vmario/wisemapping-open-source
1
0
Fork 0
mirror of https://bitbucket.org/wisemapping/wisemapping-open-source.git synced 2024-11-24 23:17:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

Improve error handle on security errors.

Browse Source
This commit is contained in:
Paulo Gustavo Veiga 2022-03-15 10:30:18 -03:00
parent 4cab5299c4
commit a9d091a187
6 changed files with 64 additions and 107 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
wise-webapp/src/main/java/com/wisemapping/exceptions/AccessDeniedSecurityException.java
View File

@ -18,18 +18,22 @@
package com.wisemapping.exceptions;
import com.wisemapping.model.Collaborator;
import com.wisemapping.model.User;
import org.jetbrains.annotations.NotNull;
public class AccessDeniedSecurityException
extends ClientException
{
extends ClientException {
public static final String MSG_KEY = "ACCESS_HAS_BEEN_REVOKED";
public AccessDeniedSecurityException(@NotNull String msg)
{
public AccessDeniedSecurityException(@NotNull String msg) {
super(msg, Severity.FATAL);
}
public AccessDeniedSecurityException(@NotNull long mapId, Collaborator user) {
super("No enough permissions to access map. Id: " + mapId + ", User: " + user, Severity.FATAL);
}
@NotNull
@Override
protected String getMsgBundleKey() {

43
wise-webapp/src/main/java/com/wisemapping/mail/NotifyingExceptionResolver.java
View File

@ -1,43 +0,0 @@
package com.wisemapping.mail;
import com.wisemapping.model.User;
import com.wisemapping.security.Utils;
import org.apache.log4j.Logger;
import org.jetbrains.annotations.NotNull;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.handler.SimpleMappingExceptionResolver;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.HashSet;
import java.util.Set;
public class NotifyingExceptionResolver extends SimpleMappingExceptionResolver {
final private Logger logger = Logger.getLogger(NotifyingExceptionResolver.class);
private Set<String> exclude = new HashSet<String>();
private NotificationService notificationService;
@Override
protected ModelAndView doResolveException(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) {
if (!exclude.contains(ex.getClass().getName())) {
logger.error("An Exception has occurred in the application", ex);
sendNotification(ex, request);
}
return super.doResolveException(request, response, handler, ex);
}
private void sendNotification(@NotNull Exception ex, @NotNull HttpServletRequest request) {
final User user = Utils.getUser(false);
notificationService.reportJavaException(ex, user, request);
}
public void setExclude(final Set<String> exclude) {
this.exclude = exclude;
}
public void setNotificationService(NotificationService notificationService) {
this.notificationService = notificationService;
}
}

2
wise-webapp/src/main/java/com/wisemapping/rest/MindmapController.java
View File

@ -250,7 +250,7 @@ public class MindmapController extends BaseController {
// Has enough permissions ?
final User user = Utils.getUser();
if (!mindmapService.hasPermissions(user, id, CollaborationRole.VIEWER)) {
throw new AccessDeniedSecurityException("No enough permissions to open map. Id:" + id);
throw new AccessDeniedSecurityException(id, user);
}
// Does the map exists ?

4
wise-webapp/src/main/java/com/wisemapping/service/LockManagerImpl.java
View File

@ -97,7 +97,7 @@ class LockManagerImpl implements LockManager {
}
if (!mindmap.hasPermissions(user, CollaborationRole.EDITOR)) {
throw new AccessDeniedSecurityException("Invalid lock, this should not happen");
throw new AccessDeniedSecurityException(mindmap.getId(), user);
}
this.unlock(mindmap.getId());
@ -132,7 +132,7 @@ class LockManagerImpl implements LockManager {
}
if (!mindmap.hasPermissions(user, CollaborationRole.EDITOR)) {
throw new AccessDeniedSecurityException("Invalid lock, this should not happen");
throw new AccessDeniedSecurityException(mindmap.getId(), user);
}
LockInfo result = lockInfoByMapId.get(mindmap.getId());

2
wise-webapp/src/main/java/com/wisemapping/webmvc/MindmapController.java
View File

@ -176,7 +176,7 @@ public class MindmapController {
private MindMapBean findMindmapBean(int mapId) throws MapCouldNotFoundException, AccessDeniedSecurityException {
final User user = Utils.getUser();
if (!mindmapService.hasPermissions(user, mapId, CollaborationRole.VIEWER)) {
throw new AccessDeniedSecurityException("No enough permissions to open map with id " + mapId);
throw new AccessDeniedSecurityException(mapId, user);
}
final Mindmap mindmap = findMindmap(mapId);

18
wise-webapp/src/main/webapp/WEB-INF/wisemapping-servlet.xml
View File

@ -22,29 +22,25 @@
<bean id="requestInterceptor" class="com.wisemapping.filter.RequestPropertiesInterceptor"/>
</mvc:interceptors>
<bean id="exceptionHandlerResolver"
class="com.wisemapping.mail.NotifyingExceptionResolver">
<bean id="simpleMappingExceptionResolver"
class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
<property name="defaultStatusCode" value="500"/>
<property name="defaultErrorView" value="unexpectedError"/>
<property name="warnLogCategory" value="com.wisemapping.mvc.Exceptions"/>
<property name="exceptionMappings">
<props>
<!-- Security exceptions are wrapped in this exceptions -->
<!-- Security access exceptions must not handled as unexpected errors -->
<prop key="com.wisemapping.exceptions.MapNonPublicException">securityError</prop>
<prop key="com.wisemapping.exceptions.AccessDeniedSecurityException">securityError</prop>
</props>
</property>
<property name="statusCodes">
<props>
<prop key="securityError">404</prop>
<prop key="securityError">403</prop>
</props>
</property>
<property name="exclude">
<set>
<value>java.lang.reflect.UndeclaredThrowableException</value>
</set>
</property>
<property name="notificationService" ref="notificationService"/>
</bean>
<bean id="viewResolver" class="org.springframework.web.servlet.view.UrlBasedViewResolver">