diff --git a/webapp/src/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicy.java b/webapp/src/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicy.java index 3b48305e0..408f8586e 100644 --- a/webapp/src/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicy.java +++ b/webapp/src/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicy.java @@ -194,13 +194,13 @@ public class SelfEditingPolicy implements VisitingPolicyIface { if( uri == null || uri.length() == 0 ) return false; - if( editableVitroUris.contains( uri ) ) - return true; - if( prohibitedProperties.contains(uri)) { log.debug("The uri "+uri+" represents a predicate that cannot be modified because it is on a list of properties prohibited from self editing"); return false; } + + if( editableVitroUris.contains( uri ) ) + return true; String namespace = uri.substring(0, Util.splitNamespace(uri)); //Matcher match = ns.matcher(uri); @@ -276,7 +276,7 @@ public class SelfEditingPolicy implements VisitingPolicyIface { } //many predicates are prohibited by namespace but there are many ones that self editors need to work with - if( prohibitedNs.contains(action.uriOfPredicate() ) && ! editableVitroUris.contains( action.uriOfPredicate() ) ) { + if( prohibitedNs.contains(action.uriOfPredicate() ) ) { log.debug("SelfEditingPolicy for DropDatapropStmt is inconclusive because it does not grant access to admin controls"); return new BasicPolicyDecision(this.defaultFailure,"SelfEditingPolicy does not grant access to admin controls"); } @@ -338,10 +338,8 @@ public class SelfEditingPolicy implements VisitingPolicyIface { if( prohibitedNs.contains( action.getResourceUri() ) ) return new BasicPolicyDecision(this.defaultFailure,"SelfEditingPolicy does not grant access to admin resources"); - //many predicates are prohibited by namespace but there are many ones that self editors need to work with - if( prohibitedNs.contains(action.getDataPropUri() ) && ! editableVitroUris.contains( action.getDataPropUri() ) ) + if( prohibitedProperties.contains( action.getDataPropUri() ) ) return new BasicPolicyDecision(this.defaultFailure,"SelfEditingPolicy does not grant access to admin controls"); - if( !canModifyPredicate( action.getDataPropUri() ) ) return new BasicPolicyDecision(this.defaultFailure,"SelfEditingPolicy does not grant access to admin predicates; " + diff --git a/webapp/test/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicyTest.java b/webapp/test/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicyTest.java index c84c52141..97075ccf7 100644 --- a/webapp/test/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicyTest.java +++ b/webapp/test/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicyTest.java @@ -17,6 +17,7 @@ import edu.cornell.mannlib.vitro.webapp.auth.policy.ifaces.Authorization; import edu.cornell.mannlib.vitro.webapp.auth.policy.ifaces.PolicyDecision; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.AddDataPropStmt; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.AddObjectPropStmt; +import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.DropDataPropStmt; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.DropObjectPropStmt; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.EditDataPropStmt; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.EditObjPropStmt; @@ -178,7 +179,63 @@ public class SelfEditingPolicyTest extends AbstractTestClass { Assert.assertNotNull(dec); Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized()); } - + + @Test + public void testForbiddenMoniker(){ + Set badProps = new HashSet(); + badProps.add(VitroVocabulary.MONIKER); + SelfEditingPolicy badPropPolicy = new SelfEditingPolicy(badProps,null,null,null); + + RequestedAction whatToAuth = null; + + whatToAuth = new AddDataPropStmt( + SELFEDITOR_URI, VitroVocabulary.MONIKER ,"someValue", null, null); + PolicyDecision dec = badPropPolicy.isAuthorized(ids, whatToAuth); + Assert.assertNotNull(dec); + Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized()); + + whatToAuth = new AddDataPropStmt( + SAFE_RESOURCE ,VitroVocabulary.MONIKER , "somevalue", null, null); + dec = badPropPolicy.isAuthorized(ids, whatToAuth); + Assert.assertNotNull(dec); + Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized()); + + DataPropertyStatement dps = new DataPropertyStatementImpl(); + dps.setIndividualURI(SELFEDITOR_URI); + dps.setDatapropURI(VitroVocabulary.MONIKER); + dps.setData("some moniker"); + whatToAuth = new EditDataPropStmt(dps); + dec = badPropPolicy.isAuthorized(ids, whatToAuth); + Assert.assertNotNull(dec); + Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized()); + + + //try where moniker is permitted + badProps = new HashSet(); + badPropPolicy = new SelfEditingPolicy(badProps,null,null,null); + + whatToAuth = new AddDataPropStmt( + SELFEDITOR_URI, VitroVocabulary.MONIKER ,"somevalue", null, null); + dec = badPropPolicy.isAuthorized(ids, whatToAuth); + Assert.assertNotNull(dec); + Assert.assertEquals(Authorization.AUTHORIZED, dec.getAuthorized()); + + whatToAuth = new AddDataPropStmt( + UNSAFE_RESOURCE ,VitroVocabulary.MONIKER , "somevalue", null, null); + dec = badPropPolicy.isAuthorized(ids, whatToAuth); + Assert.assertNotNull(dec); + Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized()); + + dps = new DataPropertyStatementImpl(); + dps.setIndividualURI(SAFE_RESOURCE); + dps.setDatapropURI(VitroVocabulary.MONIKER); + dps.setData("some moniker"); + whatToAuth = new EditDataPropStmt(dps); + dec = badPropPolicy.isAuthorized(ids, whatToAuth); + Assert.assertNotNull(dec); + Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized()); + } + @Test public void testVisitIdentifierBundleAddObjectPropStmt() { AddObjectPropStmt whatToAuth = new AddObjectPropStmt( diff --git a/webapp/web/templates/entity/entityBasic.jsp b/webapp/web/templates/entity/entityBasic.jsp index d8bbbde40..d223fd7e8 100644 --- a/webapp/web/templates/entity/entityBasic.jsp +++ b/webapp/web/templates/entity/entityBasic.jsp @@ -119,10 +119,13 @@ if (VitroRequestPrep.isSelfEditing(request) || LoginFormBean.loggedIn(request, L <%-- Moniker. Wrap in the div only if editing. If not editing, displays inline next to label. --%> -
-

moniker

- + + +
+

moniker

+ +
@@ -136,17 +139,19 @@ if (VitroRequestPrep.isSelfEditing(request) || LoginFormBean.loggedIn(request, L
-
<%-- end dprop-vitro-moniker --%> + +
<%-- end dprop-vitro-moniker --%> - <%-- Links --%> - + <%-- Links --%>