MID-9380 one more auth check

Evolveum · Jan 23, 2024 · 5621b9b · 5621b9b
1 parent a77b32d
commit 5621b9b
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 6 deletions.
diff --git a/...lveum/midpoint/gui/impl/page/admin/component/AssignmentHolderOperationalButtonsPanel.java b/...lveum/midpoint/gui/impl/page/admin/component/AssignmentHolderOperationalButtonsPanel.java
@@ -21,6 +21,7 @@
 import com.evolveum.midpoint.gui.impl.component.icon.CompositedIconBuilder;
 import com.evolveum.midpoint.gui.impl.component.icon.IconCssStyle;
 import com.evolveum.midpoint.model.api.AssignmentObjectRelation;
+import com.evolveum.midpoint.model.api.ModelAuthorizationAction;
 import com.evolveum.midpoint.prism.PrismContainer;
 import com.evolveum.midpoint.prism.PrismObject;
 import com.evolveum.midpoint.prism.delta.ObjectDelta;
@@ -317,6 +318,15 @@ protected void showMainPopup(Popupable popupable, AjaxRequestTarget target) {
     @Override
     protected boolean isSavePreviewButtonEnabled() {
         return !ItemStatus.NOT_CHANGED.equals(getModelObject().getStatus()) || getModelObject().canModify() ||
-                !getModelObject().isReadOnly(); //this check was added due to MID-9380
+                isAuthorizedToModify(); //this check was added due to MID-9380
+    }
+
+    protected boolean isAuthorizedToModify() {
+        try {
+            return getPageBase().isAuthorized(ModelAuthorizationAction.MODIFY.getUrl(),
+                    AuthorizationPhaseType.EXECUTION, getModelObject().getObject(), null, null);
+        } catch (Exception e) {
+            return false;
+        }
     }
 }
diff --git a/...java/com/evolveum/midpoint/gui/impl/page/admin/component/UserOperationalButtonsPanel.java b/...java/com/evolveum/midpoint/gui/impl/page/admin/component/UserOperationalButtonsPanel.java
@@ -23,17 +23,18 @@ public UserOperationalButtonsPanel(String id, LoadableModel<PrismObjectWrapper<U
 
     @Override
     protected boolean isSavePreviewButtonEnabled() {
-        return isAuthorizedToModifyUsers() || super.isSavePreviewButtonEnabled();
+        return isAuthorizedToModify() || super.isSavePreviewButtonEnabled();
     }
 
-
-    private boolean isAuthorizedToModifyUsers() {
+    @Override
+    protected boolean isAuthorizedToModify() {
         try {
-            return getPageBase().isAuthorized(ModelAuthorizationAction.MODIFY.getUrl(),
+            boolean selfModify = super.isAuthorizedToModify();
+            boolean otherUserModify = getPageBase().isAuthorized(ModelAuthorizationAction.MODIFY.getUrl(),
                     AuthorizationPhaseType.EXECUTION, new UserType().asPrismObject(), null, null);
+            return selfModify || otherUserModify;
         } catch (Exception e) {
             return false;
         }
     }
-
 }