[Task 70871] implemented default preauthorize setting

DSpace · May 13, 2020 · 262d81a · 262d81a
1 parent ea538d6
commit 262d81a
Show file tree

Hide file tree

Showing 11 changed files with 18 additions and 0 deletions.
diff --git a/...er-webapp/src/main/java/org/dspace/app/rest/repository/BitstreamFormatRestRepository.java b/...er-webapp/src/main/java/org/dspace/app/rest/repository/BitstreamFormatRestRepository.java
@@ -42,6 +42,7 @@ public class BitstreamFormatRestRepository extends DSpaceRestRepository<Bitstrea
     BitstreamFormatService bitstreamFormatService;
 
     @Override
+    @PreAuthorize("permitAll()")
     public BitstreamFormatRest findOne(Context context, Integer id) {
         BitstreamFormat bit = null;
         try {

diff --git a/...server-webapp/src/main/java/org/dspace/app/rest/repository/BrowseIndexRestRepository.java b/...server-webapp/src/main/java/org/dspace/app/rest/repository/BrowseIndexRestRepository.java
@@ -16,6 +16,7 @@
 import org.dspace.core.Context;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 /**
@@ -27,6 +28,7 @@
 public class BrowseIndexRestRepository extends DSpaceRestRepository<BrowseIndexRest, String> {
 
     @Override
+    @PreAuthorize("permitAll()")
     public BrowseIndexRest findOne(Context context, String name) {
         BrowseIndexRest bi = null;
         BrowseIndex bix;

diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/DSpaceRestRepository.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/DSpaceRestRepository.java
@@ -32,6 +32,7 @@
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 import org.springframework.data.repository.PagingAndSortingRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.multipart.MultipartFile;
 
 /**
@@ -122,6 +123,7 @@ public Optional<T> findById(ID id) {
      *            the rest object id
      * @return the REST object identified by its ID
      */
+    @PreAuthorize("hasAuthority('ADMIN')")
     public abstract T findOne(Context context, ID id);
 
     @Override

diff --git a/...-server-webapp/src/main/java/org/dspace/app/rest/repository/EntityTypeRestRepository.java b/...-server-webapp/src/main/java/org/dspace/app/rest/repository/EntityTypeRestRepository.java
@@ -18,6 +18,7 @@
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.rest.webmvc.ResourceNotFoundException;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 /**
@@ -29,6 +30,7 @@ public class EntityTypeRestRepository extends DSpaceRestRepository<EntityTypeRes
     @Autowired
     private EntityTypeService entityTypeService;
 
+    @PreAuthorize("permitAll()")
     public EntityTypeRest findOne(Context context, Integer integer) {
         try {
             EntityType entityType = entityTypeService.find(context, integer);

diff --git a/...ver-webapp/src/main/java/org/dspace/app/rest/repository/ExternalSourceRestRepository.java b/...ver-webapp/src/main/java/org/dspace/app/rest/repository/ExternalSourceRestRepository.java
@@ -21,6 +21,7 @@
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.rest.webmvc.ResourceNotFoundException;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 /**
@@ -77,6 +78,7 @@ public Page<ExternalSourceEntryRest> getExternalSourceEntries(String externalSou
     }
 
     @Override
+    @PreAuthorize("permitAll()")
     public ExternalSourceRest findOne(Context context, String externalSourceName) {
         ExternalDataProvider externalDataProvider = externalDataService.getExternalDataProvider(externalSourceName);
         if (externalDataProvider == null) {

diff --git a/...rver-webapp/src/main/java/org/dspace/app/rest/repository/MetadataFieldRestRepository.java b/...rver-webapp/src/main/java/org/dspace/app/rest/repository/MetadataFieldRestRepository.java
@@ -53,6 +53,7 @@ public class MetadataFieldRestRepository extends DSpaceRestRepository<MetadataFi
     MetadataSchemaService metadataSchemaService;
 
     @Override
+    @PreAuthorize("permitAll()")
     public MetadataFieldRest findOne(Context context, Integer id) {
         MetadataField metadataField = null;
         try {

diff --git a/...ver-webapp/src/main/java/org/dspace/app/rest/repository/MetadataSchemaRestRepository.java b/...ver-webapp/src/main/java/org/dspace/app/rest/repository/MetadataSchemaRestRepository.java
@@ -45,6 +45,7 @@ public class MetadataSchemaRestRepository extends DSpaceRestRepository<MetadataS
     MetadataSchemaService metadataSchemaService;
 
     @Override
+    @PreAuthorize("permitAll()")
     public MetadataSchemaRest findOne(Context context, Integer id) {
         MetadataSchema metadataSchema = null;
         try {

diff --git a/...erver-webapp/src/main/java/org/dspace/app/rest/repository/RelationshipRestRepository.java b/...erver-webapp/src/main/java/org/dspace/app/rest/repository/RelationshipRestRepository.java
@@ -40,6 +40,7 @@
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.rest.webmvc.ResourceNotFoundException;
 import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 /**
@@ -71,6 +72,7 @@ public class RelationshipRestRepository extends DSpaceRestRepository<Relationshi
     private RequestService requestService;
 
     @Override
+    @PreAuthorize("permitAll()")
     public RelationshipRest findOne(Context context, Integer integer) {
         try {
             return converter.toRest(relationshipService.find(context, integer), utils.obtainProjection());

diff --git a/...r-webapp/src/main/java/org/dspace/app/rest/repository/RelationshipTypeRestRepository.java b/...r-webapp/src/main/java/org/dspace/app/rest/repository/RelationshipTypeRestRepository.java
@@ -17,6 +17,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 /**
@@ -29,6 +30,7 @@ public class RelationshipTypeRestRepository extends DSpaceRestRepository<Relatio
     private RelationshipTypeService relationshipTypeService;
 
     @Override
+    @PreAuthorize("permitAll()")
     public RelationshipTypeRest findOne(Context context, Integer integer) {
         try {
             return converter.toRest(relationshipTypeService.find(context, integer), utils.obtainProjection());

diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ScriptRestRepository.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ScriptRestRepository.java
@@ -35,6 +35,7 @@
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 /**
@@ -52,6 +53,7 @@ public class ScriptRestRepository extends DSpaceRestRepository<ScriptRest, Strin
     private DSpaceRunnableParameterConverter dSpaceRunnableParameterConverter;
 
     @Override
+    @PreAuthorize("permitAll()")
     public ScriptRest findOne(Context context, String name) {
 
         DSpaceRunnable dSpaceRunnable = scriptService.getScriptForName(name);

diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/SiteRestRepository.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/SiteRestRepository.java
@@ -43,6 +43,7 @@ public SiteRestRepository(SiteService dsoService) {
     }
 
     @Override
+    @PreAuthorize("permitAll()")
     public SiteRest findOne(Context context, UUID id) {
         Site site = null;
         try {