[rhq] Branch 'release/jon3.1.x' - modules/enterprise

lkrejci lkrejci at fedoraproject.org
Wed Aug 8 11:49:21 UTC 2012


 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java      |   18 ++++++++-
 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java     |   19 ++++++++++
 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java        |    5 +-
 modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java |    4 +-
 4 files changed, 39 insertions(+), 7 deletions(-)

New commits:
commit 97f5db48e4570c3cf8ee516de5bda7aff31c59a9
Author: Lukas Krejci <lkrejci at redhat.com>
Date:   Wed Aug 8 13:41:26 2012 +0200

    [BZ 846623] - When creating the "child" alert definitions of group or template alert definitions, pass the real user that creates the alert def and circumvent authz.
    This behaves exactly the same as before but instead of bypassing the authz by passing the overlord when creating the child alert,
    a new local SLSB method is used that doesn't perform the authz checks and can therefore receive the original user that request the creation of the group/template
    alert def.
    
    This is good for the CLI alert sender that, when creating an alert script to be run as "myself", checks if the user creating the alert def is the same as the one set
    to run it.
    (cherry picked from commit 581324eeb3d32f4d8879d4749423fbde0f76de8c)

diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java
index 79fca41..1bcd585 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerBean.java
@@ -196,9 +196,23 @@ public class AlertDefinitionManagerBean implements AlertDefinitionManagerLocal,
         return results;
     }
 
+    @Override
+    @TransactionAttribute(TransactionAttributeType.REQUIRES_NEW)
+    public int createDependentAlertDefinition(Subject subject, AlertDefinition alertDefinition, int resourceId)
+        throws InvalidAlertDefinitionException {
+        
+        return createAlertDefinitionInternal(subject, alertDefinition, resourceId, false);
+    }
+
+    @Override
     @TransactionAttribute(TransactionAttributeType.REQUIRES_NEW)
     public int createAlertDefinition(Subject subject, AlertDefinition alertDefinition, Integer resourceId)
         throws InvalidAlertDefinitionException {
+        
+        return createAlertDefinitionInternal(subject, alertDefinition, resourceId, true);
+    }
+
+    private int createAlertDefinitionInternal(Subject subject, AlertDefinition alertDefinition, Integer resourceId, boolean checkPerms) throws InvalidAlertDefinitionException {
         checkAlertDefinition(subject, alertDefinition, resourceId);
 
         // if this is an alert definition, set up the link to a resource
@@ -212,7 +226,7 @@ public class AlertDefinitionManagerBean implements AlertDefinitionManagerLocal,
         }
 
         // after the resource is set up (in the case of non-templates), we can use the checkPermission on it
-        if (checkPermission(subject, alertDefinition) == false) {
+        if (checkPerms && checkPermission(subject, alertDefinition) == false) {
             if (alertDefinition.getResourceType() != null) {
                 throw new PermissionException("User [" + subject.getName()
                     + "] does not have permission to create alert templates for type ["
@@ -265,7 +279,7 @@ public class AlertDefinitionManagerBean implements AlertDefinitionManagerLocal,
 
         return alertDefinition.getId();
     }
-
+    
     private void fixRecoveryId(AlertDefinition definition) {
         try {
             if (definition.getParentId() != 0 && definition.getRecoveryId() != 0) {
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java
index 03c8945..45b7252 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertDefinitionManagerLocal.java
@@ -48,6 +48,25 @@ public interface AlertDefinitionManagerLocal {
     int createAlertDefinition(Subject subject, AlertDefinition alertDefinition, Integer resourceId)
         throws InvalidAlertDefinitionException;
 
+    /**
+     * This is exactly the same as {@link #createAlertDefinition(Subject, AlertDefinition, Integer)} but
+     * assumes the resource is part of a group (or has given resource type for templates) for which 
+     * a group or template alert definition is being created.
+     * <p>
+     * This method assumes the caller already checked the subject has permissions to create a group or template alert
+     * definition on a group / resource type the resource is member of.
+     * <p>
+     * In another words this method is a helper to 
+     * {@link GroupAlertDefinitionManagerLocal#createGroupAlertDefinitions(Subject, AlertDefinition, Integer)} and
+     * {@link AlertTemplateManagerLocal#createAlertTemplate(Subject, AlertDefinition, Integer)}.
+     * 
+     * @param subject the user that is creating the group or template alert definition
+     * @param alertDefinition the alert definition on the resource
+     * @param resourceId the resource
+     * @return the id of the newly created alert definition
+     */
+    int createDependentAlertDefinition(Subject subject, AlertDefinition alertDefinition, int resourceId);
+    
     boolean isEnabled(Integer definitionId);
 
     boolean isTemplate(Integer definitionId);
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java
index 94f1d35..ff00dd6 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/AlertTemplateManagerBean.java
@@ -128,7 +128,6 @@ public class AlertTemplateManagerBean implements AlertTemplateManagerLocal {
                 + alertTemplate.toSimpleString(), t);
         }
 
-        Subject overlord = subjectManager.getOverlord();
         Throwable firstThrowable = null;
 
         List<Integer> resourceIdsForType = getCommittedResourceIdsNeedingTemplateApplication(user, alertTemplateId,
@@ -140,8 +139,8 @@ public class AlertTemplateManagerBean implements AlertTemplateManagerLocal {
                 AlertDefinition childAlertDefinition = new AlertDefinition(alertTemplate);
                 childAlertDefinition.setParentId(alertTemplate.getId());
 
-                // persist the child using overlord
-                alertDefinitionManager.createAlertDefinition(overlord, childAlertDefinition, resourceId);
+                // persist the child as a dependent alert definition
+                alertDefinitionManager.createDependentAlertDefinition(user, childAlertDefinition, resourceId);
             } catch (Throwable t) {
                 // continue on error, create as many as possible
                 if (firstThrowable == null) {
diff --git a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java
index 8974c30..7df0c67 100644
--- a/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java
+++ b/modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/alert/GroupAlertDefinitionManagerBean.java
@@ -137,6 +137,7 @@ public class GroupAlertDefinitionManagerBean implements GroupAlertDefinitionMana
         return list;
     }
 
+    @Override
     @TransactionAttribute(TransactionAttributeType.NOT_SUPPORTED)
     public int createGroupAlertDefinitions(Subject subject, AlertDefinition groupAlertDefinition,
         Integer resourceGroupId) throws InvalidAlertDefinitionException, AlertDefinitionCreationException {
@@ -151,7 +152,6 @@ public class GroupAlertDefinitionManagerBean implements GroupAlertDefinitionMana
                 + " with data " + groupAlertDefinition.toSimpleString(), t);
         }
 
-        Subject overlord = subjectManager.getOverlord();
         Throwable firstThrowable = null;
 
         List<Integer> resourceIdsForGroup = getCommittedResourceIdsNeedingGroupAlertDefinitionApplication(subject,
@@ -164,7 +164,7 @@ public class GroupAlertDefinitionManagerBean implements GroupAlertDefinitionMana
                 childAlertDefinition.setGroupAlertDefinition(groupAlertDefinition);
 
                 // persist the child
-                alertDefinitionManager.createAlertDefinition(overlord, childAlertDefinition, resourceId);
+                alertDefinitionManager.createDependentAlertDefinition(subject, childAlertDefinition, resourceId);
             } catch (Throwable t) {
                 // continue on error, create as many as possible
                 if (firstThrowable == null) {




More information about the rhq-commits mailing list