Changeset 5892 for DASISH


Ignore:
Timestamp:
12/05/14 13:53:55 (9 years ago)
Author:
olhsha@mpi.nl
Message:

removed (commented) insecure api that allowed to download pictures from the Internet (URL) to the database

Location:
DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/CHANGES.txt

    r5840 r5892  
    7474November 20, 2014.  A new feature: an "all" access mode is added. The user with this permission have
    7575the same rights as the owner, that it he can update permissions on the annotation
    76 and delete it at all. Also, the pieces of code handling permissions, have been refactored.
     76and delete it at all. Also, the pieces of code handling permissions, have been refactored.
     77
     78November 24, 2014. The inconvenience is fixed. In the previous version when the user with "write"
     79access tried to update the whole annotation (including persmissions) the server ignored permission
     80update part but the user was not notified. Now it is fixed: 403 is thrown is the permissions differ
     81from the given ones.
     82
     83December 5, 2014. The insecure API that allows to download pictures from the internet to the
     84database, as a cahced representation, has been removed (commented in the code). This API was used
     85for convenience to created demo data, and was not a part of the specification.

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/UPDATE.txt

    r5850 r5892  
    1 Placing tarball: take the tar-ball of the new  version 1.6.1-basic-authentication, and follow the
    2 standard MPI deployment procedure. The "current-nonshib" should link to this package.
     1This is the a simple deployemnt that does not demand changings in the context.xml, web.xml-s
     2and in the database.
    33
    4 No changings are to be done in context.xml and in the data-base because they are the same as
    5 for the sibboleth version, abd it works.
     4Placing tarball: take the tar-ball of the version 1.6.3-basic-authentication, and follow the
     5standard first MPI deployment procedure. The "current" for lux17:mpi.nl/ds/webannotator-basic
     6(respectively corpus1:mpi.nl/ds/webannotator-basic) should link to  this package.
    67
    7 The splitting between logging of shibboleth and basic versions will be implemented in
    8 next deployments
    98
    109

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/pom.xml

    r5850 r5892  
    55    <groupId>eu.dasish.annotation</groupId>
    66    <artifactId>annotator-backend</artifactId>
    7     <version>1.6.1-basic-authentication</version>   
     7    <version>1.6.3-shibboleth</version>   
    88    <packaging>war</packaging>
    99    <name>annotator-backend Jersey Webapp</name>

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/CachedRepresentationResource.java

    r5836 r5892  
    181181    }
    182182
    183     @PUT
    184     @Consumes("text/plain")
    185     @Produces(MediaType.APPLICATION_XML)
    186     @Path("{cachedid: " + BackendConstants.regExpIdentifier + "}/path/{isurl}")
    187     public String updateCachedBlobFromFile(@PathParam("cachedid") String cachedIdentifier,
    188             @PathParam("isurl") String isURL, String blobPath) throws IOException {
    189         Map params = new HashMap();
    190         InputStream input;
    191 
    192         if (isURL.equals("URL")) {
    193             URL blob = new URL(blobPath);
    194             input = blob.openStream();
    195         } else {
    196             input = new FileInputStream(blobPath);
    197         }
    198 
    199         params.put("stream", input);
    200         try {
    201             Integer result = (Integer) (new RequestWrappers(this)).wrapRequestResource(params, new UpdateCachedBlob(), Resource.CACHED_REPRESENTATION, Access.WRITE, cachedIdentifier);
    202             input.close();
    203             if (result != null) {
    204                 return result + "rows are updated";
    205             } else {
    206                 return "Nothing is updated. ";
    207             }
    208         } catch (NotInDataBaseException e1) {
    209             httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND, e1.getMessage());
    210             return e1.getMessage();
    211         } catch (ForbiddenException e2) {
    212             httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
    213             return e2.getMessage();
    214         }
    215 
    216     }
    217 
     183//    @PUT
     184//    @Consumes("text/plain")
     185//    @Produces(MediaType.APPLICATION_XML)
     186//    @Path("{cachedid: " + BackendConstants.regExpIdentifier + "}/path/{isurl}")
     187//    public String updateCachedBlobFromFile(@PathParam("cachedid") String cachedIdentifier,
     188//            @PathParam("isurl") String isURL, String blobPath) throws IOException {
     189//        Map params = new HashMap();
     190//        InputStream input;
     191//
     192//        if (isURL.equals("URL")) {
     193//            URL blob = new URL(blobPath);
     194//            input = blob.openStream();
     195//        } else {
     196//            input = new FileInputStream(blobPath);
     197//        }
     198//
     199//        params.put("stream", input);
     200//        try {
     201//            Integer result = (Integer) (new RequestWrappers(this)).wrapRequestResource(params, new UpdateCachedBlob(), Resource.CACHED_REPRESENTATION, Access.WRITE, cachedIdentifier);
     202//            input.close();
     203//            if (result != null) {
     204//                return result + "rows are updated";
     205//            } else {
     206//                return "Nothing is updated. ";
     207//            }
     208//        } catch (NotInDataBaseException e1) {
     209//            httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND, e1.getMessage());
     210//            return e1.getMessage();
     211//        } catch (ForbiddenException e2) {
     212//            httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, e2.getMessage());
     213//            return e2.getMessage();
     214//        }
     215//
     216//    }
     217//
    218218    private class UpdateCachedBlob implements ILambda<Map, Integer> {
    219219

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/java/eu/dasish/annotation/backend/rest/DebugResource.java

    r5685 r5892  
    164164        Number remotePrincipalID = this.getPrincipalID();
    165165        if (remotePrincipalID == null) {
    166             return "null in;ogged principal";
     166            return "null inlogged principal";
    167167        }
    168168        String typeOfAccount = dbDispatcher.getTypeOfPrincipalAccount(remotePrincipalID);

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/webapp/WEB-INF/shhaa.xml

    r5850 r5892  
    3838                <username>anonymous</username>
    3939            </fallback>
    40             <sso action="lI">https://lux17.mpi.nl/Shibboleth.sso/Login</sso>
    41             <slo action="lO">https://lux17.mpi.nl/Shibboleth.sso/Logout</slo>
     40            <sso action="lI">https://corpus1.mpi.nl/Shibboleth.sso/Login</sso>
     41            <slo action="lO">https://corpus1.mpi.nl/Shibboleth.sso/Logout</slo>
    4242        </authentication>
    4343       

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/webapp/WEB-INF/web.xml

    r5850 r5892  
    4040    <context-param>
    4141        <param-name>eu.dasish.annotation.backend.isShibbolethSession</param-name>
    42         <param-value>false</param-value>
     42        <param-value>true</param-value>
    4343    </context-param>
    4444    <context-param>
    … …  
    4848    <context-param>
    4949        <param-name>eu.dasish.annotation.backend.logout.shibboleth</param-name>
    50         <param-value>https://lux17.mpi.nl/Shibboleth.sso/Logout</param-value>
     50        <param-value>https://corpus1.mpi.nl/Shibboleth.sso/Logout</param-value>
    5151    </context-param>
    5252   
    … …  
    111111   
    112112    <!-- Spring security -->
    113      <filter>
     113<!--      <filter>
    114114        <filter-name>springSecurityFilterChain</filter-name>
    115115        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    … …  
    118118        <filter-name>springSecurityFilterChain</filter-name>
    119119        <url-pattern>/*</url-pattern>
    120     </filter-mapping>
     120    </filter-mapping> -->
    121121   
    122     <!--  Shibboleth filter -->
    123    <!-- <filter>
     122    <!-- Shibboleth filter -->
     123  <filter>
    124124        <filter-name>AAIFilter</filter-name>
    125125        <filter-class>de.mpg.aai.shhaa.AuthFilter</filter-class>
    … …  
    128128        <filter-name>AAIFilter</filter-name>
    129129        <url-pattern>/*</url-pattern>
    130     </filter-mapping> -->
     130    </filter-mapping>
    131131   
    132132  </web-app> 

  • DASISH/t5.6/backend/annotator-backend/trunk/annotator-backend/src/main/webapp/index.jsp

    r5690 r5892  
    5555        GET <a href="api/authentication/principal">api/authentication/principal</a> <br>
    5656        GET <a href="api/principals/admin">api/principals/admin</a><br>
    57         GET <a href="api/principals/00000000-0000-0000-0000-0000000000112">api/principals/00000000-0000-0000-0000-0000000000112</a> <br>
    58         GET <a href="api/principals/00000000-0000-0000-0000-0000000000112/current">api/principals/00000000-0000-0000-0000-0000000000112/current</a><br> 
     57        GET <a href="api/principals/a0000000-0000-0000-0000-0000000000114">api/principals/a0000000-0000-0000-0000-0000000000114</a> <br>
     58        GET <a href="api/principals/a0000000-0000-0000-0000-0000000000114/current">api/principals/a0000000-0000-0000-0000-0000000000114/current</a><br> 
    5959<!--        !Problem: how to ask the servlet if the given user is logged in, may be by some other running somewhere client<br> -->
    60         GET <a href="api/principals/info?email=Twan.Goosen@mpi.nl">api/principals/info?email=Twan.Goosen@mpi.nl</a>  <br>
     60        GET <a href="api/principals/info?email=Twan.Goosen@mpi.nl">api/principals/info?email=twan.Goosen@mpi.nl</a>  <br>
    6161        GET <a href="api/annotations?link=Sagrada&matchMode=contains">api/annotations?link=Sagrada&matchMode=contains</a>  <br>
    6262        GET <a href="api/annotations?link=http://nl.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia&matchMode=exact">api/annotations?link=http://nl.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia&matchMode=exact</a>  <br>
    … …  
    6565        GET <a href="api/annotations?link=http://nl.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia">api/annotations?link=http://nl.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia</a>  <br>
    6666        GET <a href="api/annotations?link=http://nl.wikipedia.org/wiki/Antoni_Gaud%C3%AD">api/annotations?link=http://nl.wikipedia.org/wiki/Antoni_Gaud%C3%AD</a>  <br>
    67         GET <a href="api/annotations?after=2013-02-04 15:57:58.046908&before=2014-06-25 10:08:16.213186">api/annotations?after=2014-02-04 15:57:58.046908&before=2014-04-06 10:08:16.213186</a><br>
     67        GET <a href="api/annotations?after=2013-02-04 15:57:58.046908&before=2014-12-31 10:08:16.213186">api/annotations?after=2014-02-04 15:57:58.046908&before=2014-12-31 10:08:16.213186</a><br>
    6868<!--        !Comment: What is "namespace" query parameter? Must be implemented and tested <br>-->
    69         GET <a href="api/annotations/00000000-0000-0000-0000-000000000022">api/annotations/00000000-0000-0000-0000-000000000022</a>  </br>
    70         GET <a href="api/annotations/00000000-0000-0000-0000-000000000022/targets">api/annotations/00000000-0000-0000-0000-000000000022/targets</a>  </br>
    71         GET <a href="api/annotations/00000000-0000-0000-0000-000000000022/permissions">api/annotations/00000000-0000-0000-0000-000000000022/permissions</a><br>
    72         GET <a href="api/targets/00000000-0000-0000-0000-000000000032">api/targets/00000000-0000-0000-0000-000000000032</a>  <br>
    73         GET <a href="api/targets/00000000-0000-0000-0000-000000000032/versions">api/targets/00000000-0000-0000-0000-000000000032/versions</a>   <br>
    74         GET <a href="api/cached/b0d3f18c-eecf-40ea-9979-eecbbdca7d68/metadata">api/cached/b0d3f18c-eecf-40ea-9979-eecbbdca7d68/metadata</a><br>
    75         GET <a href="api/cached/b0d3f18c-eecf-40ea-9979-eecbbdca7d68/stream">api/cached/b0d3f18c-eecf-40ea-9979-eecbbdca7d68/stream</a><br>
    76         GET <a href="api/cached/00000000-0000-0000-0000-000000000051/content">api/cached/00000000-0000-0000-0000-000000000051/content</a><br>
    77         GET <a href="api/cached/de82f9d5-6b84-4c9d-8b8a-0736c8b1dd79/stream">api/cached/de82f9d5-6b84-4c9d-8b8a-0736c8b1dd79/stream</a><br>
     69        GET <a href="api/annotations/a0000000-0000-0000-0000-000000000022">api/annotations/a0000000-0000-0000-0000-000000000022</a>  </br>
     70        GET <a href="api/annotations/a0000000-0000-0000-0000-000000000022/targets">api/annotations/a0000000-0000-0000-0000-000000000022/targets</a>  </br>
     71        GET <a href="api/annotations/a0000000-0000-0000-0000-000000000022/permissions">api/annotations/a0000000-0000-0000-0000-000000000022/permissions</a><br>
     72        GET <a href="api/targets/a0000000-0000-0000-0000-000000000032">api/targets/a0000000-0000-0000-0000-000000000032</a>  <br>
     73        GET <a href="api/targets/a0000000-0000-0000-0000-000000000032/versions">api/targets/a0000000-0000-0000-0000-000000000032/versions</a>   <br>
     74        GET <a href="api/cached/a0000000-0000-0000-0000-000000000051/metadata">api/cached/a0000000-0000-0000-0000-000000000051/metadata</a><br>
     75        GET <a href="api/cached/a0000000-0000-0000-0000-000000000511/content">api/cached/a0000000-0000-0000-0000-0000000000511/content</a><br>
     76        GET <a href="api/cached/a0000000-0000-0000-0000-000000000051/stream">api/cached/a0000000-0000-0000-0000-000000000051/stream</a><br>
    7877       
    7978       
Note: See TracChangeset for help on using the changeset viewer.