aboutsummaryrefslogtreecommitdiff
path: root/subsonic-main/src/main/java/net/sourceforge/subsonic/service/SecurityService.java
diff options
context:
space:
mode:
Diffstat (limited to 'subsonic-main/src/main/java/net/sourceforge/subsonic/service/SecurityService.java')
-rw-r--r--subsonic-main/src/main/java/net/sourceforge/subsonic/service/SecurityService.java303
1 files changed, 0 insertions, 303 deletions
diff --git a/subsonic-main/src/main/java/net/sourceforge/subsonic/service/SecurityService.java b/subsonic-main/src/main/java/net/sourceforge/subsonic/service/SecurityService.java
deleted file mode 100644
index d6ca871d..00000000
--- a/subsonic-main/src/main/java/net/sourceforge/subsonic/service/SecurityService.java
+++ /dev/null
@@ -1,303 +0,0 @@
-/*
- This file is part of Subsonic.
-
- Subsonic is free software: you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation, either version 3 of the License, or
- (at your option) any later version.
-
- Subsonic is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with Subsonic. If not, see <http://www.gnu.org/licenses/>.
-
- Copyright 2009 (C) Sindre Mehus
- */
-package net.sourceforge.subsonic.service;
-
-import java.io.File;
-import java.util.List;
-
-import javax.servlet.http.HttpServletRequest;
-
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.GrantedAuthorityImpl;
-import org.acegisecurity.providers.dao.DaoAuthenticationProvider;
-import org.acegisecurity.userdetails.UserDetails;
-import org.acegisecurity.userdetails.UserDetailsService;
-import org.acegisecurity.userdetails.UsernameNotFoundException;
-import org.acegisecurity.wrapper.SecurityContextHolderAwareRequestWrapper;
-import org.springframework.dao.DataAccessException;
-
-import net.sf.ehcache.Ehcache;
-import net.sourceforge.subsonic.Logger;
-import net.sourceforge.subsonic.dao.UserDao;
-import net.sourceforge.subsonic.domain.MusicFolder;
-import net.sourceforge.subsonic.domain.User;
-import net.sourceforge.subsonic.util.FileUtil;
-
-/**
- * Provides security-related services for authentication and authorization.
- *
- * @author Sindre Mehus
- */
-public class SecurityService implements UserDetailsService {
-
- private static final Logger LOG = Logger.getLogger(SecurityService.class);
-
- private UserDao userDao;
- private SettingsService settingsService;
- private Ehcache userCache;
-
- /**
- * Locates the user based on the username.
- *
- * @param username The username presented to the {@link DaoAuthenticationProvider}
- * @return A fully populated user record (never <code>null</code>)
- * @throws UsernameNotFoundException if the user could not be found or the user has no GrantedAuthority.
- * @throws DataAccessException If user could not be found for a repository-specific reason.
- */
- public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {
- User user = getUserByName(username);
- if (user == null) {
- throw new UsernameNotFoundException("User \"" + username + "\" was not found.");
- }
-
- String[] roles = userDao.getRolesForUser(username);
- GrantedAuthority[] authorities = new GrantedAuthority[roles.length];
- for (int i = 0; i < roles.length; i++) {
- authorities[i] = new GrantedAuthorityImpl("ROLE_" + roles[i].toUpperCase());
- }
-
- // If user is LDAP authenticated, disable user. The proper authentication should in that case
- // be done by SubsonicLdapBindAuthenticator.
- boolean enabled = !user.isLdapAuthenticated();
-
- return new org.acegisecurity.userdetails.User(username, user.getPassword(), enabled, true, true, true, authorities);
- }
-
- /**
- * Returns the currently logged-in user for the given HTTP request.
- *
- * @param request The HTTP request.
- * @return The logged-in user, or <code>null</code>.
- */
- public User getCurrentUser(HttpServletRequest request) {
- String username = getCurrentUsername(request);
- return username == null ? null : userDao.getUserByName(username);
- }
-
- /**
- * Returns the name of the currently logged-in user.
- *
- * @param request The HTTP request.
- * @return The name of the logged-in user, or <code>null</code>.
- */
- public String getCurrentUsername(HttpServletRequest request) {
- return new SecurityContextHolderAwareRequestWrapper(request, null).getRemoteUser();
- }
-
- /**
- * Returns the user with the given username.
- *
- * @param username The username used when logging in.
- * @return The user, or <code>null</code> if not found.
- */
- public User getUserByName(String username) {
- return userDao.getUserByName(username);
- }
-
- /**
- * Returns the user with the given email address.
- *
- * @param email The email address.
- * @return The user, or <code>null</code> if not found.
- */
- public User getUserByEmail(String email) {
- return userDao.getUserByEmail(email);
- }
-
- /**
- * Returns all users.
- *
- * @return Possibly empty array of all users.
- */
- public List<User> getAllUsers() {
- return userDao.getAllUsers();
- }
-
- /**
- * Returns whether the given user has administrative rights.
- */
- public boolean isAdmin(String username) {
- if (User.USERNAME_ADMIN.equals(username)) {
- return true;
- }
- User user = getUserByName(username);
- return user != null && user.isAdminRole();
- }
-
- /**
- * Creates a new user.
- *
- * @param user The user to create.
- */
- public void createUser(User user) {
- userDao.createUser(user);
- LOG.info("Created user " + user.getUsername());
- }
-
- /**
- * Deletes the user with the given username.
- *
- * @param username The username.
- */
- public void deleteUser(String username) {
- userDao.deleteUser(username);
- LOG.info("Deleted user " + username);
- userCache.remove(username);
- }
-
- /**
- * Updates the given user.
- *
- * @param user The user to update.
- */
- public void updateUser(User user) {
- userDao.updateUser(user);
- userCache.remove(user.getUsername());
- }
-
- /**
- * Updates the byte counts for given user.
- *
- * @param user The user to update, may be <code>null</code>.
- * @param bytesStreamedDelta Increment bytes streamed count with this value.
- * @param bytesDownloadedDelta Increment bytes downloaded count with this value.
- * @param bytesUploadedDelta Increment bytes uploaded count with this value.
- */
- public void updateUserByteCounts(User user, long bytesStreamedDelta, long bytesDownloadedDelta, long bytesUploadedDelta) {
- if (user == null) {
- return;
- }
-
- user.setBytesStreamed(user.getBytesStreamed() + bytesStreamedDelta);
- user.setBytesDownloaded(user.getBytesDownloaded() + bytesDownloadedDelta);
- user.setBytesUploaded(user.getBytesUploaded() + bytesUploadedDelta);
-
- userDao.updateUser(user);
- }
-
- /**
- * Returns whether the given file may be read.
- *
- * @return Whether the given file may be read.
- */
- public boolean isReadAllowed(File file) {
- // Allowed to read from both music folder and podcast folder.
- return isInMusicFolder(file) || isInPodcastFolder(file);
- }
-
- /**
- * Returns whether the given file may be written, created or deleted.
- *
- * @return Whether the given file may be written, created or deleted.
- */
- public boolean isWriteAllowed(File file) {
- // Only allowed to write podcasts or cover art.
- boolean isPodcast = isInPodcastFolder(file);
- boolean isCoverArt = isInMusicFolder(file) && file.getName().startsWith("cover.");
-
- return isPodcast || isCoverArt;
- }
-
- /**
- * Returns whether the given file may be uploaded.
- *
- * @return Whether the given file may be uploaded.
- */
- public boolean isUploadAllowed(File file) {
- return isInMusicFolder(file) && !FileUtil.exists(file);
- }
-
- /**
- * Returns whether the given file is located in one of the music folders (or any of their sub-folders).
- *
- * @param file The file in question.
- * @return Whether the given file is located in one of the music folders.
- */
- private boolean isInMusicFolder(File file) {
- return getMusicFolderForFile(file) != null;
- }
-
- private MusicFolder getMusicFolderForFile(File file) {
- List<MusicFolder> folders = settingsService.getAllMusicFolders(false, true);
- String path = file.getPath();
- for (MusicFolder folder : folders) {
- if (isFileInFolder(path, folder.getPath().getPath())) {
- return folder;
- }
- }
- return null;
- }
-
- /**
- * Returns whether the given file is located in the Podcast folder (or any of its sub-folders).
- *
- * @param file The file in question.
- * @return Whether the given file is located in the Podcast folder.
- */
- private boolean isInPodcastFolder(File file) {
- String podcastFolder = settingsService.getPodcastFolder();
- return isFileInFolder(file.getPath(), podcastFolder);
- }
-
- public String getRootFolderForFile(File file) {
- MusicFolder folder = getMusicFolderForFile(file);
- if (folder != null) {
- return folder.getPath().getPath();
- }
-
- if (isInPodcastFolder(file)) {
- return settingsService.getPodcastFolder();
- }
- return null;
- }
-
- /**
- * Returns whether the given file is located in the given folder (or any of its sub-folders).
- * If the given file contains the expression ".." (indicating a reference to the parent directory),
- * this method will return <code>false</code>.
- *
- * @param file The file in question.
- * @param folder The folder in question.
- * @return Whether the given file is located in the given folder.
- */
- protected boolean isFileInFolder(String file, String folder) {
- // Deny access if file contains ".." surrounded by slashes (or end of line).
- if (file.matches(".*(/|\\\\)\\.\\.(/|\\\\|$).*")) {
- return false;
- }
-
- // Convert slashes.
- file = file.replace('\\', '/');
- folder = folder.replace('\\', '/');
-
- return file.toUpperCase().startsWith(folder.toUpperCase());
- }
-
- public void setSettingsService(SettingsService settingsService) {
- this.settingsService = settingsService;
- }
-
- public void setUserDao(UserDao userDao) {
- this.userDao = userDao;
- }
-
- public void setUserCache(Ehcache userCache) {
- this.userCache = userCache;
- }
-} \ No newline at end of file
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-18 12:56:21 +0000