@SuppressWarnings("unchecked")
List<Element> requestedGroups = request.getChildren(SearchParameter.GROUP);
Set<Integer> userGroups = gc.getBean(AccessManager.class).getUserGroups(srvContext.getUserSession(), srvContext.getIpAddress(), false);
UserSession userSession = srvContext.getUserSession();
// unless you are logged in as Administrator, check if you are allowed to query the groups in the query
if (userSession == null || userSession.getProfile() == null ||
(userSession.getProfile() != Profile.Administrator && userSession.isAuthenticated())) {
if(!CollectionUtils.isEmpty(requestedGroups)) {
for(Element group : requestedGroups) {
if(! "".equals(group.getText())
&& ! userGroups.contains(Integer.valueOf(group.getText()))) {
throw new UnAuthorizedException("You are not authorized to do this.", null);
}
}
}
}
// remove elements from user input that compromise this request
for (String fieldName : UserQueryInput.SECURITY_FIELDS){
request.removeChildren(fieldName);
}
// if 'restrict to' is set then don't add any other user/group info
if ((request.getChild(SearchParameter.GROUP) == null) ||
(StringUtils.isEmpty(request.getChild(SearchParameter.GROUP).getText().trim()))) {
for (Integer group : userGroups) {
request.addContent(new Element(SearchParameter.GROUP).addContent(""+group));
}
String owner = null;
if (userSession != null) {
owner = userSession.getUserId();
}
if (owner != null) {
request.addContent(new Element(SearchParameter.OWNER).addContent(owner));
}
//--- in case of an admin show all results
if (userSession != null) {
if (userSession.isAuthenticated()) {
if (userSession.getProfile() == Profile.Administrator) {
request.addContent(new Element(SearchParameter.ISADMIN).addContent("true"));
} else if (userSession.getProfile() == Profile.Reviewer) {
request.addContent(new Element(SearchParameter.ISREVIEWER).addContent("true"));
}
}
}
}