[rhq] modules/enterprise

lkrejci lkrejci at fedoraproject.org
Wed Aug 8 11:42:59 UTC 2012


 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java      |   18 ++++++++-
 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java     |   19 ++++++++++
 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java        |    5 +-
 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java |    4 +-
 4 files changed, 39 insertions(+), 7 deletions(-)

New commits:
commit 581324eeb3d32f4d8879d4749423fbde0f76de8c
Author: Lukas Krejci <lkrejci at redhat.com>
Date:   Wed Aug 8 13:41:26 2012 +0200

    [BZ 846623] - When creating the "child" alert definitions of group or template alert definitions, pass the real user that creates the alert def and circumvent authz.
    This behaves exactly the same as before but instead of bypassing the authz by passing the overlord when creating the child alert,
    a new local SLSB method is used that doesn't perform the authz checks and can therefore receive the original user that request the creation of the group/template
    alert def.
    
    This is good for the CLI alert sender that, when creating an alert script to be run as "myself", checks if the user creating the alert def is the same as the one set
    to run it.

diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java
index c4fdcda..927ae74 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java
@@ -196,9 +196,23 @@ public class AlertDefinitionManagerBean implements AlertDefinitionManagerLocal,
         return results;
     }
 
+    @Override
+    @TransactionAttribute(TransactionAttributeType.REQUIRES_NEW)
+    public int createDependentAlertDefinition(Subject subject, AlertDefinition alertDefinition, int resourceId)
+        throws InvalidAlertDefinitionException {
+        
+        return createAlertDefinitionInternal(subject, alertDefinition, resourceId, false);
+    }
+
+    @Override
     @TransactionAttribute(TransactionAttributeType.REQUIRES_NEW)
     public int createAlertDefinition(Subject subject, AlertDefinition alertDefinition, Integer resourceId)
         throws InvalidAlertDefinitionException {
+        
+        return createAlertDefinitionInternal(subject, alertDefinition, resourceId, true);
+    }
+
+    private int createAlertDefinitionInternal(Subject subject, AlertDefinition alertDefinition, Integer resourceId, boolean checkPerms) throws InvalidAlertDefinitionException {
         checkAlertDefinition(subject, alertDefinition, resourceId);
 
         // if this is an alert definition, set up the link to a resource
@@ -212,7 +226,7 @@ public class AlertDefinitionManagerBean implements AlertDefinitionManagerLocal,
         }
 
         // after the resource is set up (in the case of non-templates), we can use the checkPermission on it
-        if (checkPermission(subject, alertDefinition) == false) {
+        if (checkPerms && checkPermission(subject, alertDefinition) == false) {
             if (alertDefinition.getResourceType() != null) {
                 throw new PermissionException("User [" + subject.getName()
                     + "] does not have permission to create alert templates for type ["
@@ -265,7 +279,7 @@ public class AlertDefinitionManagerBean implements AlertDefinitionManagerLocal,
 
         return alertDefinition.getId();
     }
-
+    
     private void fixRecoveryId(AlertDefinition definition) {
         try {
             if (definition.getParentId() != 0 && definition.getRecoveryId() != 0) {
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java
index d663198..81f0ac0 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java
@@ -48,6 +48,25 @@ public interface AlertDefinitionManagerLocal {
     int createAlertDefinition(Subject subject, AlertDefinition alertDefinition, Integer resourceId)
         throws InvalidAlertDefinitionException;
 
+    /**
+     * This is exactly the same as {@link #createAlertDefinition(Subject, AlertDefinition, Integer)} but
+     * assumes the resource is part of a group (or has given resource type for templates) for which 
+     * a group or template alert definition is being created.
+     * <p>
+     * This method assumes the caller already checked the subject has permissions to create a group or template alert
+     * definition on a group / resource type the resource is member of.
+     * <p>
+     * In another words this method is a helper to 
+     * {@link GroupAlertDefinitionManagerLocal#createGroupAlertDefinitions(Subject, AlertDefinition, Integer)} and
+     * {@link AlertTemplateManagerLocal#createAlertTemplate(Subject, AlertDefinition, Integer)}.
+     * 
+     * @param subject the user that is creating the group or template alert definition
+     * @param alertDefinition the alert definition on the resource
+     * @param resourceId the resource
+     * @return the id of the newly created alert definition
+     */
+    int createDependentAlertDefinition(Subject subject, AlertDefinition alertDefinition, int resourceId);
+    
     boolean isEnabled(Integer definitionId);
 
     boolean isTemplate(Integer definitionId);
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java
index 5b4ad77..cda1e0f 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java
@@ -128,7 +128,6 @@ public class AlertTemplateManagerBean implements AlertTemplateManagerLocal {
                 + alertTemplate.toSimpleString(), t);
         }
 
-        Subject overlord = subjectManager.getOverlord();
         Throwable firstThrowable = null;
 
         List<Integer> resourceIdsForType = getCommittedResourceIdsNeedingTemplateApplication(user, alertTemplateId,
@@ -140,8 +139,8 @@ public class AlertTemplateManagerBean implements AlertTemplateManagerLocal {
                 AlertDefinition childAlertDefinition = new AlertDefinition(alertTemplate);
                 childAlertDefinition.setParentId(alertTemplate.getId());
 
-                // persist the child using overlord
-                alertDefinitionManager.createAlertDefinition(overlord, childAlertDefinition, resourceId);
+                // persist the child as a dependent alert definition
+                alertDefinitionManager.createDependentAlertDefinition(user, childAlertDefinition, resourceId);
             } catch (Throwable t) {
                 // continue on error, create as many as possible
                 if (firstThrowable == null) {
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java
index cde2f04..6df9ae0 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java
@@ -137,6 +137,7 @@ public class GroupAlertDefinitionManagerBean implements GroupAlertDefinitionMana
         return list;
     }
 
+    @Override
     @TransactionAttribute(TransactionAttributeType.NOT_SUPPORTED)
     public int createGroupAlertDefinitions(Subject subject, AlertDefinition groupAlertDefinition,
         Integer resourceGroupId) throws InvalidAlertDefinitionException, AlertDefinitionCreationException {
@@ -151,7 +152,6 @@ public class GroupAlertDefinitionManagerBean implements GroupAlertDefinitionMana
                 + " with data " + groupAlertDefinition.toSimpleString(), t);
         }
 
-        Subject overlord = subjectManager.getOverlord();
         Throwable firstThrowable = null;
 
         List<Integer> resourceIdsForGroup = getCommittedResourceIdsNeedingGroupAlertDefinitionApplication(subject,
@@ -164,7 +164,7 @@ public class GroupAlertDefinitionManagerBean implements GroupAlertDefinitionMana
                 childAlertDefinition.setGroupAlertDefinition(groupAlertDefinition);
 
                 // persist the child
-                alertDefinitionManager.createAlertDefinition(overlord, childAlertDefinition, resourceId);
+                alertDefinitionManager.createDependentAlertDefinition(subject, childAlertDefinition, resourceId);
             } catch (Throwable t) {
                 // continue on error, create as many as possible
                 if (firstThrowable == null) {




More information about the rhq-commits mailing list