Proof of concept #1026

Paul Martin

2016-04-16 eecaad8b8e2c447429c31a01d49260ddd6b4ee03

 src/main/java/com/gitblit/servlet/RpcFilter.java

@@ -18,6 +18,8 @@
import java.io.IOException;

import java.text.MessageFormat;



import com.google.inject.Inject;

import com.google.inject.Singleton;

import javax.servlet.FilterChain;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

@@ -45,18 +47,22 @@
 * @author James Moger

 *

 */

@Singleton

public class RpcFilter extends AuthenticationFilter {



   private final IStoredSettings settings;

   private IStoredSettings settings;



   private final IRuntimeManager runtimeManager;

   private IRuntimeManager runtimeManager;



   @Inject

   public RpcFilter(

         IStoredSettings settings,

         IRuntimeManager runtimeManager,

         IAuthenticationManager authenticationManager) {



      super(authenticationManager);

      this.settings = runtimeManager.getSettings();



      this.settings = settings;

      this.runtimeManager = runtimeManager;

   }



@@ -122,7 +128,7 @@
            return;

         } else {

            // check user access for request

            if (user.canAdmin() || canAccess(user, requestType)) {

            if (user.canAdmin() || !adminRequest) {

               // authenticated request permitted.

               // pass processing to the restricted servlet.

               newSession(authenticatedRequest, httpResponse);

@@ -147,15 +153,4 @@
      // pass processing to the restricted servlet.

      chain.doFilter(authenticatedRequest, httpResponse);

   }



   private boolean canAccess(UserModel user, RpcRequest requestType) {

      switch (requestType) {

      case GET_PROTOCOL:

         return true;

      case LIST_REPOSITORIES:

         return true;

      default:

         return user.canAdmin();

      }

   }

}
}