administrator = true;
break;
}
}
User user = (User) args[0];
String username = user.getUsername();
String currentUser = null;
if (auth.getPrincipal() instanceof UserDetails) {
currentUser = ((UserDetails) auth.getPrincipal()).getUsername();
} else {
currentUser = String.valueOf(auth.getPrincipal());
}
if (!username.equals(currentUser)) {
AuthenticationTrustResolver resolver = new AuthenticationTrustResolverImpl();
// allow new users to signup - this is OK b/c Signup doesn't allow setting of roles
boolean signupUser = resolver.isAnonymous(auth);
if (!signupUser) {
if (log.isDebugEnabled()) {
log.debug("Verifying that '" + currentUser + "' can modify '" + username + "'");
}
if (!administrator) {
log.warn("Access Denied: '" + currentUser + "' tried to modify '" + username + "'!");
throw new AccessDeniedException(ACCESS_DENIED);
}
} else {
if (log.isDebugEnabled()) {
log.debug("Registering new user '" + username + "'");
}
}
}
// fix for http://issues.appfuse.org/browse/APF-96
// don't allow users with "user" role to upgrade to "admin" role
else if (username.equalsIgnoreCase(currentUser) && !administrator) {
// get the list of roles the user is trying add
Set userRoles = new HashSet();
if (user.getRoles() != null) {
for (Iterator it = user.getRoles().iterator(); it.hasNext();) {
Role role = (Role) it.next();
userRoles.add(role.getName());
}
}