if (forward != null) {
return forward;
}
long roleId = Utility.parseLong(context.getRequest().getParameter("roleId"));
RoleSecurity role = null;
AuthorizationPersistence authorizationPersistence =
PersistenceManager.getInstance().getAuthorizationPersistence();
if (roleId >= 0) {
role = authorizationPersistence.getRole(roleId);
}
if (role == null) {
return this.handleSuccess(mapping, context, "failure");
}
context.setAttribute("importMessage", "");
context.setAttribute("role", role);
String users = context.getRequest().getParameter("users");
if (users == null || users.trim().length() == 0) {
return this.handleSuccess(mapping, context, "success");
}
List<String> userList = new ArrayList<String>();
BufferedReader reader = new BufferedReader(new StringReader(users));
for (;;) {
String line = reader.readLine();
if (line == null) {
break;
}
if (line.trim().length() > 0) {
userList.add(line.trim());
}
}
String operation = context.getRequest().getParameter("operation");
if ("remove".equalsIgnoreCase(operation)) {
// TODO NOT SAFE HERE, Sql injection is possible.
Map<String, Boolean> result = authorizationPersistence.removeRoleUsers(userList, roleId);
String message = this.generateResult(userList, result, true);
context.setAttribute("importMessage", message);
} else if ("add".equalsIgnoreCase(operation)) {
// TODO NOT SAFE HERE, Sql injection is possible.
Map<String, Boolean> result = authorizationPersistence.addRoleUsers(userList, roleId);
String message = this.generateResult(userList, result, false);
context.setAttribute("importMessage", message);
}
return this.handleSuccess(mapping, context, "success");