code> | </code> | ||
| ==== Importer Interface ==== | ==== Importer Interface ==== | ||
| - | <code java>package be.mentoringsystems.merke.importer; | + | <code java VendorImporter.java>package be.mentoringsystems.merke.importer; |
| import java.io.File; | import java.io.File; | ||
| Line 5429: | Line 5891: | ||
| */ | */ | ||
| public interface VendorImporter { | public interface VendorImporter { | ||
| + | |||
| void importFile(final File file, final UUID fileId); | void importFile(final File file, final UUID fileId); | ||
| } | } | ||
| Line 5436: | Line 5899: | ||
| ''values'' is used to import instead of ''result''. Usually importing would be done with the ''result'' map (since it has the column names).\\ In this case the format of imported files varied a lot. | ''values'' is used to import instead of ''result''. Usually importing would be done with the ''result'' map (since it has the column names).\\ In this case the format of imported files varied a lot. | ||
| - | <code java>package be.mentoringsystems.merke.importer.excel; | + | <code java VendorImporterImpl.java>package be.mentoringsystems.merke.importer.excel; |
| import be.mentoringsystems.merke.importer.VendorImporter; | import be.mentoringsystems.merke.importer.VendorImporter; | ||
| Line 5694: | Line 6157: | ||
| Add ''log4j2.json'' to ''/WEB-INF/'' \\ | Add ''log4j2.json'' to ''/WEB-INF/'' \\ | ||
| - | <code javascript> | + | <code javascript log4j2.json> |
| { | { | ||
| "configuration": { | "configuration": { | ||
| Line 5725: | Line 6188: | ||
| ====== JSP Pages ====== | ====== JSP Pages ====== | ||
| ===== Login ===== | ===== Login ===== | ||
| - | <code html><%@page contentType="text/html" pageEncoding="UTF-8"%> | + | <code html Login.jsp><%@page contentType="text/html" pageEncoding="UTF-8"%> |
| <!DOCTYPE html> | <!DOCTYPE html> | ||
| <html> | <html> | ||
| Line 5824: | Line 6287: | ||
| this should be the index.html of your extjs application (slighly modified like :) | this should be the index.html of your extjs application (slighly modified like :) | ||
| - | <code html><!DOCTYPE HTML> | + | <code html index.jsp><!DOCTYPE HTML> |
| <html manifest="cache.appcache"> | <html manifest="cache.appcache"> | ||
| <head> | <head> | ||
| Line 5901: | Line 6364: | ||
| simply place the resource in ''/static/'' or any subfolder there | simply place the resource in ''/static/'' or any subfolder there | ||
| - | ====== EXT JS 6 ====== | + | ====== EXT JS 7 ====== |
| ===== A new App ===== | ===== A new App ===== | ||