From 2bfb8ab137ac18b60cad0c375c7b9bef67499b94 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Tue, 23 Oct 2012 17:35:42 -0400
Subject: [PATCH] Enforce strict order for permission determination
---
src/com/gitblit/models/UserModel.java | 22 +++++++++++++---------
1 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/src/com/gitblit/models/UserModel.java b/src/com/gitblit/models/UserModel.java
index 6cc0778..d7bc293 100644
--- a/src/com/gitblit/models/UserModel.java
+++ b/src/com/gitblit/models/UserModel.java
@@ -19,8 +19,8 @@
import java.security.Principal;
import java.util.ArrayList;
import java.util.Collections;
-import java.util.HashMap;
import java.util.HashSet;
+import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
@@ -60,7 +60,7 @@
// retained for backwards-compatibility with RPC clients
@Deprecated
public final Set<String> repositories = new HashSet<String>();
- public final Map<String, AccessPermission> permissions = new HashMap<String, AccessPermission>();
+ public final Map<String, AccessPermission> permissions = new LinkedHashMap<String, AccessPermission>();
public final Set<TeamModel> teams = new HashSet<TeamModel>();
// non-persisted fields
@@ -217,8 +217,8 @@
return AccessPermission.REWIND;
}
- // determine best permission available based on user's personal permissions
- // and the permissions of teams of which the user belongs
+ // explicit user permission OR user regex match is used
+ // if that fails, then the best team permission is used
AccessPermission permission = AccessPermission.NONE;
if (permissions.containsKey(repository.name.toLowerCase())) {
// exact repository permission specified, use it
@@ -232,17 +232,21 @@
if (StringUtils.matchesIgnoreCase(repository.name, key)) {
AccessPermission p = permissions.get(key);
if (p != null) {
+ // take first match
permission = p;
+ break;
}
}
}
}
- for (TeamModel team : teams) {
- AccessPermission p = team.getRepositoryPermission(repository);
- if (permission == null || p.exceeds(permission)) {
- // use team permission
- permission = p;
+ if (AccessPermission.NONE.equals(permission)) {
+ for (TeamModel team : teams) {
+ AccessPermission p = team.getRepositoryPermission(repository);
+ if (p.exceeds(permission)) {
+ // use highest team permission
+ permission = p;
+ }
}
}
return permission;
--
Gitblit v1.9.1