aboutsummaryrefslogtreecommitdiff
path: root/src/org/traccar/http/BaseServlet.java
diff options
context:
space:
mode:
authorAnton Tananaev <anton.tananaev@gmail.com>2015-06-13 17:36:31 +1200
committerAnton Tananaev <anton.tananaev@gmail.com>2015-06-13 17:36:31 +1200
commitfc75fe4ab4f8ea9de58c41772fdd92c10c73f2bc (patch)
tree9418ef08d1b5d8858922b90e4c0b9e2f1747b2ee /src/org/traccar/http/BaseServlet.java
parentbd4c32abced2bb654b64a2042668340167d6b191 (diff)
downloadtrackermap-server-fc75fe4ab4f8ea9de58c41772fdd92c10c73f2bc.tar.gz
trackermap-server-fc75fe4ab4f8ea9de58c41772fdd92c10c73f2bc.tar.bz2
trackermap-server-fc75fe4ab4f8ea9de58c41772fdd92c10c73f2bc.zip
Fix API access permissions
Diffstat (limited to 'src/org/traccar/http/BaseServlet.java')
-rw-r--r--src/org/traccar/http/BaseServlet.java13
1 files changed, 9 insertions, 4 deletions
diff --git a/src/org/traccar/http/BaseServlet.java b/src/org/traccar/http/BaseServlet.java
index be4b41631..9dba2e647 100644
--- a/src/org/traccar/http/BaseServlet.java
+++ b/src/org/traccar/http/BaseServlet.java
@@ -25,7 +25,6 @@ import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
import org.traccar.model.User;
public abstract class BaseServlet extends HttpServlet {
@@ -46,14 +45,20 @@ public abstract class BaseServlet extends HttpServlet {
protected abstract boolean handle(String command, HttpServletRequest req, HttpServletResponse resp) throws Exception;
- public long getUserId(HttpSession session) {
- User user = (User) session.getAttribute(USER_KEY);
+ public long getUserId(HttpServletRequest req) {
+ User user = (User) req.getSession().getAttribute(USER_KEY);
if (user == null) {
- throw new AccessControlException("User is not logged in");
+ throw new AccessControlException("User not logged in");
}
return user.getId();
}
+ public void securityCheck(boolean check) throws SecurityException {
+ if (!check) {
+ throw new SecurityException("Access denied");
+ }
+ }
+
public void sendResponse(Writer writer, boolean success) throws IOException {
JsonObjectBuilder result = Json.createObjectBuilder();
result.add("success", success);