java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java | 46 +++++++++-
1 file changed, 42 insertions(+), 4 deletions(-)
New commits:
commit 2588078268d806a98a6d3fe8d54e9e110efb3e3a
Author: Tomas Kasparek <tkasparek(a)redhat.com>
Date: Tue Jul 31 15:59:05 2012 +0200
838618 - Allowing some API calls to be called from another organizations
Allowing errata.getDetails and errata.listPackages to be called if the errata is
reachable via any shared channel from organizanion that does not own the errata.
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
index 9a90b32..efd756a 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
@@ -217,7 +217,7 @@ public class ErrataHandler extends BaseHandler {
// just want to make sure the caller is logged in.
User loggedInUser = getLoggedInUser(sessionKey);
- Errata errata = lookupErrata(advisoryName, loggedInUser.getOrg());
+ Errata errata = lookupErrataReadOnly(advisoryName, loggedInUser.getOrg());
Map errataMap = new HashMap();
@@ -700,7 +700,7 @@ public class ErrataHandler extends BaseHandler {
throws FaultException {
// Get the logged in user
User loggedInUser = getLoggedInUser(sessionKey);
- Errata errata = lookupErrata(advisoryName, loggedInUser.getOrg());
+ Errata errata = lookupErrataReadOnly(advisoryName, loggedInUser.getOrg());
List<Map> toRet = new ArrayList<Map>();
for (PackageDto dto : PackageManager.listPackageDtosForErrata(errata)) {
@@ -846,14 +846,52 @@ public class ErrataHandler extends BaseHandler {
* need to make sure here that everything is checked correclty
*/
if (errata.getOrg() != null && !errata.getOrg().equals(org)) {
- throw new FaultException(-209, "no_such_errata",
- "The errata " + advisoryName + " cannot be
found.");
+ throw new FaultException(-209, "no_rights_to_access",
+ "You don't have rights to access " + advisoryName +
" errata.");
}
return errata;
}
/**
+ * Private helper method to lookup an errata and throw a Fault exception if it
isn't
+ * found
+ * @param advisoryName The advisory name for the erratum you're looking for
+ * @return Returns the errata or a Fault Exception
+ * @throws FaultException Occurs when the erratum is not found
+ */
+ private Errata lookupErrataReadOnly(String advisoryName, Org org)
+ throws FaultException {
+ Errata errata = ErrataManager.lookupByAdvisory(advisoryName);
+
+ /*
+ * ErrataManager.lookupByAdvisory() could return null, so we need to check
+ * and throw a no_such_errata exception if the errata was not found.
+ */
+ if (errata == null) {
+ throw new FaultException(-208, "no_such_errata",
+ "The errata " + advisoryName + " cannot be
found.");
+ }
+ /**
+ * errata with org_id of null are public, but ones with an org id of !null are
not
+ * need to make sure here that everything is checked correclty
+ */
+
+ if (errata.getOrg() == null || errata.getOrg().equals(org)) {
+ return errata;
+ }
+ Set<Channel> errataChannels = errata.getChannels();
+ List orgChannels = org.getAccessibleChannels();
+ for (Channel channel : errataChannels) {
+ if (orgChannels.contains(channel)) {
+ return errata;
+ }
+ }
+ throw new FaultException(-209, "no_rights_to_access",
+ "You don't have rights to access " + advisoryName + "
errata.");
+ }
+
+ /**
* Clones a list of errata into a specified channel
*
* @param sessionKey The sessionKey containing the logged in user