diff --git a/app/src/main/java/org/apache/roller/weblogger/business/BookmarkManager.java b/app/src/main/java/org/apache/roller/weblogger/business/BookmarkManager.java index e3cddf21bd..eef43d2c32 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/BookmarkManager.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/BookmarkManager.java @@ -63,8 +63,21 @@ public interface BookmarkManager { * @throws WebloggerException If there is a problem. */ WeblogBookmarkFolder getFolder(String id) throws WebloggerException; - - + + /** + * Get a folder by id, restricted to the given weblog. + * + *

Named differently from {@link #getFolder(Weblog, String)}, which + * looks a folder up by name, because the two would otherwise have the + * same erasure. + * + * @return the folder, or null if no folder with that id belongs to the + * given weblog. A folder that exists but belongs to another weblog + * is reported the same way as one that does not exist. + */ + WeblogBookmarkFolder getFolderById(Weblog weblog, String id) throws WebloggerException; + + /** * Get all folders for a weblog. * @@ -123,8 +136,18 @@ WeblogBookmarkFolder getFolder(Weblog weblog, String name) * @throws WebloggerException If there is a problem. */ WeblogBookmark getBookmark(String id) throws WebloggerException; - - + + /** + * Get a bookmark by id, restricted to the given weblog. + * + * @return the bookmark, or null if no bookmark with that id belongs to a + * folder of the given weblog. A bookmark that exists but belongs + * to another weblog is reported the same way as one that does not + * exist. + */ + WeblogBookmark getBookmark(Weblog weblog, String id) throws WebloggerException; + + /** * Lookup all Bookmarks in a folder, optionally search recursively. * diff --git a/app/src/main/java/org/apache/roller/weblogger/business/MediaFileManager.java b/app/src/main/java/org/apache/roller/weblogger/business/MediaFileManager.java index e345dddfad..f8a3611328 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/MediaFileManager.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/MediaFileManager.java @@ -76,6 +76,15 @@ void updateMediaFile(Weblog website, MediaFile mf, InputStream fis) */ MediaFile getMediaFile(String id) throws WebloggerException; + /** + * Get media file metadata by file id, restricted to the given weblog. + * + * @return the media file, or null if no media file with that id belongs to + * the given weblog. A media file that exists but belongs to another + * weblog is reported the same way as one that does not exist. + */ + MediaFile getMediaFile(Weblog weblog, String id) throws WebloggerException; + /** * Get media file metadata optionally including the actual content */ @@ -118,6 +127,16 @@ MediaFileDirectory createMediaFileDirectory(Weblog weblog, MediaFileDirectory getMediaFileDirectory(String id) throws WebloggerException; + /** + * Get media file directory by id, restricted to the given weblog. + * + * @return the directory, or null if no directory with that id belongs to + * the given weblog. A directory that exists but belongs to another + * weblog is reported the same way as one that does not exist. + */ + MediaFileDirectory getMediaFileDirectory(Weblog weblog, String id) + throws WebloggerException; + /** * Get media file directory by its path */ diff --git a/app/src/main/java/org/apache/roller/weblogger/business/WeblogEntryManager.java b/app/src/main/java/org/apache/roller/weblogger/business/WeblogEntryManager.java index ca95a0dc89..3ed56d16b6 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/WeblogEntryManager.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/WeblogEntryManager.java @@ -53,9 +53,18 @@ public interface WeblogEntryManager { * Get weblog entry by id. */ WeblogEntry getWeblogEntry(String id) throws WebloggerException; - - /** - * Get weblog entry by anchor. + + /** + * Get weblog entry by id, restricted to the given weblog. + * + * @return the entry, or null if no entry with that id belongs to the given + * weblog. An entry that exists but belongs to another weblog is + * reported the same way as one that does not exist. + */ + WeblogEntry getWeblogEntry(Weblog weblog, String id) throws WebloggerException; + + /** + * Get weblog entry by anchor. */ WeblogEntry getWeblogEntryByAnchor(Weblog website, String anchor) throws WebloggerException; @@ -154,8 +163,17 @@ void removeWeblogEntryAttribute(String name,WeblogEntry entry) * Get category by id. */ WeblogCategory getWeblogCategory(String id) throws WebloggerException; - - + + /** + * Get category by id, restricted to the given weblog. + * + * @return the category, or null if no category with that id belongs to the + * given weblog. A category that exists but belongs to another + * weblog is reported the same way as one that does not exist. + */ + WeblogCategory getWeblogCategory(Weblog weblog, String id) throws WebloggerException; + + /** * Recategorize all entries with one category to another. */ @@ -190,7 +208,18 @@ List getWeblogCategories(Weblog website) * Get comment by id. */ WeblogEntryComment getComment(String id) throws WebloggerException; - + + /** + * Get comment by id, restricted to the given weblog. + * + * @return the comment, or null if no comment with that id belongs to an + * entry of the given weblog. A comment that exists but belongs to + * another weblog is reported the same way as one that does not + * exist. + */ + WeblogEntryComment getComment(Weblog weblog, String id) throws WebloggerException; + + /** * Generic comments query method. * @param csc CommentSearchCriteria object with fields indicating search criteria diff --git a/app/src/main/java/org/apache/roller/weblogger/business/WeblogManager.java b/app/src/main/java/org/apache/roller/weblogger/business/WeblogManager.java index 1df391a7c6..2b65f371ba 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/WeblogManager.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/WeblogManager.java @@ -155,11 +155,28 @@ List getWeblogsByLetter(char letter, int offset, int length) /** - * Get a custom template by its id. + * Get a custom template by its id, without restricting the result to any + * weblog. + * + *

Callers that act on behalf of a single weblog must use + * {@link #getTemplate(Weblog, String)} instead, so that a template id + * belonging to another weblog cannot resolve. This unscoped form is for + * callers that legitimately have no weblog in context, such as the + * Velocity resource loader. */ WeblogTemplate getTemplate(String id) throws WebloggerException; - - + + + /** + * Get a custom template by its id, restricted to the given weblog. + * + * @return the template, or null if no template with that id belongs to + * the given weblog. A template that exists but belongs to another + * weblog is reported the same way as one that does not exist. + */ + WeblogTemplate getTemplate(Weblog weblog, String id) throws WebloggerException; + + /** * Get a custom template by the action it supports. */ diff --git a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPABookmarkManagerImpl.java b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPABookmarkManagerImpl.java index 5b4224e09c..6284302832 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPABookmarkManagerImpl.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPABookmarkManagerImpl.java @@ -88,6 +88,50 @@ public WeblogBookmark getBookmark(String id) throws WebloggerException { return (WeblogBookmark) strategy.load(WeblogBookmark.class, id); } + @Override + public WeblogBookmark getBookmark(Weblog weblog, String id) throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + if (id == null) { + return null; + } + + TypedQuery q = strategy.getNamedQuery( + "WeblogBookmark.getByWebsite&Id", WeblogBookmark.class); + q.setParameter(1, weblog); + q.setParameter(2, id); + try { + return q.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } + + @Override + public WeblogBookmarkFolder getFolderById(Weblog weblog, String id) throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + if (id == null) { + return null; + } + + TypedQuery q = strategy.getNamedQuery( + "WeblogBookmarkFolder.getByWebsite&Id", WeblogBookmarkFolder.class); + q.setParameter(1, weblog); + q.setParameter(2, id); + try { + return q.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } + @Override public void removeBookmark(WeblogBookmark bookmark) throws WebloggerException { Weblog weblog = bookmark.getWebsite(); diff --git a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAMediaFileManagerImpl.java b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAMediaFileManagerImpl.java index 2a4071cebd..85a19cd44f 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAMediaFileManagerImpl.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAMediaFileManagerImpl.java @@ -346,6 +346,51 @@ public MediaFile getMediaFile(String id) throws WebloggerException { return getMediaFile(id, false); } + @Override + public MediaFile getMediaFile(Weblog weblog, String id) throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + if (id == null) { + return null; + } + + TypedQuery q = strategy.getNamedQuery( + "MediaFile.getByWeblogAndId", MediaFile.class); + q.setParameter(1, weblog); + q.setParameter(2, id); + try { + return q.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } + + @Override + public MediaFileDirectory getMediaFileDirectory(Weblog weblog, String id) + throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + if (id == null) { + return null; + } + + TypedQuery q = strategy.getNamedQuery( + "MediaFileDirectory.getByWeblogAndId", MediaFileDirectory.class); + q.setParameter(1, weblog); + q.setParameter(2, id); + try { + return q.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } + /** * {@inheritDoc} */ diff --git a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogEntryManagerImpl.java b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogEntryManagerImpl.java index b9bdf1f106..7a84bb5d33 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogEntryManagerImpl.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogEntryManagerImpl.java @@ -762,7 +762,82 @@ public WeblogEntryComment getComment(String id) throws WebloggerException { public WeblogEntry getWeblogEntry(String id) throws WebloggerException { return (WeblogEntry)strategy.load(WeblogEntry.class, id); } - + + /** + * @inheritDoc + */ + @Override + public WeblogEntry getWeblogEntry(Weblog weblog, String id) throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + if (id == null) { + return null; + } + + TypedQuery q = strategy.getNamedQuery( + "WeblogEntry.getByWebsite&Id", WeblogEntry.class); + q.setParameter(1, weblog); + q.setParameter(2, id); + try { + return q.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } + + /** + * @inheritDoc + */ + @Override + public WeblogCategory getWeblogCategory(Weblog weblog, String id) throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + if (id == null) { + return null; + } + + TypedQuery q = strategy.getNamedQuery( + "WeblogCategory.getByWeblog&Id", WeblogCategory.class); + q.setParameter(1, weblog); + q.setParameter(2, id); + try { + return q.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } + + /** + * @inheritDoc + */ + @Override + public WeblogEntryComment getComment(Weblog weblog, String id) throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + if (id == null) { + return null; + } + + TypedQuery q = strategy.getNamedQuery( + "WeblogEntryComment.getByWebsite&Id", WeblogEntryComment.class); + q.setParameter(1, weblog); + q.setParameter(2, id); + try { + return q.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } + /** * @inheritDoc */ diff --git a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogManagerImpl.java b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogManagerImpl.java index 8cb1f96727..d4304b4587 100644 --- a/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogManagerImpl.java +++ b/app/src/main/java/org/apache/roller/weblogger/business/jpa/JPAWeblogManagerImpl.java @@ -514,9 +514,32 @@ public WeblogTemplate getTemplate(String id) throws WebloggerException { if (id != null && id.endsWith(".vm")) { return null; } - + return (WeblogTemplate)this.strategy.load(WeblogTemplate.class,id); } + + @Override + public WeblogTemplate getTemplate(Weblog weblog, String id) throws WebloggerException { + + if (weblog == null) { + throw new WebloggerException("weblog is null"); + } + + // Don't hit database for templates stored on disk + if (id == null || id.endsWith(".vm")) { + return null; + } + + TypedQuery query = strategy.getNamedQuery("WeblogTemplate.getByWeblog&Id", + WeblogTemplate.class); + query.setParameter(1, weblog); + query.setParameter(2, id); + try { + return query.getSingleResult(); + } catch (NoResultException e) { + return null; + } + } /** * Use JPA directly because Weblogger's Query API does too much allocation. diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/BookmarkEdit.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/BookmarkEdit.java index ebb068c72b..f9c12d31ad 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/BookmarkEdit.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/BookmarkEdit.java @@ -65,7 +65,7 @@ public void myPrepare() { BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); try { if (!StringUtils.isEmpty(getFolderId())) { - bookmark.setFolder(bmgr.getFolder(getFolderId())); + bookmark.setFolder(bmgr.getFolderById(getActionWeblog(), getFolderId())); } } catch (WebloggerException ex) { addError("generic.error.check.logs"); @@ -75,7 +75,7 @@ public void myPrepare() { // existing bookmark, retrieve its info from DB try { BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); - bookmark = bmgr.getBookmark(getBean().getId()); + bookmark = bmgr.getBookmark(getActionWeblog(), getBean().getId()); } catch (WebloggerException ex) { addError("generic.error.check.logs"); log.error("Error looking up bookmark" + getBean().getId(), ex); diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Bookmarks.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Bookmarks.java index 60c8aa8fb0..1aa8b4c1b2 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Bookmarks.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Bookmarks.java @@ -72,7 +72,7 @@ public void myPrepare() { try { BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); if (!StringUtils.isEmpty(getFolderId())) { - setFolder(bmgr.getFolder(getFolderId())); + setFolder(bmgr.getFolderById(getActionWeblog(), getFolderId())); } else { setFolder(bmgr.getDefaultFolder(getActionWeblog())); if (getFolder() != null) { @@ -134,7 +134,7 @@ public String delete() { if (log.isDebugEnabled()) { log.debug("Deleting bookmark - " + bookmarks[j]); } - bookmark = bmgr.getBookmark(bookmarks[j]); + bookmark = bmgr.getBookmark(getActionWeblog(), bookmarks[j]); if (bookmark != null) { bmgr.removeBookmark(bookmark); } @@ -160,7 +160,7 @@ public String deleteFolder() { try { BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); - WeblogBookmarkFolder fd = bmgr.getFolder(getFolderId()); + WeblogBookmarkFolder fd = bmgr.getFolderById(getActionWeblog(), getFolderId()); if (fd != null) { @@ -203,7 +203,7 @@ public String view() { try { BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); if (!StringUtils.isEmpty(viewFolderId)) { - setFolder(bmgr.getFolder(viewFolderId)); + setFolder(bmgr.getFolderById(getActionWeblog(), viewFolderId)); setFolderId(viewFolderId); } } catch (WebloggerException ex) { @@ -225,12 +225,12 @@ public String move() { } // Move bookmarks to new parent folder. - WeblogBookmarkFolder newFolder = bmgr.getFolder(getTargetFolderId()); + WeblogBookmarkFolder newFolder = bmgr.getFolderById(getActionWeblog(), getTargetFolderId()); String bookmarks[] = getSelectedBookmarks(); if (null != bookmarks && bookmarks.length > 0) { for (int j = 0; j < bookmarks.length; j++) { - WeblogBookmark bd = bmgr.getBookmark(bookmarks[j]); + WeblogBookmark bd = bmgr.getBookmark(getActionWeblog(), bookmarks[j]); newFolder.addBookmark(bd); bd.setFolder(newFolder); bmgr.saveBookmark(bd); diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryEdit.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryEdit.java index a7cb24b8ce..c2968797d3 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryEdit.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryEdit.java @@ -74,7 +74,7 @@ public void myPrepare() { } else { try { WeblogEntryManager wmgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); - category = wmgr.getWeblogCategory(getBean().getId()); + category = wmgr.getWeblogCategory(getActionWeblog(), getBean().getId()); } catch (WebloggerException ex) { log.error("Error looking up category", ex); } diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryRemove.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryRemove.java index 1c823b7ea1..e6f6444899 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryRemove.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/CategoryRemove.java @@ -73,7 +73,7 @@ public void myPrepare() { try { WeblogEntryManager wmgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); if(!StringUtils.isEmpty(getRemoveId())) { - setCategory(wmgr.getWeblogCategory(getRemoveId())); + setCategory(wmgr.getWeblogCategory(getActionWeblog(), getRemoveId())); } } catch (WebloggerException ex) { log.error("Error looking up category", ex); @@ -112,7 +112,7 @@ public String remove() { WeblogEntryManager wmgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); if (getTargetCategoryId() != null) { - WeblogCategory target = wmgr.getWeblogCategory(getTargetCategoryId()); + WeblogCategory target = wmgr.getWeblogCategory(getActionWeblog(), getTargetCategoryId()); wmgr.moveWeblogCategoryContents(getCategory(), target); WebloggerFactory.getWeblogger().flush(); } diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Comments.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Comments.java index 7ccd7d4a67..fba790eee8 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Comments.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Comments.java @@ -102,7 +102,7 @@ public void loadComments() { // lookup weblog entry if necessary if (!StringUtils.isEmpty(getBean().getEntryId())) { - setQueryEntry(wmgr.getWeblogEntry(getBean().getEntryId())); + setQueryEntry(wmgr.getWeblogEntry(getActionWeblog(), getBean().getEntryId())); } CommentSearchCriteria csc = getCommentSearchCriteria(); @@ -284,11 +284,11 @@ public String update() { WeblogEntryComment deleteComment = null; for (String deleteId : deletes) { - deleteComment = wmgr.getComment(deleteId); + deleteComment = wmgr.getComment(getActionWeblog(), deleteId); - // make sure comment is tied to action weblog - if (getActionWeblog().equals( - deleteComment.getWeblogEntry().getWebsite())) { + // scoped lookup yields null for ids that do not belong to + // the action weblog, and for ids that do not exist at all + if (deleteComment != null) { flushList.add(deleteComment); reindexList.add(deleteComment.getWeblogEntry()); wmgr.removeComment(deleteComment); @@ -315,11 +315,11 @@ public String update() { continue; } - WeblogEntryComment comment = wmgr.getComment(ids[i]); + WeblogEntryComment comment = wmgr.getComment(getActionWeblog(), ids[i]); - // make sure comment is tied to action weblog - if (getActionWeblog().equals( - comment.getWeblogEntry().getWebsite())) { + // scoped lookup yields null for ids that do not belong to the + // action weblog, and for ids that do not exist at all + if (comment != null) { // comment approvals and mark/unmark spam if (approvedIds.contains(ids[i])) { // if a comment was previously PENDING then this is diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryAddWithMediaFile.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryAddWithMediaFile.java index 40c67e39b5..4f7d11f4d9 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryAddWithMediaFile.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryAddWithMediaFile.java @@ -71,7 +71,7 @@ public String execute() { if (selectedImages != null) { for (String image : selectedImages) { - MediaFile mediaFile = manager.getMediaFile(image); + MediaFile mediaFile = manager.getMediaFile(getActionWeblog(), image); String link; if (mediaFile.isImageFile()) { diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryEdit.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryEdit.java index a12dc18fff..5ef718505c 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryEdit.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryEdit.java @@ -104,7 +104,7 @@ public void myPrepare() { // retrieve from DB WeblogEntry based on ID WeblogEntryManager wmgr = WebloggerFactory.getWeblogger() .getWeblogEntryManager(); - setEntry(wmgr.getWeblogEntry(getBean().getId())); + setEntry(wmgr.getWeblogEntry(getActionWeblog(), getBean().getId())); } catch (WebloggerException ex) { log.error( "Error looking up entry by id - " + getBean().getId(), diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryRemove.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryRemove.java index 5555f70423..0db70756e1 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryRemove.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/EntryRemove.java @@ -59,7 +59,7 @@ public void myPrepare() { try { WeblogEntryManager wmgr = WebloggerFactory.getWeblogger() .getWeblogEntryManager(); - setRemoveEntry(wmgr.getWeblogEntry(getRemoveId())); + setRemoveEntry(wmgr.getWeblogEntry(getActionWeblog(), getRemoveId())); } catch (WebloggerException ex) { log.error("Error looking up entry by id - " + getRemoveId(), ex); } diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/FolderEdit.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/FolderEdit.java index 94de22d1fc..613e4bd0a7 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/FolderEdit.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/FolderEdit.java @@ -74,7 +74,7 @@ public void myPrepare() { // retrieve existing folder data from DB try { BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); - folder = bmgr.getFolder(getBean().getId()); + folder = bmgr.getFolderById(getActionWeblog(), getBean().getId()); } catch (WebloggerException ex) { log.error("Error looking up folder", ex); } diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileAdd.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileAdd.java index 881dad7549..356e498e62 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileAdd.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileAdd.java @@ -81,7 +81,7 @@ public void myPrepare() { MediaFileManager mgr = WebloggerFactory.getWeblogger() .getMediaFileManager(); if (!StringUtils.isEmpty(bean.getDirectoryId())) { - setDirectory(mgr.getMediaFileDirectory(bean.getDirectoryId())); + setDirectory(mgr.getMediaFileDirectory(getActionWeblog(), bean.getDirectoryId())); } else if (StringUtils.isNotEmpty(directoryName)) { setDirectory(mgr.getMediaFileDirectoryByName(getActionWeblog(), diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileBase.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileBase.java index 38c4ef9edf..13c301f020 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileBase.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileBase.java @@ -62,7 +62,7 @@ protected void doDeleteMediaFile() { log.debug("Processing delete of file id - " + this.mediaFileId); MediaFileManager manager = WebloggerFactory.getWeblogger() .getMediaFileManager(); - MediaFile mediaFile = manager.getMediaFile(this.mediaFileId); + MediaFile mediaFile = manager.getMediaFile(getActionWeblog(), this.mediaFileId); manager.removeMediaFile(getActionWeblog(), mediaFile); // flush changes WebloggerFactory.getWeblogger().flush(); @@ -84,7 +84,7 @@ protected void doIncludeMediaFileInGallery() { + this.mediaFileId); MediaFileManager manager = WebloggerFactory.getWeblogger() .getMediaFileManager(); - MediaFile mediaFile = manager.getMediaFile(this.mediaFileId); + MediaFile mediaFile = manager.getMediaFile(getActionWeblog(), this.mediaFileId); mediaFile.setSharedForGallery(true); manager.updateMediaFile(getActionWeblog(), mediaFile); // flush changes @@ -111,7 +111,7 @@ protected void doDeleteSelected() { + " media files."); for (String fileId : fileIds) { log.debug("Deleting media file - " + fileId); - MediaFile mediaFile = manager.getMediaFile(fileId); + MediaFile mediaFile = manager.getMediaFile(getActionWeblog(), fileId); if (mediaFile != null) { manager.removeMediaFile(getActionWeblog(), mediaFile); } @@ -147,11 +147,11 @@ void doMoveSelected() { log.debug("Processing move of " + fileIds.length + " media files."); MediaFileDirectory targetDirectory = manager - .getMediaFileDirectory(this.selectedDirectory); + .getMediaFileDirectory(getActionWeblog(), this.selectedDirectory); for (String fileId : fileIds) { log.debug("Moving media file - " + fileId + " to directory - " + this.selectedDirectory); - MediaFile mediaFile = manager.getMediaFile(fileId); + MediaFile mediaFile = manager.getMediaFile(getActionWeblog(), fileId); if (mediaFile != null && !mediaFile.getDirectory().getId().equals(targetDirectory.getId())) { manager.moveMediaFile(mediaFile, targetDirectory); movedFiles++; diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileEdit.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileEdit.java index 76ff2dbb7c..885d8cd1ca 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileEdit.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileEdit.java @@ -67,7 +67,7 @@ public void myPrepare() { try { MediaFileManager mgr = WebloggerFactory.getWeblogger().getMediaFileManager(); if (!StringUtils.isEmpty(bean.getDirectoryId())) { - setDirectory(mgr.getMediaFileDirectory(bean.getDirectoryId())); + setDirectory(mgr.getMediaFileDirectory(getActionWeblog(), bean.getDirectoryId())); } } catch (WebloggerException ex) { log.error("Error looking up media file directory", ex); @@ -95,7 +95,7 @@ public void myValidate() { public String execute() { MediaFileManager manager = WebloggerFactory.getWeblogger().getMediaFileManager(); try { - MediaFile mediaFile = manager.getMediaFile(getMediaFileId()); + MediaFile mediaFile = manager.getMediaFile(getActionWeblog(), getMediaFileId()); this.bean.copyFrom(mediaFile); } catch (FileIOException ex) { @@ -119,7 +119,7 @@ public String save() { if (!hasActionErrors()) { MediaFileManager manager = WebloggerFactory.getWeblogger().getMediaFileManager(); try { - MediaFile mediaFile = manager.getMediaFile(getMediaFileId()); + MediaFile mediaFile = manager.getMediaFile(getActionWeblog(), getMediaFileId()); bean.copyTo(mediaFile); if (uploadedFile != null) { diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageChooser.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageChooser.java index 335255bd4b..c16f0a78eb 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageChooser.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageChooser.java @@ -83,7 +83,7 @@ public String execute() { MediaFileDirectory directory; if (this.directoryId != null) { - directory = manager.getMediaFileDirectory(this.directoryId); + directory = manager.getMediaFileDirectory(getActionWeblog(), this.directoryId); } else if (this.directoryName != null) { directory = manager.getMediaFileDirectoryByName(getActionWeblog(), this.directoryName); this.directoryId = directory.getId(); diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageDim.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageDim.java index 67b91e5b2e..5796ece72d 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageDim.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileImageDim.java @@ -50,7 +50,7 @@ public MediaFileImageDim() { public String execute() { try { MediaFileManager mgr = WebloggerFactory.getWeblogger().getMediaFileManager(); - MediaFile mediaFile = mgr.getMediaFile(getMediaFileId()); + MediaFile mediaFile = mgr.getMediaFile(getActionWeblog(), getMediaFileId()); bean.copyFrom(mediaFile); } catch (WebloggerException ex) { log.error("Error looking up media file directory", ex); diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileView.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileView.java index 79310ef539..32b83dc340 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileView.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/MediaFileView.java @@ -199,7 +199,7 @@ public String execute() { try { MediaFileDirectory directory; if (StringUtils.isNotEmpty(this.directoryId)) { - directory = manager.getMediaFileDirectory(this.directoryId); + directory = manager.getMediaFileDirectory(getActionWeblog(), this.directoryId); } else if (StringUtils.isNotEmpty(this.directoryName)) { directory = manager.getMediaFileDirectoryByName( @@ -254,7 +254,7 @@ public String view() { .getMediaFileManager(); if (!StringUtils.isEmpty(viewDirectoryId)) { setDirectoryId(viewDirectoryId); - setCurrentDirectory(manager.getMediaFileDirectory(viewDirectoryId)); + setCurrentDirectory(manager.getMediaFileDirectory(getActionWeblog(), viewDirectoryId)); } } catch (WebloggerException ex) { log.error("Error looking up directory", ex); @@ -326,7 +326,7 @@ public String deleteFolder() { log.debug("Deleting media file folder - " + directoryId + " (" + directoryName + ")"); MediaFileDirectory mediaFileDir = manager - .getMediaFileDirectory(directoryId); + .getMediaFileDirectory(getActionWeblog(), directoryId); manager.removeMediaFileDirectory(mediaFileDir); refreshAllDirectories(); WebloggerFactory.getWeblogger().getWeblogManager() diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/TemplateEdit.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/TemplateEdit.java index dd1261dc90..a1f95cebb0 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/TemplateEdit.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/TemplateEdit.java @@ -58,7 +58,8 @@ public TemplateEdit() { @Override public void myPrepare() { try { - setTemplate(WebloggerFactory.getWeblogger().getWeblogManager().getTemplate(getBean().getId())); + setTemplate(WebloggerFactory.getWeblogger().getWeblogManager() + .getTemplate(getActionWeblog(), getBean().getId())); } catch (WebloggerException ex) { log.error("Error looking up template - " + getBean().getId(), ex); } diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Templates.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Templates.java index 4cee7dae51..157e8f4092 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Templates.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Templates.java @@ -210,7 +210,7 @@ public String remove() { WeblogTemplate template = null; try { - template = WebloggerFactory.getWeblogger().getWeblogManager().getTemplate(getRemoveId()); + template = WebloggerFactory.getWeblogger().getWeblogManager().getTemplate(getActionWeblog(), getRemoveId()); } catch (WebloggerException e) { addError("Error deleting template - check Roller logs"); } diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/WeblogConfig.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/WeblogConfig.java index 0cfe9a352b..45e4ed5848 100644 --- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/WeblogConfig.java +++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/WeblogConfig.java @@ -136,7 +136,7 @@ public String save() { // if blogger category changed then lookup new cat and set it if(getBean().getBloggerCategoryId() != null && !weblog.getBloggerCategory().getId().equals(getBean().getBloggerCategoryId())) { - weblog.setBloggerCategory(wmgr.getWeblogCategory(getBean().getBloggerCategoryId())); + weblog.setBloggerCategory(wmgr.getWeblogCategory(getActionWeblog(), getBean().getBloggerCategoryId())); } // ROL-485: comments not allowed on inactive weblogs diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFile.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFile.orm.xml index 241c8a1641..f7b0113c71 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFile.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFile.orm.xml @@ -9,6 +9,9 @@ SELECT f FROM MediaFile f WHERE f.weblog = ?1 AND f.originalPath = ?2 + + SELECT f FROM MediaFile f WHERE f.weblog = ?1 AND f.id = ?2 + diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFileDirectory.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFileDirectory.orm.xml index fcb24d2547..baea5b10f9 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFileDirectory.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/MediaFileDirectory.orm.xml @@ -12,6 +12,9 @@ SELECT d FROM MediaFileDirectory d WHERE d.weblog = ?1 AND d.name = ?2 + + SELECT d FROM MediaFileDirectory d WHERE d.weblog = ?1 AND d.id = ?2 + diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmark.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmark.orm.xml index b04c6acaf9..dd9ccdc67a 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmark.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmark.orm.xml @@ -9,6 +9,9 @@ SELECT b FROM WeblogBookmark b WHERE b.folder = ?1 order by b.priority + + SELECT b FROM WeblogBookmark b WHERE b.folder.weblog = ?1 AND b.id = ?2 + diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmarkFolder.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmarkFolder.orm.xml index a9cd414b29..ddee76952c 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmarkFolder.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogBookmarkFolder.orm.xml @@ -12,6 +12,9 @@ SELECT f FROM WeblogBookmarkFolder f WHERE f.weblog = ?1 AND f.name = ?2 + + SELECT f FROM WeblogBookmarkFolder f WHERE f.weblog = ?1 AND f.id = ?2 + diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogCategory.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogCategory.orm.xml index 23764dc18f..a5a0e76cbf 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogCategory.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogCategory.orm.xml @@ -13,6 +13,9 @@ SELECT w FROM WeblogCategory w WHERE w.weblog = ?1 AND w.name = ?2 + + SELECT w FROM WeblogCategory w WHERE w.weblog = ?1 AND w.id = ?2 + DELETE FROM WeblogCategory w WHERE w.weblog = ?1 diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntry.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntry.orm.xml index 7c28c6e630..6f3c9178e4 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntry.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntry.orm.xml @@ -18,6 +18,9 @@ SELECT w FROM WeblogEntry w WHERE w.website = ?1 AND w.anchor = ?2 + + SELECT w FROM WeblogEntry w WHERE w.website = ?1 AND w.id = ?2 + SELECT w FROM WeblogEntry w WHERE w.website = ?1 diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntryComment.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntryComment.orm.xml index 44607d7177..f1576b2ecb 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntryComment.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogEntryComment.orm.xml @@ -11,6 +11,9 @@ SELECT COUNT(c) FROM WeblogEntryComment c where c.status = ?1 + + SELECT c FROM WeblogEntryComment c WHERE c.weblogEntry.website = ?1 AND c.id = ?2 + SELECT COUNT(c) FROM WeblogEntryComment c WHERE c.weblogEntry.website = ?1 AND c.status = ?2 diff --git a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogTemplate.orm.xml b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogTemplate.orm.xml index 0485071ade..e493537e5e 100644 --- a/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogTemplate.orm.xml +++ b/app/src/main/resources/org/apache/roller/weblogger/pojos/WeblogTemplate.orm.xml @@ -22,6 +22,9 @@ SELECT w FROM WeblogTemplate w WHERE w.weblog = ?1 AND w.name= ?2 + + SELECT w FROM WeblogTemplate w WHERE w.weblog = ?1 AND w.id = ?2 + diff --git a/app/src/test/java/org/apache/roller/weblogger/business/WeblogScopedLookupTest.java b/app/src/test/java/org/apache/roller/weblogger/business/WeblogScopedLookupTest.java new file mode 100644 index 0000000000..d0801b0072 --- /dev/null +++ b/app/src/test/java/org/apache/roller/weblogger/business/WeblogScopedLookupTest.java @@ -0,0 +1,413 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. The ASF licenses this file to You + * under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. For additional information regarding + * copyright in this work, please see the NOTICE file in the top level + * directory of this distribution. + */ + +package org.apache.roller.weblogger.business; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.apache.roller.weblogger.TestUtils; +import org.apache.roller.weblogger.pojos.MediaFile; +import org.apache.roller.weblogger.pojos.MediaFileDirectory; +import org.apache.roller.weblogger.pojos.ThemeTemplate.ComponentType; +import org.apache.roller.weblogger.pojos.WeblogBookmark; +import org.apache.roller.weblogger.pojos.WeblogBookmarkFolder; +import org.apache.roller.weblogger.util.RollerMessages; +import org.apache.roller.weblogger.pojos.User; +import org.apache.roller.weblogger.pojos.Weblog; +import org.apache.roller.weblogger.pojos.WeblogCategory; +import org.apache.roller.weblogger.pojos.WeblogEntry; +import org.apache.roller.weblogger.pojos.WeblogEntryComment; +import org.apache.roller.weblogger.pojos.WeblogTemplate; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertNull; + +/** + * Tests that resource lookups performed on behalf of the authoring UI resolve + * only within the weblog they are scoped to. + * + * Each test sets up two independent weblogs owned by different users and + * verifies that a resource belonging to one is not reachable through a lookup + * scoped to the other. + */ +public class WeblogScopedLookupTest { + + public static Log log = LogFactory.getLog(WeblogScopedLookupTest.class); + + User userOne = null; + User userTwo = null; + Weblog weblogOne = null; + Weblog weblogTwo = null; + + @BeforeEach + public void setUp() throws Exception { + + TestUtils.setupWeblogger(); + + // media file creation is rejected outright unless uploads are enabled + WebloggerFactory.getWeblogger().getPropertiesManager().getProperties() + .get("uploads.enabled").setValue("true"); + + try { + userOne = TestUtils.setupUser("scopeTestUserOne"); + userTwo = TestUtils.setupUser("scopeTestUserTwo"); + weblogOne = TestUtils.setupWeblog("scopeTestWeblogOne", userOne); + weblogTwo = TestUtils.setupWeblog("scopeTestWeblogTwo", userTwo); + TestUtils.endSession(true); + } catch (Exception ex) { + log.error(ex); + throw new Exception("Test setup failed", ex); + } + } + + @AfterEach + public void tearDown() throws Exception { + + try { + TestUtils.teardownWeblog(weblogOne.getId()); + TestUtils.teardownWeblog(weblogTwo.getId()); + TestUtils.teardownUser(userOne.getUserName()); + TestUtils.teardownUser(userTwo.getUserName()); + TestUtils.endSession(true); + } catch (Exception ex) { + log.error(ex); + throw new Exception("Test teardown failed", ex); + } + } + + /** + * Creates a template owned by the given weblog and returns its id. + */ + private String createTemplate(Weblog weblog, String name) throws Exception { + WeblogTemplate template = new WeblogTemplate(); + template.setAction(ComponentType.WEBLOG); + template.setName(name); + template.setDescription("Test Weblog Template"); + template.setLink(name); + template.setLastModified(new java.util.Date()); + template.setWeblog(TestUtils.getManagedWebsite(weblog)); + + WebloggerFactory.getWeblogger().getWeblogManager().saveTemplate(template); + TestUtils.endSession(true); + + return template.getId(); + } + + @Test + public void testGetTemplateReturnsNullForTemplateOwnedByAnotherWeblog() throws Exception { + + WeblogManager mgr = WebloggerFactory.getWeblogger().getWeblogManager(); + + String foreignTemplateId = createTemplate(weblogTwo, "scopeTestForeignTemplate"); + + WeblogTemplate found = mgr.getTemplate( + TestUtils.getManagedWebsite(weblogOne), foreignTemplateId); + + assertNull(found, "template owned by another weblog must not be returned"); + } + + @Test + public void testGetTemplateReturnsTemplateOwnedByTheGivenWeblog() throws Exception { + + WeblogManager mgr = WebloggerFactory.getWeblogger().getWeblogManager(); + + String ownTemplateId = createTemplate(weblogOne, "scopeTestOwnTemplate"); + + WeblogTemplate found = mgr.getTemplate( + TestUtils.getManagedWebsite(weblogOne), ownTemplateId); + + assertNotNull(found, "template owned by the given weblog must be returned"); + assertEquals(ownTemplateId, found.getId()); + } + + @Test + public void testGetWeblogEntryReturnsNullForEntryOwnedByAnotherWeblog() throws Exception { + + WeblogEntryManager mgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); + + WeblogEntry foreign = TestUtils.setupWeblogEntry( + "scopeTestForeignEntry", weblogTwo, userTwo); + TestUtils.endSession(true); + + WeblogEntry found = mgr.getWeblogEntry( + TestUtils.getManagedWebsite(weblogOne), foreign.getId()); + + assertNull(found, "entry owned by another weblog must not be returned"); + } + + @Test + public void testGetWeblogEntryReturnsEntryOwnedByTheGivenWeblog() throws Exception { + + WeblogEntryManager mgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); + + WeblogEntry own = TestUtils.setupWeblogEntry( + "scopeTestOwnEntry", weblogOne, userOne); + TestUtils.endSession(true); + + WeblogEntry found = mgr.getWeblogEntry( + TestUtils.getManagedWebsite(weblogOne), own.getId()); + + assertNotNull(found, "entry owned by the given weblog must be returned"); + assertEquals(own.getId(), found.getId()); + } + + @Test + public void testGetWeblogCategoryReturnsNullForCategoryOwnedByAnotherWeblog() throws Exception { + + WeblogEntryManager mgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); + + WeblogCategory foreign = TestUtils.setupWeblogCategory( + TestUtils.getManagedWebsite(weblogTwo), "scopeTestForeignCategory"); + TestUtils.endSession(true); + + WeblogCategory found = mgr.getWeblogCategory( + TestUtils.getManagedWebsite(weblogOne), foreign.getId()); + + assertNull(found, "category owned by another weblog must not be returned"); + } + + @Test + public void testGetWeblogCategoryReturnsCategoryOwnedByTheGivenWeblog() throws Exception { + + WeblogEntryManager mgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); + + WeblogCategory own = TestUtils.setupWeblogCategory( + TestUtils.getManagedWebsite(weblogOne), "scopeTestOwnCategory"); + TestUtils.endSession(true); + + WeblogCategory found = mgr.getWeblogCategory( + TestUtils.getManagedWebsite(weblogOne), own.getId()); + + assertNotNull(found, "category owned by the given weblog must be returned"); + assertEquals(own.getId(), found.getId()); + } + + @Test + public void testGetCommentReturnsNullForCommentOwnedByAnotherWeblog() throws Exception { + + WeblogEntryManager mgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); + + WeblogEntry foreignEntry = TestUtils.setupWeblogEntry( + "scopeTestForeignCommentEntry", weblogTwo, userTwo); + WeblogEntryComment foreign = TestUtils.setupComment( + "scopeTestForeignComment", foreignEntry); + TestUtils.endSession(true); + + WeblogEntryComment found = mgr.getComment( + TestUtils.getManagedWebsite(weblogOne), foreign.getId()); + + assertNull(found, "comment owned by another weblog must not be returned"); + } + + @Test + public void testGetCommentReturnsCommentOwnedByTheGivenWeblog() throws Exception { + + WeblogEntryManager mgr = WebloggerFactory.getWeblogger().getWeblogEntryManager(); + + WeblogEntry ownEntry = TestUtils.setupWeblogEntry( + "scopeTestOwnCommentEntry", weblogOne, userOne); + WeblogEntryComment own = TestUtils.setupComment( + "scopeTestOwnComment", ownEntry); + TestUtils.endSession(true); + + WeblogEntryComment found = mgr.getComment( + TestUtils.getManagedWebsite(weblogOne), own.getId()); + + assertNotNull(found, "comment owned by the given weblog must be returned"); + assertEquals(own.getId(), found.getId()); + } + + /** + * Creates a bookmark in a new folder owned by the given weblog. + */ + private WeblogBookmark createBookmark(Weblog weblog, String name) throws Exception { + + BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); + + WeblogBookmarkFolder folder = TestUtils.setupFolder( + TestUtils.getManagedWebsite(weblog), name + "Folder"); + TestUtils.endSession(true); + + WeblogBookmark bookmark = new WeblogBookmark( + bmgr.getFolder(folder.getId()), name, "desc", + "http://example.com/", "http://example.com/feed", "image"); + bmgr.saveBookmark(bookmark); + TestUtils.endSession(true); + + return bookmark; + } + + @Test + public void testGetFolderReturnsNullForFolderOwnedByAnotherWeblog() throws Exception { + + BookmarkManager mgr = WebloggerFactory.getWeblogger().getBookmarkManager(); + + WeblogBookmarkFolder foreign = TestUtils.setupFolder( + TestUtils.getManagedWebsite(weblogTwo), "scopeTestForeignFolder"); + TestUtils.endSession(true); + + WeblogBookmarkFolder found = mgr.getFolderById( + TestUtils.getManagedWebsite(weblogOne), foreign.getId()); + + assertNull(found, "folder owned by another weblog must not be returned"); + } + + @Test + public void testGetFolderReturnsFolderOwnedByTheGivenWeblog() throws Exception { + + BookmarkManager mgr = WebloggerFactory.getWeblogger().getBookmarkManager(); + + WeblogBookmarkFolder own = TestUtils.setupFolder( + TestUtils.getManagedWebsite(weblogOne), "scopeTestOwnFolder"); + TestUtils.endSession(true); + + WeblogBookmarkFolder found = mgr.getFolderById( + TestUtils.getManagedWebsite(weblogOne), own.getId()); + + assertNotNull(found, "folder owned by the given weblog must be returned"); + assertEquals(own.getId(), found.getId()); + } + + @Test + public void testGetBookmarkReturnsNullForBookmarkOwnedByAnotherWeblog() throws Exception { + + BookmarkManager mgr = WebloggerFactory.getWeblogger().getBookmarkManager(); + + WeblogBookmark foreign = createBookmark(weblogTwo, "scopeTestForeignBookmark"); + + WeblogBookmark found = mgr.getBookmark( + TestUtils.getManagedWebsite(weblogOne), foreign.getId()); + + assertNull(found, "bookmark owned by another weblog must not be returned"); + } + + @Test + public void testGetBookmarkReturnsBookmarkOwnedByTheGivenWeblog() throws Exception { + + BookmarkManager mgr = WebloggerFactory.getWeblogger().getBookmarkManager(); + + WeblogBookmark own = createBookmark(weblogOne, "scopeTestOwnBookmark"); + + WeblogBookmark found = mgr.getBookmark( + TestUtils.getManagedWebsite(weblogOne), own.getId()); + + assertNotNull(found, "bookmark owned by the given weblog must be returned"); + assertEquals(own.getId(), found.getId()); + } + + /** + * Creates a media file in the given weblog's default directory. + */ + private MediaFile createMediaFile(Weblog weblog, String name) throws Exception { + + MediaFileManager mmgr = WebloggerFactory.getWeblogger().getMediaFileManager(); + + Weblog managed = TestUtils.getManagedWebsite(weblog); + MediaFileDirectory directory = mmgr.getDefaultMediaFileDirectory(managed); + if (directory == null) { + directory = mmgr.createMediaFileDirectory(managed, "default"); + TestUtils.endSession(true); + managed = TestUtils.getManagedWebsite(weblog); + directory = mmgr.getMediaFileDirectory(directory.getId()); + } + + MediaFile mediaFile = new MediaFile(); + mediaFile.setName(name); + mediaFile.setDescription("scoped lookup test file"); + mediaFile.setCopyrightText("none"); + mediaFile.setSharedForGallery(false); + mediaFile.setLength(3000); + mediaFile.setDirectory(directory); + mediaFile.setWeblog(managed); + mediaFile.setContentType("image/jpeg"); + mediaFile.setInputStream(getClass().getResourceAsStream("/hawk.jpg")); + + RollerMessages messages = new RollerMessages(); + mmgr.createMediaFile(managed, mediaFile, messages); + // createMediaFile reports rejection through messages rather than + // throwing, so a silent failure here would leave the test asserting + // against a file that was never stored + assertEquals(0, messages.getErrorCount(), + "media file fixture was rejected: " + messages); + TestUtils.endSession(true); + + return mediaFile; + } + + @Test + public void testGetMediaFileReturnsNullForFileOwnedByAnotherWeblog() throws Exception { + + MediaFileManager mgr = WebloggerFactory.getWeblogger().getMediaFileManager(); + + MediaFile foreign = createMediaFile(weblogTwo, "scopeTestForeignFile.jpg"); + + MediaFile found = mgr.getMediaFile( + TestUtils.getManagedWebsite(weblogOne), foreign.getId()); + + assertNull(found, "media file owned by another weblog must not be returned"); + } + + @Test + public void testGetMediaFileReturnsFileOwnedByTheGivenWeblog() throws Exception { + + MediaFileManager mgr = WebloggerFactory.getWeblogger().getMediaFileManager(); + + MediaFile own = createMediaFile(weblogOne, "scopeTestOwnFile.jpg"); + + MediaFile found = mgr.getMediaFile( + TestUtils.getManagedWebsite(weblogOne), own.getId()); + + assertNotNull(found, "media file owned by the given weblog must be returned"); + assertEquals(own.getId(), found.getId()); + } + + @Test + public void testGetMediaFileDirectoryReturnsNullForDirectoryOwnedByAnotherWeblog() throws Exception { + + MediaFileManager mgr = WebloggerFactory.getWeblogger().getMediaFileManager(); + + MediaFileDirectory foreign = mgr.createMediaFileDirectory( + TestUtils.getManagedWebsite(weblogTwo), "scopeTestForeignDir"); + TestUtils.endSession(true); + + MediaFileDirectory found = mgr.getMediaFileDirectory( + TestUtils.getManagedWebsite(weblogOne), foreign.getId()); + + assertNull(found, "directory owned by another weblog must not be returned"); + } + + @Test + public void testGetMediaFileDirectoryReturnsDirectoryOwnedByTheGivenWeblog() throws Exception { + + MediaFileManager mgr = WebloggerFactory.getWeblogger().getMediaFileManager(); + + MediaFileDirectory own = mgr.createMediaFileDirectory( + TestUtils.getManagedWebsite(weblogOne), "scopeTestOwnDir"); + TestUtils.endSession(true); + + MediaFileDirectory found = mgr.getMediaFileDirectory( + TestUtils.getManagedWebsite(weblogOne), own.getId()); + + assertNotNull(found, "directory owned by the given weblog must be returned"); + assertEquals(own.getId(), found.getId()); + } +} diff --git a/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/AuthoringActionScopingTest.java b/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/AuthoringActionScopingTest.java new file mode 100644 index 0000000000..17572463df --- /dev/null +++ b/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/AuthoringActionScopingTest.java @@ -0,0 +1,203 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. The ASF licenses this file to You + * under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. For additional information regarding + * copyright in this work, please see the NOTICE file in the top level + * directory of this distribution. + */ + +package org.apache.roller.weblogger.ui.struts2.editor; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.apache.roller.weblogger.TestUtils; +import org.apache.roller.weblogger.business.BookmarkManager; +import org.apache.roller.weblogger.business.WebloggerFactory; +import org.apache.roller.weblogger.pojos.User; +import org.apache.roller.weblogger.pojos.Weblog; +import org.apache.roller.weblogger.pojos.WeblogBookmark; +import org.apache.roller.weblogger.pojos.WeblogBookmarkFolder; +import org.apache.roller.weblogger.pojos.WeblogCategory; +import org.apache.roller.weblogger.pojos.WeblogEntry; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertNull; + +/** + * Verifies that authoring actions resolve the resource named by a request + * parameter within the weblog the request is acting on, rather than by id + * alone. + * + * The interceptor stack resolves and authorizes the action weblog before + * myPrepare() runs, so these tests set the action weblog directly and then + * ask each action to prepare against an id owned by a different weblog. + */ +public class AuthoringActionScopingTest { + + public static Log log = LogFactory.getLog(AuthoringActionScopingTest.class); + + User userOne = null; + User userTwo = null; + Weblog weblogOne = null; + Weblog weblogTwo = null; + + @BeforeEach + public void setUp() throws Exception { + + TestUtils.setupWeblogger(); + + try { + userOne = TestUtils.setupUser("actScopeUserOne"); + userTwo = TestUtils.setupUser("actScopeUserTwo"); + weblogOne = TestUtils.setupWeblog("actScopeWeblogOne", userOne); + weblogTwo = TestUtils.setupWeblog("actScopeWeblogTwo", userTwo); + TestUtils.endSession(true); + } catch (Exception ex) { + log.error(ex); + throw new Exception("Test setup failed", ex); + } + } + + @AfterEach + public void tearDown() throws Exception { + + try { + TestUtils.teardownWeblog(weblogOne.getId()); + TestUtils.teardownWeblog(weblogTwo.getId()); + TestUtils.teardownUser(userOne.getUserName()); + TestUtils.teardownUser(userTwo.getUserName()); + TestUtils.endSession(true); + } catch (Exception ex) { + log.error(ex); + throw new Exception("Test teardown failed", ex); + } + } + + // ----------------------------------------------------- entry removal + + @Test + public void testEntryRemoveDoesNotLoadEntryOwnedByAnotherWeblog() throws Exception { + + WeblogEntry foreign = TestUtils.setupWeblogEntry( + "actScopeForeignEntry", weblogTwo, userTwo); + TestUtils.endSession(true); + + EntryRemove action = new EntryRemove(); + action.setActionWeblog(TestUtils.getManagedWebsite(weblogOne)); + action.setRemoveId(foreign.getId()); + action.myPrepare(); + + assertNull(action.getRemoveEntry(), + "remove must not load an entry owned by another weblog"); + } + + @Test + public void testEntryRemoveLoadsEntryOwnedByTheActionWeblog() throws Exception { + + WeblogEntry own = TestUtils.setupWeblogEntry( + "actScopeOwnEntry", weblogOne, userOne); + TestUtils.endSession(true); + + EntryRemove action = new EntryRemove(); + action.setActionWeblog(TestUtils.getManagedWebsite(weblogOne)); + action.setRemoveId(own.getId()); + action.myPrepare(); + + assertNotNull(action.getRemoveEntry(), + "remove must load an entry owned by the action weblog"); + assertEquals(own.getId(), action.getRemoveEntry().getId()); + } + + // ----------------------------------------------------- entry editing + + @Test + public void testEntryEditDoesNotLoadEntryOwnedByAnotherWeblog() throws Exception { + + WeblogEntry foreign = TestUtils.setupWeblogEntry( + "actScopeForeignEditEntry", weblogTwo, userTwo); + TestUtils.endSession(true); + + EntryEdit action = new EntryEdit(); + action.setActionWeblog(TestUtils.getManagedWebsite(weblogOne)); + action.getBean().setId(foreign.getId()); + action.myPrepare(); + + assertNull(action.getEntry(), + "editor must not load an entry owned by another weblog"); + } + + // -------------------------------------------------- category removal + + @Test + public void testCategoryRemoveDoesNotLoadCategoryOwnedByAnotherWeblog() throws Exception { + + WeblogCategory foreign = TestUtils.setupWeblogCategory( + TestUtils.getManagedWebsite(weblogTwo), "actScopeForeignCat"); + TestUtils.endSession(true); + + CategoryRemove action = new CategoryRemove(); + action.setActionWeblog(TestUtils.getManagedWebsite(weblogOne)); + action.setRemoveId(foreign.getId()); + action.myPrepare(); + + assertNull(action.getCategory(), + "remove must not load a category owned by another weblog"); + } + + @Test + public void testCategoryRemoveLoadsCategoryOwnedByTheActionWeblog() throws Exception { + + WeblogCategory own = TestUtils.setupWeblogCategory( + TestUtils.getManagedWebsite(weblogOne), "actScopeOwnCat"); + TestUtils.endSession(true); + + CategoryRemove action = new CategoryRemove(); + action.setActionWeblog(TestUtils.getManagedWebsite(weblogOne)); + action.setRemoveId(own.getId()); + action.myPrepare(); + + assertNotNull(action.getCategory(), + "remove must load a category owned by the action weblog"); + assertEquals(own.getId(), action.getCategory().getId()); + } + + // -------------------------------------------------- bookmark editing + + @Test + public void testBookmarkEditDoesNotLoadBookmarkOwnedByAnotherWeblog() throws Exception { + + BookmarkManager bmgr = WebloggerFactory.getWeblogger().getBookmarkManager(); + + WeblogBookmarkFolder folder = TestUtils.setupFolder( + TestUtils.getManagedWebsite(weblogTwo), "actScopeForeignBmFolder"); + TestUtils.endSession(true); + + WeblogBookmark foreign = new WeblogBookmark( + bmgr.getFolder(folder.getId()), "actScopeForeignBm", "desc", + "http://example.com/", "http://example.com/feed", "image"); + bmgr.saveBookmark(foreign); + TestUtils.endSession(true); + + BookmarkEdit action = new BookmarkEdit(); + action.setActionWeblog(TestUtils.getManagedWebsite(weblogOne)); + action.getBean().setId(foreign.getId()); + action.myPrepare(); + + assertNull(action.getBookmark(), + "editor must not load a bookmark owned by another weblog"); + } +} diff --git a/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/TemplateEditScopingTest.java b/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/TemplateEditScopingTest.java new file mode 100644 index 0000000000..e4285ea89a --- /dev/null +++ b/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/TemplateEditScopingTest.java @@ -0,0 +1,133 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. The ASF licenses this file to You + * under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. For additional information regarding + * copyright in this work, please see the NOTICE file in the top level + * directory of this distribution. + */ + +package org.apache.roller.weblogger.ui.struts2.editor; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.apache.roller.weblogger.TestUtils; +import org.apache.roller.weblogger.business.WebloggerFactory; +import org.apache.roller.weblogger.pojos.ThemeTemplate.ComponentType; +import org.apache.roller.weblogger.pojos.User; +import org.apache.roller.weblogger.pojos.Weblog; +import org.apache.roller.weblogger.pojos.WeblogTemplate; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertNull; + +/** + * Verifies that the template editor resolves the template it is asked to edit + * within the weblog the request is acting on, rather than by id alone. + */ +public class TemplateEditScopingTest { + + public static Log log = LogFactory.getLog(TemplateEditScopingTest.class); + + User userOne = null; + User userTwo = null; + Weblog weblogOne = null; + Weblog weblogTwo = null; + + @BeforeEach + public void setUp() throws Exception { + + TestUtils.setupWeblogger(); + + try { + userOne = TestUtils.setupUser("tmplEditUserOne"); + userTwo = TestUtils.setupUser("tmplEditUserTwo"); + weblogOne = TestUtils.setupWeblog("tmplEditWeblogOne", userOne); + weblogTwo = TestUtils.setupWeblog("tmplEditWeblogTwo", userTwo); + TestUtils.endSession(true); + } catch (Exception ex) { + log.error(ex); + throw new Exception("Test setup failed", ex); + } + } + + @AfterEach + public void tearDown() throws Exception { + + try { + TestUtils.teardownWeblog(weblogOne.getId()); + TestUtils.teardownWeblog(weblogTwo.getId()); + TestUtils.teardownUser(userOne.getUserName()); + TestUtils.teardownUser(userTwo.getUserName()); + TestUtils.endSession(true); + } catch (Exception ex) { + log.error(ex); + throw new Exception("Test teardown failed", ex); + } + } + + private String createTemplate(Weblog weblog, String name) throws Exception { + WeblogTemplate template = new WeblogTemplate(); + template.setAction(ComponentType.WEBLOG); + template.setName(name); + template.setDescription("Test Weblog Template"); + template.setLink(name); + template.setLastModified(new java.util.Date()); + template.setWeblog(TestUtils.getManagedWebsite(weblog)); + + WebloggerFactory.getWeblogger().getWeblogManager().saveTemplate(template); + TestUtils.endSession(true); + + return template.getId(); + } + + /** + * Builds the action as the interceptor stack would: the action weblog is + * already resolved and authorized before myPrepare() runs. + */ + private TemplateEdit actionFor(Weblog actionWeblog, String requestedTemplateId) + throws Exception { + TemplateEdit action = new TemplateEdit(); + action.setActionWeblog(TestUtils.getManagedWebsite(actionWeblog)); + action.getBean().setId(requestedTemplateId); + return action; + } + + @Test + public void testDoesNotLoadTemplateBelongingToAnotherWeblog() throws Exception { + + String foreignTemplateId = createTemplate(weblogTwo, "tmplEditForeign"); + + TemplateEdit action = actionFor(weblogOne, foreignTemplateId); + action.myPrepare(); + + assertNull(action.getTemplate(), + "editor must not load a template owned by another weblog"); + } + + @Test + public void testLoadsTemplateBelongingToTheActionWeblog() throws Exception { + + String ownTemplateId = createTemplate(weblogOne, "tmplEditOwn"); + + TemplateEdit action = actionFor(weblogOne, ownTemplateId); + action.myPrepare(); + + assertNotNull(action.getTemplate(), + "editor must load a template owned by the action weblog"); + assertEquals(ownTemplateId, action.getTemplate().getId()); + } +}