TSK-349 Mandatory read permission is not checked in WorkbasketQuery if another permission is used as condition
This commit is contained in:
BerndBreier
Holger Hagen
parent
b626fc4603
commit
18f03bd32e
|
|
@ -203,12 +203,14 @@ public interface QueryMapper {
|
|||
@Select("<script>"
|
||||
+ "SELECT DISTINCT "
|
||||
+ "w.ID, w.KEY, w.NAME, w.DOMAIN, W.TYPE, w.DESCRIPTION, w.OWNER, w.ORG_LEVEL_1, w.ORG_LEVEL_2, w.ORG_LEVEL_3, w.ORG_LEVEL_4 from WORKBASKET w "
|
||||
+ "<if test = 'joinWithAccessList'> "
|
||||
+ "LEFT OUTER JOIN (select WORKBASKET_ID as WID, max(PERM_READ) as MAX_READ, max(PERM_OPEN) as MAX_OPEN, "
|
||||
+ "MAX(PERM_APPEND) as MAX_APPEND, MAX(PERM_TRANSFER) as MAX_TRANSFER, MAX(PERM_DISTRIBUTE) as MAX_DISTRIBUTE, MAX(PERM_CUSTOM_1) as MAX_CUSTOM_1, MAX(PERM_CUSTOM_2) as MAX_CUSTOM_2, "
|
||||
+ "MAX(PERM_CUSTOM_3) as MAX_CUSTOM_3, MAX(PERM_CUSTOM_4) as MAX_CUSTOM_4, MAX(PERM_CUSTOM_5) as MAX_CUSTOM_5, MAX(PERM_CUSTOM_6) as MAX_CUSTOM_6, MAX(PERM_CUSTOM_7) as MAX_CUSTOM_7, "
|
||||
+ "MAX(PERM_CUSTOM_8) as MAX_CUSTOM_8, MAX(PERM_CUSTOM_9) as MAX_CUSTOM_9, MAX(PERM_CUSTOM_10) as MAX_CUSTOM_10, MAX(PERM_CUSTOM_11) as MAX_CUSTOM_11, MAX(PERM_CUSTOM_12) as MAX_CUSTOM_12 "
|
||||
+ "FROM WORKBASKET_ACCESS_LIST where ACCESS_ID IN (<if test='accessId != null'><foreach item='item' collection='accessId' separator=',' >#{item}</foreach></if>) group by WORKBASKET_ID ) a "
|
||||
+ "on (w.ID = a.WID)"
|
||||
+ "</if> "
|
||||
+ "<where>"
|
||||
+ "<if test='ownerIn != null'>AND w.OWNER IN(<foreach item='item' collection='ownerIn' separator=',' >#{item}</foreach>)</if> "
|
||||
+ "<if test='ownerLike != null'>AND (<foreach item='item' collection='ownerLike' separator=' OR ' >UPPER(w.OWNER) LIKE #{item}</foreach>)</if> "
|
||||
|
|
@ -239,8 +241,14 @@ public interface QueryMapper {
|
|||
+ "<if test='orgLevel3Like != null'>AND (<foreach item='item' collection='orgLevel3Like' separator=' OR ' >UPPER(w.ORG_LEVEL_3) LIKE #{item}</foreach>)</if> "
|
||||
+ "<if test='orgLevel4In != null'>AND UPPER(w.ORG_LEVEL_4) IN(<foreach item='item' collection='orgLevel4In' separator=',' >#{item}</foreach>)</if> "
|
||||
+ "<if test='orgLevel4Like != null'>AND (<foreach item='item' collection='orgLevel4Like' separator=' OR ' >UPPER(w.ORG_LEVEL_4) LIKE #{item}</foreach>)</if> "
|
||||
+ "<if test = 'joinWithAccessList'> "
|
||||
+ "<if test = 'checkReadPermission'> "
|
||||
+ "AND (a.MAX_READ = 1 "
|
||||
+ "</if> "
|
||||
+ "<if test='permission != null'>AND "
|
||||
+ "<if test = '!checkReadPermission'> "
|
||||
+ "( "
|
||||
+ "</if> "
|
||||
+ "<if test=\"permission.name().equals('READ')\">a.MAX_READ</if> "
|
||||
+ "<if test=\"permission.name().equals('OPEN')\">a.MAX_OPEN</if> "
|
||||
+ "<if test=\"permission.name().equals('APPEND')\">a.MAX_APPEND</if>"
|
||||
|
|
@ -259,6 +267,7 @@ public interface QueryMapper {
|
|||
+ "<if test=\"permission.name().equals('CUSTOM_11')\">a.MAX_CUSTOM_11</if>"
|
||||
+ "<if test=\"permission.name().equals('CUSTOM_12')\">a.MAX_CUSTOM_12</if> = 1 "
|
||||
+ "</if>)"
|
||||
+ "</if>"
|
||||
+ "</where>"
|
||||
+ "<if test='!orderBy.isEmpty()'>ORDER BY <foreach item='orderItem' collection='orderBy' separator=',' >${orderItem}</foreach></if> "
|
||||
+ "</script>")
|
||||
|
|
@ -429,12 +438,14 @@ public interface QueryMapper {
|
|||
|
||||
@Select("<script>"
|
||||
+ "SELECT COUNT(w.ID) from WORKBASKET w "
|
||||
+ "<if test = 'joinWithAccessList'> "
|
||||
+ "LEFT OUTER JOIN (select WORKBASKET_ID as WID, max(PERM_READ) as MAX_READ, max(PERM_OPEN) as MAX_OPEN, "
|
||||
+ "MAX(PERM_APPEND) as MAX_APPEND, MAX(PERM_TRANSFER) as MAX_TRANSFER, MAX(PERM_DISTRIBUTE) as MAX_DISTRIBUTE, MAX(PERM_CUSTOM_1) as MAX_CUSTOM_1, MAX(PERM_CUSTOM_2) as MAX_CUSTOM_2, "
|
||||
+ "MAX(PERM_CUSTOM_3) as MAX_CUSTOM_3, MAX(PERM_CUSTOM_4) as MAX_CUSTOM_4, MAX(PERM_CUSTOM_5) as MAX_CUSTOM_5, MAX(PERM_CUSTOM_6) as MAX_CUSTOM_6, MAX(PERM_CUSTOM_7) as MAX_CUSTOM_7, "
|
||||
+ "MAX(PERM_CUSTOM_8) as MAX_CUSTOM_8, MAX(PERM_CUSTOM_9) as MAX_CUSTOM_9, MAX(PERM_CUSTOM_10) as MAX_CUSTOM_10, MAX(PERM_CUSTOM_11) as MAX_CUSTOM_11, MAX(PERM_CUSTOM_12) as MAX_CUSTOM_12 "
|
||||
+ "FROM WORKBASKET_ACCESS_LIST where ACCESS_ID IN (<if test='accessId != null'><foreach item='item' collection='accessId' separator=',' >#{item}</foreach></if>) group by WORKBASKET_ID ) a "
|
||||
+ "on (w.ID = a.WID)"
|
||||
+ "</if> "
|
||||
+ "<where>"
|
||||
+ "<if test='ownerIn != null'>AND w.OWNER IN(<foreach item='item' collection='ownerIn' separator=',' >#{item}</foreach>)</if> "
|
||||
+ "<if test='ownerLike != null'>AND (<foreach item='item' collection='ownerLike' separator=' OR ' >UPPER(w.OWNER) LIKE #{item}</foreach>)</if> "
|
||||
|
|
@ -465,8 +476,14 @@ public interface QueryMapper {
|
|||
+ "<if test='orgLevel3Like != null'>AND (<foreach item='item' collection='orgLevel3Like' separator=' OR ' >UPPER(w.ORG_LEVEL_3) LIKE #{item}</foreach>)</if> "
|
||||
+ "<if test='orgLevel4In != null'>AND UPPER(w.ORG_LEVEL_4) IN(<foreach item='item' collection='orgLevel4In' separator=',' >#{item}</foreach>)</if> "
|
||||
+ "<if test='orgLevel4Like != null'>AND (<foreach item='item' collection='orgLevel4Like' separator=' OR ' >UPPER(w.ORG_LEVEL_4) LIKE #{item}</foreach>)</if> "
|
||||
+ "<if test = 'joinWithAccessList'> "
|
||||
+ "<if test = 'checkReadPermission'> "
|
||||
+ "AND (a.MAX_READ = 1 "
|
||||
+ "</if> "
|
||||
+ "<if test='permission != null'>AND "
|
||||
+ "<if test = '!checkReadPermission'> "
|
||||
+ "( "
|
||||
+ "</if> "
|
||||
+ "<if test=\"permission.name().equals('READ')\">a.MAX_READ</if> "
|
||||
+ "<if test=\"permission.name().equals('OPEN')\">a.MAX_OPEN</if> "
|
||||
+ "<if test=\"permission.name().equals('APPEND')\">a.MAX_APPEND</if>"
|
||||
|
|
@ -619,12 +636,14 @@ public interface QueryMapper {
|
|||
|
||||
@Select("<script>SELECT DISTINCT ${columnName} "
|
||||
+ "FROM WORKBASKET w "
|
||||
+ "<if test = 'joinWithAccessList'> "
|
||||
+ "LEFT OUTER JOIN (select WORKBASKET_ID as WID, max(PERM_READ) as MAX_READ, max(PERM_OPEN) as MAX_OPEN, "
|
||||
+ "MAX(PERM_APPEND) as MAX_APPEND, MAX(PERM_TRANSFER) as MAX_TRANSFER, MAX(PERM_DISTRIBUTE) as MAX_DISTRIBUTE, MAX(PERM_CUSTOM_1) as MAX_CUSTOM_1, MAX(PERM_CUSTOM_2) as MAX_CUSTOM_2, "
|
||||
+ "MAX(PERM_CUSTOM_3) as MAX_CUSTOM_3, MAX(PERM_CUSTOM_4) as MAX_CUSTOM_4, MAX(PERM_CUSTOM_5) as MAX_CUSTOM_5, MAX(PERM_CUSTOM_6) as MAX_CUSTOM_6, MAX(PERM_CUSTOM_7) as MAX_CUSTOM_7, "
|
||||
+ "MAX(PERM_CUSTOM_8) as MAX_CUSTOM_8, MAX(PERM_CUSTOM_9) as MAX_CUSTOM_9, MAX(PERM_CUSTOM_10) as MAX_CUSTOM_10, MAX(PERM_CUSTOM_11) as MAX_CUSTOM_11, MAX(PERM_CUSTOM_12) as MAX_CUSTOM_12 "
|
||||
+ "FROM WORKBASKET_ACCESS_LIST where ACCESS_ID IN (<if test='accessId != null'><foreach item='item' collection='accessId' separator=',' >#{item}</foreach></if>) group by WORKBASKET_ID ) a "
|
||||
+ "on (w.ID = a.WID)"
|
||||
+ "</if> "
|
||||
+ "<where>"
|
||||
+ "<if test='ownerIn != null'>AND w.OWNER IN(<foreach item='item' collection='ownerIn' separator=',' >#{item}</foreach>)</if> "
|
||||
+ "<if test='ownerLike != null'>AND (<foreach item='item' collection='ownerLike' separator=' OR ' >UPPER(w.OWNER) LIKE #{item}</foreach>)</if> "
|
||||
|
|
@ -655,8 +674,14 @@ public interface QueryMapper {
|
|||
+ "<if test='orgLevel3Like != null'>AND (<foreach item='item' collection='orgLevel3Like' separator=' OR ' >UPPER(w.ORG_LEVEL_3) LIKE #{item}</foreach>)</if> "
|
||||
+ "<if test='orgLevel4In != null'>AND UPPER(w.ORG_LEVEL_4) IN(<foreach item='item' collection='orgLevel4In' separator=',' >#{item}</foreach>)</if> "
|
||||
+ "<if test='orgLevel4Like != null'>AND (<foreach item='item' collection='orgLevel4Like' separator=' OR ' >UPPER(w.ORG_LEVEL_4) LIKE #{item}</foreach>)</if> "
|
||||
+ "<if test = 'joinWithAccessList'> "
|
||||
+ "<if test = 'checkReadPermission'> "
|
||||
+ "AND (a.MAX_READ = 1 "
|
||||
+ "</if> "
|
||||
+ "<if test='permission != null'>AND "
|
||||
+ "<if test = '!checkReadPermission'> "
|
||||
+ "( "
|
||||
+ "</if> "
|
||||
+ "<if test=\"permission.name().equals('READ')\">a.MAX_READ</if> "
|
||||
+ "<if test=\"permission.name().equals('OPEN')\">a.MAX_OPEN</if> "
|
||||
+ "<if test=\"permission.name().equals('APPEND')\">a.MAX_APPEND</if>"
|
||||
|
|
@ -675,6 +700,7 @@ public interface QueryMapper {
|
|||
+ "<if test=\"permission.name().equals('CUSTOM_11')\">a.MAX_CUSTOM_11</if>"
|
||||
+ "<if test=\"permission.name().equals('CUSTOM_12')\">a.MAX_CUSTOM_12</if> = 1 "
|
||||
+ "</if>)"
|
||||
+ "</if>"
|
||||
+ "</where>"
|
||||
+ "<if test='!orderBy.isEmpty()'>ORDER BY <foreach item='orderItem' collection='orderBy' separator=',' >${orderItem}</foreach></if> "
|
||||
+ "</script>")
|
||||
|
|
|
|||
Loading…
Reference in New Issue