public PermissibleObject updatePermissibleObject(PermissibleObject permissibleObject) throws SimpleMessageException {
if (permissibleObject == null) {
throw new SimpleMessageException("PermissibleObject not supplied.");
}
User authUser = getAuthenticatedUser(session.get());
if (authUser == null) {
throw new SimpleMessageException("User is not authenticated.");
}
Transaction tx = session.get().beginTransaction();
try {
User newOwner = ((User) session.get().load(User.class, permissibleObject.getOwner().getId()));
PermissibleObject hibPermissibleObject = ((PermissibleObject) session.get().load(PermissibleObject.class, permissibleObject.getId()));
if (!authUser.isAdministrator() && !hibPermissibleObject.getOwner().equals(authUser)) {
throw new SimpleMessageException("User is not authorized to update this object.");
}
// update fields (for example, image has child permissibles)