}
}
public PermissibleObject savePermissibleObject(PermissibleObject permissibleObject) throws SimpleMessageException {
if (permissibleObject == null) {
throw new SimpleMessageException("Object not supplied.");
}
User authUser = getAuthenticatedUser(session.get());
if (authUser == null && permissibleObject instanceof IAnonymousPermissibleObject) {
authUser = UserHelper.getUser(session.get(), "anonymous");
}
if (authUser == null) {
throw new SimpleMessageException("User is not authenticated.");
}
Transaction tx = session.get().beginTransaction();
try {
if (permissibleObject.getParent() != null) {
permissibleObject.setParent((PermissibleObject) session.get().load(PermissibleObject.class, permissibleObject.getParent().getId()));
}
if (!SecurityHelper.doesUserHavePermission(session.get(), authUser, permissibleObject.getParent(), PERM.CREATE_CHILD)) {
throw new SimpleMessageException("User is not authorized to write to parent folder.");
}
if (permissibleObject.getId() != null) {
PermissibleObject hibNewObject = (PermissibleObject) session.get().load(PermissibleObject.class, permissibleObject.getId());
if (hibNewObject != null) {
if (!SecurityHelper.doesUserHavePermission(session.get(), authUser, hibNewObject, PERM.WRITE)) {
throw new SimpleMessageException("User is not authorized to overwrite object.");
}
List<Field> fields = ReflectionCache.getFields(permissibleObject.getClass());
for (Field field : fields) {
try {
field.set(hibNewObject, field.get(permissibleObject));
} catch (Exception e) {
e.printStackTrace();
Logger.log(e);
}
}
permissibleObject = hibNewObject;
}
}
List<Field> fields = ReflectionCache.getFields(permissibleObject.getClass());
for (Field field : fields) {
try {
// do not update parent permission only our 'owned' objects
if (!"parent".equals(field.getName())) {
Object obj = field.get(permissibleObject);
if (obj instanceof PermissibleObject) {
PermissibleObject childObj = (PermissibleObject) obj;
PermissibleObject hibChild = (PermissibleObject) session.get().load(PermissibleObject.class, childObj.getId());
hibChild.setGlobalRead(permissibleObject.isGlobalRead());
hibChild.setGlobalWrite(permissibleObject.isGlobalWrite());
hibChild.setGlobalExecute(permissibleObject.isGlobalExecute());
hibChild.setGlobalCreateChild(permissibleObject.isGlobalCreateChild());
field.set(permissibleObject, hibChild);
}
}
} catch (Exception e) {
Logger.log(e);
}
}
permissibleObject.setOwner(authUser);
session.get().save(permissibleObject);
tx.commit();
return permissibleObject;
} catch (Throwable t) {
Logger.log(t);
try {
tx.rollback();
} catch (Throwable tt) {
}
throw new SimpleMessageException(t.getMessage());
}
}