Honor page ACLs on SisterSites.jsp + proper attachment detection
<%@ page import="org.apache.log4j.*" %>
<%@ page import="org.apache.wiki.api.core.*" %>
<%@ page import="org.apache.wiki.api.spi.Wiki" %>
+<%@ page import="org.apache.wiki.attachment.AttachmentManager" %>
<%@ page import="org.apache.wiki.auth.AuthorizationManager" %>
+<%@ page import="org.apache.wiki.auth.permissions.*" %>
+<%@ page import="org.apache.wiki.pages.PageManager" %>
<%@ page import="org.apache.wiki.preferences.Preferences" %>
<%@ page import="org.apache.wiki.references.ReferenceManager" %>
<%@ page import="org.apache.wiki.rss.*" %>
%>
<%
/*
- * This JSP creates support for the SisterSites standard,
- * as specified by http://usemod.com/cgi-bin/mb.pl?SisterSitesImplementationGuide
- *
- * FIXME: Does not honor the ACL's on the pages.
+ * This JSP creates support for the SisterSites standard, as specified by
+ * http://usemod.com/cgi-bin/mb.pl?SisterSitesImplementationGuide
*/
Engine wiki = Wiki.engine().find( getServletConfig() );
// Create wiki context and check for authorization
Set< String > allPages = wiki.getManager( ReferenceManager.class ).findCreated();
response.setContentType("text/plain; charset=UTF-8");
- for( Iterator< String > i = allPages.iterator(); i.hasNext(); ) {
- String pageName = i.next();
-
+ for( String pageName : allPages ) {
// Let's not add attachments.
- // TODO: This is a kludge and not forward-compatible.
+ if( wiki.getManager( AttachmentManager.class ).getAttachmentInfoName( wikiContext, pageName ) != null ) continue;
- if( pageName.indexOf("/") != -1 ) continue;
+ Page wikiPage = wiki.getManager( PageManager.class ).getPage( pageName );
+ PagePermission permission = PermissionFactory.getPagePermission( wikiPage, "view" );
+ boolean allowed = wiki.getManager( AuthorizationManager.class ).checkPermission( wikiContext.getWikiSession(), permission );
+ if( allowed ) {
String url = wikiContext.getViewURL( pageName );
-
out.write( url + " " + pageName + "\n" );
}
+ }
%>
\ No newline at end of file
