fix permission check

widgets and views
justeene · May 23, 2019 · e24373f · e24373f
1 parent be40398
commit e24373f
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 5 deletions.
diff --git a/.gitignore b/.gitignore
@@ -32,5 +32,4 @@ userfiles/
 .vscode
 *yarn.lock
 bin/upgrade.go
-davinci-ui/
 bin/upgrade/
diff --git a/server/src/main/java/edp/davinci/service/impl/ViewServiceImpl.java b/server/src/main/java/edp/davinci/service/impl/ViewServiceImpl.java
@@ -142,7 +142,9 @@ public List<ViewBaseInfo> getViews(Long projectId, User user) throws NotFoundExc
 
         if (null != views) {
             ProjectPermission projectPermission = projectService.getProjectPermission(projectDetail, user);
-            if (projectPermission.getViewPermission() == UserPermissionEnum.HIDDEN.getPermission()) {
+            if (projectPermission.getVizPermission() == UserPermissionEnum.HIDDEN.getPermission() &&
+                    projectPermission.getWidgetPermission() == UserPermissionEnum.HIDDEN.getPermission() &&
+                    projectPermission.getViewPermission() == UserPermissionEnum.HIDDEN.getPermission()) {
                 return null;
             }
         }
@@ -159,8 +161,10 @@ public ViewWithSourceBaseInfo getView(Long id, User user) throws NotFoundExcepti
 
         ProjectDetail projectDetail = projectService.getProjectDetail(view.getProjectId(), user, false);
         ProjectPermission projectPermission = projectService.getProjectPermission(projectDetail, user);
-        if (projectPermission.getViewPermission() == UserPermissionEnum.HIDDEN.getPermission()) {
-            throw new NotFoundException("Insufficient permissions");
+        if (projectPermission.getVizPermission() == UserPermissionEnum.HIDDEN.getPermission() &&
+                projectPermission.getWidgetPermission() == UserPermissionEnum.HIDDEN.getPermission() &&
+                projectPermission.getViewPermission() == UserPermissionEnum.HIDDEN.getPermission()) {
+            throw new UnAuthorizedExecption("Insufficient permissions");
         }
 
         List<RelRoleView> relRoleViews = relRoleViewMapper.getByView(view.getId());

diff --git a/server/src/main/java/edp/davinci/service/impl/WidgetServiceImpl.java b/server/src/main/java/edp/davinci/service/impl/WidgetServiceImpl.java
@@ -138,7 +138,8 @@ public List<Widget> getWidgets(Long projectId, User user) throws NotFoundExcepti
 
         if (null != widgets) {
             ProjectPermission projectPermission = projectService.getProjectPermission(projectDetail, user);
-            if (projectPermission.getWidgetPermission() == UserPermissionEnum.HIDDEN.getPermission()) {
+            if (projectPermission.getVizPermission() == UserPermissionEnum.HIDDEN.getPermission() &&
+                    projectPermission.getWidgetPermission() == UserPermissionEnum.HIDDEN.getPermission()) {
                 return null;
             }
         }