Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2025-11-12 16:35:45 +01:00
Code Issues Packages Projects Releases Activity

only map authorizationException to forbidden if user is not _anonymous

Browse Source
This commit is contained in:
Eduard Heimbuch
2019-10-14 10:18:26 +02:00
parent 1d79ed86ea
commit eb684a3b1d
1 changed files with 17 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
scm-webapp/src/main/java/sonia/scm/api/rest/AuthorizationExceptionMapper.java
View File

@@ -33,15 +33,19 @@ package sonia.scm.api.rest;
//~--- non-JDK imports --------------------------------------------------------
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authz.AuthorizationException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import sonia.scm.SCMContext;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.ext.ExceptionMapper;
import javax.ws.rs.ext.Provider;
//~--- JDK imports ------------------------------------------------------------
import javax.ws.rs.core.Response;
import javax.ws.rs.ext.Provider;
/**
*
* @author Sebastian Sdorra
@@ -49,20 +53,22 @@ import javax.ws.rs.ext.Provider;
*/
@Provider
public class AuthorizationExceptionMapper
extends StatusExceptionMapper<AuthorizationException>
implements ExceptionMapper<AuthorizationException>
{
private static final Logger LOG = LoggerFactory.getLogger(AuthorizationExceptionMapper.class);
public AuthorizationExceptionMapper()
{
super(AuthorizationException.class, Response.Status.FORBIDDEN);
}
@Override
public Response toResponse(AuthorizationException exception) {
LOG.info("user is missing permission: {}", exception.getMessage());
LOG.trace("AuthorizationException:", exception);
return super.toResponse(exception);
LOG.trace(getStatus().toString(), exception);
return Response.status(getStatus())
.entity(exception.getMessage())
.type(MediaType.TEXT_PLAIN_TYPE)
.build();
}
private Response.Status getStatus() {
return SecurityUtils.getSubject().getPrincipal().equals(SCMContext.USER_ANONYMOUS) ? Response.Status.UNAUTHORIZED : Response.Status.FORBIDDEN;
}
}