opendaylight/web/flows/src/main/java/org/opendaylight/controller/flows/web/Flows.java.rej

   1 ***************
   2 *** 29,35 ****
   3   import org.opendaylight.controller.switchmanager.SwitchConfig;
   4   import org.opendaylight.controller.usermanager.IUserManager;
   5   import org.opendaylight.controller.web.IOneWeb;
   6 - import org.springframework.security.core.context.SecurityContextHolder;
   7   import org.springframework.stereotype.Controller;
   8   import org.springframework.web.bind.annotation.PathVariable;
   9   import org.springframework.web.bind.annotation.RequestMapping;
  10 --- 31,36 ----
  11   import org.opendaylight.controller.switchmanager.SwitchConfig;
  12   import org.opendaylight.controller.usermanager.IUserManager;
  13   import org.opendaylight.controller.web.IOneWeb;
  14   import org.springframework.stereotype.Controller;
  15   import org.springframework.web.bind.annotation.PathVariable;
  16   import org.springframework.web.bind.annotation.RequestMapping;
  17 ***************
  18 *** 182,189 ****
  19       @RequestMapping(value = "/flow", method = RequestMethod.POST)
  20       @ResponseBody
  21       public String actionFlow(@RequestParam(required = true) String action,
  22 -             @RequestParam(required = false) String body, @RequestParam(required = true) String nodeId) {
  23 -       if (!authorize(UserLevel.NETWORKADMIN)) {
  24                 return "Operation not authorized";
  25         }
  26
  27 --- 183,190 ----
  28       @RequestMapping(value = "/flow", method = RequestMethod.POST)
  29       @ResponseBody
  30       public String actionFlow(@RequestParam(required = true) String action,
  31 +             @RequestParam(required = false) String body, @RequestParam(required = true) String nodeId, HttpServletRequest request) {
  32 +       if (!authorize(UserLevel.NETWORKADMIN, request)) {
  33                 return "Operation not authorized";
  34         }
  35
  36 ***************
  37 *** 206,213 ****
  38       @RequestMapping(value = "/flow/{nodeId}/{name}", method = RequestMethod.POST)
  39       @ResponseBody
  40       public String removeFlow(@PathVariable("nodeId") String nodeId, @PathVariable("name") String name,
  41 -               @RequestParam(required = true) String action) {
  42 -       if (!authorize(UserLevel.NETWORKADMIN)) { return "Operation not authorized"; }
  43
  44         IForwardingRulesManager frm = (IForwardingRulesManager) ServiceHelper
  45                   .getInstance(IForwardingRulesManager.class, "default", this);
  46 --- 207,214 ----
  47       @RequestMapping(value = "/flow/{nodeId}/{name}", method = RequestMethod.POST)
  48       @ResponseBody
  49       public String removeFlow(@PathVariable("nodeId") String nodeId, @PathVariable("name") String name,
  50 +               @RequestParam(required = true) String action, HttpServletRequest request) {
  51 +       if (!authorize(UserLevel.NETWORKADMIN, request)) { return "Operation not authorized"; }
  52
  53         IForwardingRulesManager frm = (IForwardingRulesManager) ServiceHelper
  54                   .getInstance(IForwardingRulesManager.class, "default", this);
  55 ***************
  56 *** 235,248 ****
  57        *
  58        * @param level
  59        */
  60 -     private boolean authorize(UserLevel level) {
  61         IUserManager userManager = (IUserManager) ServiceHelper
  62                   .getGlobalInstance(IUserManager.class, this);
  63           if (userManager == null) {
  64                 return false;
  65           }
  66
  67 -         String username = SecurityContextHolder.getContext().getAuthentication().getName();
  68           UserLevel userLevel = userManager.getUserLevel(username);
  69           if (userLevel.toNumber() <= level.toNumber()) {
  70                 return true;
  71 --- 236,249 ----
  72        *
  73        * @param level
  74        */
  75 +     private boolean authorize(UserLevel level, HttpServletRequest request) {
  76         IUserManager userManager = (IUserManager) ServiceHelper
  77                   .getGlobalInstance(IUserManager.class, this);
  78           if (userManager == null) {
  79                 return false;
  80           }
  81
  82 +         String username = request.getUserPrincipal().getName();
  83           UserLevel userLevel = userManager.getUserLevel(username);
  84           if (userLevel.toNumber() <= level.toNumber()) {
  85                 return true;