litvinovg/vitro
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fix for release 1.5.2

Browse source 
Secure the DeletePageController. It was accessible to anyone who knew the link.
This commit is contained in:
j2blake 2013-04-15 12:23:14 -04:00
parent efdfaa9c8f
commit 91f0935109
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
webapp/src/edu/cornell/mannlib/vitro/webapp/controller/edit/DeletePageController.java
View file

@ -23,6 +23,7 @@ import com.hp.hpl.jena.rdf.model.Statement;
import com.hp.hpl.jena.rdf.model.StmtIterator;
import com.hp.hpl.jena.shared.Lock;
import edu.cornell.mannlib.vitro.webapp.auth.permissions.SimplePermission;
import edu.cornell.mannlib.vitro.webapp.controller.VitroHttpServlet;
import edu.cornell.mannlib.vitro.webapp.controller.VitroRequest;
import edu.cornell.mannlib.vitro.webapp.dao.DisplayVocabulary;
@ -38,6 +39,9 @@ public class DeletePageController extends VitroHttpServlet {
@Override
protected void doPost(HttpServletRequest rawRequest, HttpServletResponse resp)
throws ServletException, IOException {
if (!isAuthorizedToDisplayPage(rawRequest, resp, SimplePermission.MANAGE_MENUS.ACTION)) {
return;
}
removeStatements = ModelFactory.createDefaultModel();
VitroRequest vreq = new VitroRequest(rawRequest);
String pageUri = vreq.getParameter("pageURI");