}
});
}
public void updatePrivileges(NodeFact node) throws RepositoryException {
final JCRSiteNode site = node.getParent().getNode().getResolveSite();
String principal = StringUtils.substringAfter(StringUtils.substringAfterLast(node.getPath(), "/"), "_").replaceFirst("_", ":");
if (principal.startsWith("jcr:read") || principal.startsWith("jcr:write")) {
principal = StringUtils.substringAfter(principal,"_").replaceFirst("_", ":");
}
final String fPrincipal = principal;
if (site == null) {
return;
}
boolean needPrivileged = JCRTemplate.getInstance().doExecuteWithSystemSession(new JCRCallback<Boolean>() {
public Boolean doInJCR(JCRSessionWrapper session) throws RepositoryException {
QueryManager q = session.getWorkspace().getQueryManager();
String sql = "select * from [jnt:ace] as ace where ace.[j:aceType]='GRANT' and ace.[j:principal] = '"+fPrincipal+"' and isdescendantnode(ace, ['"+site.getPath()+"'])";
QueryResult qr = q.createQuery(sql, Query.JCR_SQL2).execute();
NodeIterator ni = qr.getNodes();
Set<String> roles = new HashSet<String>();
while (ni.hasNext()) {
JCRNodeWrapper next = (JCRNodeWrapper) ni.next();
if (next.hasProperty("j:roles")) {
Value[] vals = next.getProperty("j:roles").getValues();
for (Value val : vals) {
roles.add(val.getString());
}
} else {
logger.warn("Missing roles property for acl on "+next.getPath());
}
}
boolean needPrivileged = false;
for (String role : roles) {
JCRNodeWrapper roleNode = session.getNode("/roles/"+role);
if (roleNode.hasProperty("j:privilegedAccess") && roleNode.getProperty("j:privilegedAccess").getBoolean()) {
needPrivileged = true;
break;
}
}
return needPrivileged;
}
});
JahiaGroupManagerService groupService = ServicesRegistry.getInstance().getJahiaGroupManagerService();
final JahiaGroup priv = groupService.lookupGroup(site.getID(), JahiaGroupManagerService.SITE_PRIVILEGED_GROUPNAME);
Principal p = null;
if (principal.startsWith("u:")) {
p = userManagerService.lookupUser(principal.substring(2));
} else if (principal.length() > 2) {
p = groupService.lookupGroup(site.getID(), principal.substring(2));
}
if (p != null) {
if (needPrivileged && !priv.isMember(p)) {
logger.info(principal + " need privileged access");
priv.addMember(p);