Fix security to execute predicates in non-authenticated session
package com.orientechnologies.orient.core.metadata.security;
import com.orientechnologies.orient.core.command.OBasicCommandContext;
+import com.orientechnologies.orient.core.db.ODatabaseInternal;
import com.orientechnologies.orient.core.db.ODatabaseSession;
+import com.orientechnologies.orient.core.exception.OSecurityException;
import com.orientechnologies.orient.core.metadata.function.OFunction;
import com.orientechnologies.orient.core.metadata.schema.OClass;
import com.orientechnologies.orient.core.record.ORecord;
+import com.orientechnologies.orient.core.record.impl.ODocument;
import com.orientechnologies.orient.core.sql.OSQLEngine;
import com.orientechnologies.orient.core.sql.executor.OResult;
import com.orientechnologies.orient.core.sql.parser.OAndBlock;
@@ -20,15 +23,14 @@ public class OSecurityEngine {
* Calculates a predicate for a security resource. It also takes into consideration the security and schema hierarchies.
* ie. invoking it with a specific session for a specific class, the method checks all the roles of the session, all the parent roles
* and all the parent classes until it finds a valid predicarte (the most specific one).
- *
+ * <p>
* For multiple-role session, the result is the OR of the predicates that would be calculated for each single role.
- *
+ * <p>
* For class hierarchies:
* - the most specific (ie. defined on subclass) defined predicate is applied
* - in case a class does not have a direct predicate defined, the superclass predicate is used (and recursively)
* - in case of multiple superclasses, the AND of the predicates for superclasses (also recursively) is applied
*
- *
* @param session
* @param security
* @param resourceString
@@ -256,19 +258,31 @@ public class OSecurityEngine {
static boolean evaluateSecuirtyPolicyPredicate(ODatabaseSession session, OBooleanExpression predicate, ORecord record) {
- //TODO execute with a different session (reload the record...?)
+ try {
+ final ODocument user = session.getUser().getDocument();
+ return ((ODatabaseInternal) session).getSharedContext().getOrientDB().executeNoAuthorization(session.getName(), (db -> {
OBasicCommandContext ctx = new OBasicCommandContext();
- ctx.setDatabase(session);
- ctx.setVariable("$currentUser", session.getUser().getDocument());
+ ctx.setDatabase(db);
+ ctx.setVariable("$currentUser", user);
return predicate.evaluate(record, ctx);
+ })).get();
+ } catch (Exception e) {
+ throw new OSecurityException("Cannot execute security predicate");
+ }
}
static boolean evaluateSecuirtyPolicyPredicate(ODatabaseSession session, OBooleanExpression predicate, OResult record) {
- //TODO execute with a different session (reload the record...?)
+ try {
+ final ODocument user = session.getUser().getDocument();
+ return ((ODatabaseInternal) session).getSharedContext().getOrientDB().executeNoAuthorization(session.getName(), (db -> {
OBasicCommandContext ctx = new OBasicCommandContext();
- ctx.setDatabase(session);
- ctx.setVariable("$currentUser", session.getUser().getDocument());
+ ctx.setDatabase(db);
+ ctx.setVariable("$currentUser", user);
return predicate.evaluate(record, ctx);
+ })).get();
+ } catch (Exception e) {
+ throw new OSecurityException("Cannot execute security predicate");
+ }
}
/**
