Skip to content

Commit 8fa4c01

Browse files
wikumChamithwikumChamith
committed
TRUNK-6203: Global properties access should be privileged
1 parent ff12904 commit 8fa4c01

7 files changed

Lines changed: 77 additions & 18 deletions

File tree

‎api/src/main/java/org/openmrs/ui/framework/FormatterImpl.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
import org.openmrs.ui.framework.formatter.FormatterService;
3535
import org.springframework.context.MessageSource;
3636

37+
import static org.openmrs.ui.framework.UiFrameworkConstants.GET_GLOBAL_PROPERTIES;
3738
import static org.openmrs.util.TimeZoneUtil.toTimezone;
3839

3940
/**
@@ -117,6 +118,7 @@ private boolean wholeNumber(Number n) {
117118

118119
private String format(Date d, Locale locale) {
119120
DateFormat df;
121+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
120122
boolean convertTimezones = BooleanUtils
121123
.toBoolean(administrationService.getGlobalProperty(UiFrameworkConstants.GP_TIMEZONE_CONVERSIONS));
122124
if (convertTimezones) {
@@ -130,6 +132,7 @@ private String format(Date d, Locale locale) {
130132
} else {
131133
df = UiFrameworkUtil.getDateFormat(administrationService, locale);
132134
}
135+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
133136
return df.format(d);
134137
}
135138

@@ -276,7 +279,9 @@ private String format(PersonAddress personAddress, Locale locale) {
276279
Object templates = MethodUtils.invokeExactMethod(addressSupport, "getAddressTemplate", null);
277280
addressTemplate = ((List<?>) templates).get(0);
278281
} else {
282+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
279283
String templateName = administrationService.getGlobalProperty(ADDRESS_LAYOUT_TEMPLATE_NAME_GP);
284+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
280285
if (templateName != null) {
281286
addressTemplate = MethodUtils.invokeExactMethod(addressSupport, "getLayoutTemplateByName", templateName);
282287
}

‎api/src/main/java/org/openmrs/ui/framework/UiFrameworkConstants.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,6 @@ public class UiFrameworkConstants {
3737
//The name of the user property that save the client timezone.
3838
public static final String UP_CLIENT_TIMEZONE = "uiframework.client.timezone";
3939

40+
public static final String GET_GLOBAL_PROPERTIES = "Get Global Properties";
41+
4042
}

‎api/src/main/java/org/openmrs/ui/framework/UiFrameworkUtil.java‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@
5454
import org.springframework.web.multipart.MultipartFile;
5555
import org.springframework.web.multipart.MultipartHttpServletRequest;
5656

57+
import static org.openmrs.ui.framework.UiFrameworkConstants.GET_GLOBAL_PROPERTIES;
58+
5759
public class UiFrameworkUtil {
5860

5961
private static Log log = LogFactory.getLog(UiFrameworkUtil.class);
@@ -667,9 +669,11 @@ private static String getRuntimeOrSystemProperty(String key) {
667669
public static DateFormat getDateFormat(AdministrationService administrationService, Locale locale) {
668670
String defaultFormat = "dd.MMM.yyyy";
669671
if (administrationService != null) {
670-
return new SimpleDateFormat(
671-
administrationService.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATE_FORMAT, defaultFormat),
672-
locale);
672+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
673+
String globalProperty = administrationService.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATE_FORMAT,
674+
defaultFormat);
675+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
676+
return new SimpleDateFormat(globalProperty, locale);
673677
} else {
674678
return new SimpleDateFormat(defaultFormat, locale);
675679
}
@@ -678,8 +682,11 @@ public static DateFormat getDateFormat(AdministrationService administrationServi
678682
public static DateFormat getDateTimeFormat(AdministrationService administrationService, Locale locale) {
679683
String defaultFormat = "dd.MMM.yyyy, HH:mm:ss";
680684
if (administrationService != null) {
681-
return new SimpleDateFormat(administrationService
682-
.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATETIME_FORMAT, defaultFormat), locale);
685+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
686+
String globalProperty = administrationService
687+
.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATETIME_FORMAT, defaultFormat);
688+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
689+
return new SimpleDateFormat(globalProperty, locale);
683690
} else {
684691
return new SimpleDateFormat(defaultFormat, locale);
685692
}
@@ -688,9 +695,11 @@ public static DateFormat getDateTimeFormat(AdministrationService administrationS
688695
public static DateFormat getTimeFormat(AdministrationService administrationService, Locale locale) {
689696
String defaultFormat = "hh:mm a";
690697
if (administrationService != null) {
691-
return new SimpleDateFormat(
692-
administrationService.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_TIME_FORMAT, defaultFormat),
693-
locale);
698+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
699+
String globalProperty = administrationService.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_TIME_FORMAT,
700+
defaultFormat);
701+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
702+
return new SimpleDateFormat(globalProperty, locale);
694703
} else {
695704
return new SimpleDateFormat(defaultFormat, locale);
696705
}

‎api/src/main/java/org/openmrs/ui/framework/UiUtils.java‎

Lines changed: 38 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import java.util.Map;
3333
import java.util.Random;
3434

35+
import static org.openmrs.ui.framework.UiFrameworkConstants.GET_GLOBAL_PROPERTIES;
3536
import static org.openmrs.util.TimeZoneUtil.toTimezone;
3637

3738
/**
@@ -643,36 +644,62 @@ public void setLocale(Locale locale) {
643644
* @return the value of the Global Property GP_TIMEZONE_CONVERSIONS
644645
*/
645646
public boolean convertTimezones() {
646-
return BooleanUtils.toBoolean(
647-
Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.GP_TIMEZONE_CONVERSIONS));
647+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
648+
String globalProperty = Context.getAdministrationService()
649+
.getGlobalProperty(UiFrameworkConstants.GP_TIMEZONE_CONVERSIONS);
650+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
651+
return BooleanUtils.toBoolean(globalProperty);
648652
}
649653

650654
public String getJSDatetimeFormat() {
651-
return Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_JS_DATETIME_FORMAT);
655+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
656+
String globalProperty = Context.getAdministrationService()
657+
.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_JS_DATETIME_FORMAT);
658+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
659+
return globalProperty;
652660
}
653661

654662
public String getJSDateFormat() {
655-
return Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_JS_DATE_FORMAT);
663+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
664+
String globalProperty = Context.getAdministrationService()
665+
.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_JS_DATE_FORMAT);
666+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
667+
return globalProperty;
656668
}
657669

658670
public String getDatetimeFormat() {
659-
return Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATETIME_FORMAT);
671+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
672+
String globalProperty = Context.getAdministrationService()
673+
.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATETIME_FORMAT);
674+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
675+
return globalProperty;
660676
}
661677

662678
public String getDateFormat() {
663-
return Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATE_FORMAT);
679+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
680+
String globalProperty = Context.getAdministrationService()
681+
.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_DATE_FORMAT);
682+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
683+
return globalProperty;
664684
}
665685

666686
public String getTimeFormat() {
667-
return Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_TIME_FORMAT);
687+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
688+
String globalProperty = Context.getAdministrationService()
689+
.getGlobalProperty(UiFrameworkConstants.GP_FORMATTER_TIME_FORMAT);
690+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
691+
return globalProperty;
668692
}
669693

670694
/**
671695
* @return the value of the User Property clientTimezone, that indicates the client timezone
672696
*/
673697
public String getClientTimezone() {
674-
return Context.getAuthenticatedUser().getUserProperty(
675-
Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.UP_CLIENT_TIMEZONE));
698+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
699+
String globalProperty = Context.getAdministrationService()
700+
.getGlobalProperty(UiFrameworkConstants.UP_CLIENT_TIMEZONE);
701+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
702+
return Context.getAuthenticatedUser().getUserProperty(globalProperty);
676703
}
677704

678705
/**
@@ -683,12 +710,14 @@ public String getClientTimezone() {
683710
public void setClientTimezone(String clientTimezone) {
684711
try {
685712
Context.addProxyPrivilege(PrivilegeConstants.EDIT_USERS);
713+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
686714
Context.getUserService().setUserProperty(Context.getAuthenticatedUser(),
687715
Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.UP_CLIENT_TIMEZONE),
688716
clientTimezone);
689717
}
690718
finally {
691719
Context.removeProxyPrivilege(PrivilegeConstants.EDIT_USERS);
720+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
692721
}
693722
}
694723

‎api/src/main/java/org/openmrs/ui/framework/converter/StringToGlobalPropertyConverter.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
import org.openmrs.api.context.Context;
66
import org.springframework.core.convert.converter.Converter;
77

8+
import static org.openmrs.ui.framework.UiFrameworkConstants.GET_GLOBAL_PROPERTIES;
9+
810
/**
911
* Note that this converts based on property name, not on id
1012
*/
@@ -15,6 +17,9 @@ public GlobalProperty convert(String propertyName) {
1517
if (StringUtils.isBlank(propertyName)) {
1618
return null;
1719
}
18-
return Context.getAdministrationService().getGlobalPropertyObject(propertyName);
20+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
21+
GlobalProperty globalPropertyObject = Context.getAdministrationService().getGlobalPropertyObject(propertyName);
22+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
23+
return globalPropertyObject;
1924
}
2025
}

‎api/src/main/java/org/openmrs/ui/framework/extension/ExtensionManager.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
import org.springframework.beans.factory.annotation.Autowired;
1818
import org.springframework.stereotype.Service;
1919

20+
import static org.openmrs.ui.framework.UiFrameworkConstants.GET_GLOBAL_PROPERTIES;
21+
2022
/**
2123
* Manager for extension points
2224
*/
@@ -112,7 +114,9 @@ public <T extends Extension> Map<String, T> getExtensionsByClass(Class<T> clazz)
112114
* the point has not been configured, this returns null.
113115
*/
114116
public List<String> getExtensionPointConfiguration(String pointId) {
117+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
115118
String gp = Context.getAdministrationService().getGlobalProperty("ui2.extensionConfig." + pointId);
119+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
116120
return gp == null ? null : Arrays.asList(gp.split(","));
117121
}
118122

@@ -126,7 +130,9 @@ public List<String> getExtensionPointConfiguration(String pointId) {
126130
*/
127131
public void saveExtensionPointConfiguration(String pointId, String... uniqueIds) {
128132
AdministrationService service = Context.getAdministrationService();
133+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
129134
GlobalProperty gp = service.getGlobalPropertyObject("ui2.extensionConfig." + pointId);
135+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
130136
if (uniqueIds.length == 0) {
131137
if (gp != null)
132138
service.purgeGlobalProperty(gp);

‎api/src/main/java/org/openmrs/util/TimeZoneUtil.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import java.util.TimeZone;
2525

2626
import static org.joda.time.DateTimeZone.UTC;
27+
import static org.openmrs.ui.framework.UiFrameworkConstants.GET_GLOBAL_PROPERTIES;
2728

2829
/**
2930
* Helps provide tools to support recommended OpenMRS time zones conventions.
@@ -40,8 +41,10 @@ public class TimeZoneUtil {
4041
* @return string with the date in the client timezone, formatted and ready to be displayed.
4142
*/
4243
public static String toTimezone(Date date, String format) {
44+
Context.addProxyPrivilege(GET_GLOBAL_PROPERTIES);
4345
String clientTimezone = Context.getAuthenticatedUser().getUserProperty(
4446
Context.getAdministrationService().getGlobalProperty(UiFrameworkConstants.UP_CLIENT_TIMEZONE));
47+
Context.removeProxyPrivilege(GET_GLOBAL_PROPERTIES);
4548
return toTimezone(date, format, clientTimezone);
4649
}
4750

0 commit comments

Comments
 (0)