hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-07 10:04:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

#3116 Security issue in discovery

Browse Source 
Fix in PreAuthorize (making sure it's not ignored)
This commit is contained in:
Ben Bosman
2021-02-04 13:04:54 +01:00
parent ca0786a067
commit 7515fb2075
2 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
dspace-server-webapp/src/main/java/org/dspace/app/rest/converter/DiscoverResultConverter.java
View File

@@ -38,6 +38,10 @@ public class DiscoverResultConverter {
@Autowired
private List<IndexableObjectConverter> converters;
@Autowired
protected ConverterService converter;
@Autowired
private DiscoverFacetsConverter facetConverter;
@Autowired
@@ -93,12 +97,7 @@ public class DiscoverResultConverter {
private RestAddressableModel convertDSpaceObject(final IndexableObject indexableObject,
final Projection projection) {
for (IndexableObjectConverter<Object, RestAddressableModel> converter : converters) {
if (converter.supportsModel(indexableObject)) {
return converter.convert(indexableObject.getIndexedObject(), projection);
}
}
return null;
return converter.toRest(indexableObject.getIndexedObject(), projection);
}
private void setRequestInformation(final Context context, final String query, final List<String> dsoTypes,

14
dspace-server-webapp/src/test/java/org/dspace/app/rest/DiscoveryRestControllerIT.java
View File

@@ -1924,7 +1924,7 @@ public class DiscoveryRestControllerIT extends AbstractControllerIntegrationTest
.build();
Item publicItem3 = ItemBuilder.createItem(context, col2)
.withTitle("Public item 2")
.withTitle("Embargoed item 2")
.withIssueDate("2010-02-13")
.withAuthor("Smith, Maria").withAuthor("Doe, Jane").withAuthor("test,test")
.withAuthor("test2, test2").withAuthor("Maybe, Maybe")
@@ -1946,7 +1946,7 @@ public class DiscoveryRestControllerIT extends AbstractControllerIntegrationTest
.andExpect(jsonPath("$.type", is("discover")))
//The page object needs to look like this
.andExpect(jsonPath("$._embedded.searchResult.page", is(
PageMatcher.pageEntry(0, 20)
PageMatcher.pageEntryWithTotalPagesAndElements(0, 20, 1, 6)
)))
//These are the items that aren't set to private
.andExpect(jsonPath("$._embedded.searchResult._embedded.objects", Matchers.hasItems(
@@ -1955,12 +1955,16 @@ public class DiscoveryRestControllerIT extends AbstractControllerIntegrationTest
//Collections are specified like this because they don't have any special properties
SearchResultMatcher.match(),
SearchResultMatcher.match(),
SearchResultMatcher.matchOnItemName("item", "items", "Test"),
SearchResultMatcher.matchOnItemName("item", "items", "Public item 2")
SearchResultMatcher.matchOnItemName("item", "items", "Test")
)))
//This is a private item, this shouldn't show up in the result
.andExpect(jsonPath("$._embedded.searchResult._embedded.objects",
Matchers.not(SearchResultMatcher.matchOnItemName("item", "items", "Test 2"))))
Matchers.not(
Matchers.anyOf(
SearchResultMatcher.matchOnItemName("item", "items", "Test 2"),
SearchResultMatcher.matchOnItemName("item", "items", "Embargoed item 2")
)
)))
//These facets have to show up in the embedded.facets section as well with the given hasMore
// property because we don't exceed their default limit for a hasMore true (the default is 10)
.andExpect(jsonPath("$._embedded.facets", Matchers.containsInAnyOrder(