SONAR-5927 Prevent access to batch/global when no permission

server/sonar-server/src/main/java/org/sonar/server/batch/GlobalRepositoryAction.java

@@ -33,6 +33,7 @@
 import org.sonar.core.properties.PropertiesDao;
 import org.sonar.core.properties.PropertyDto;
 import org.sonar.server.db.DbClient;
+import org.sonar.server.exceptions.ForbiddenException;
 import org.sonar.server.plugins.MimeTypes;
 import org.sonar.server.user.UserSession;
 
@@ -58,13 +59,16 @@ void define(WebService.NewController controller) {
   public void handle(Request request, Response response) throws Exception {
     UserSession userSession = UserSession.get();
     boolean hasScanPerm = userSession.hasGlobalPermission(GlobalPermissions.SCAN_EXECUTION);
-    boolean hasDryRunPerm = userSession.hasGlobalPermission(GlobalPermissions.PREVIEW_EXECUTION);
+    boolean hasPreviewPerm = userSession.hasGlobalPermission(GlobalPermissions.PREVIEW_EXECUTION);
+    if (!hasPreviewPerm && !hasScanPerm) {
+      throw new ForbiddenException(Messages.NO_PERMISSION);
+    }
 
     DbSession session = dbClient.openSession(false);
     try {
       GlobalRepositories ref = new GlobalRepositories();
       addMetrics(ref, session);
-      addSettings(ref, hasScanPerm, hasDryRunPerm, session);
+      addSettings(ref, hasScanPerm, hasPreviewPerm, session);
 
       response.stream().setMediaType(MimeTypes.JSON);
       IOUtils.write(ref.toJson(), response.stream().output());
@@ -90,19 +94,19 @@ private void addMetrics(GlobalRepositories ref, DbSession session) {
     }
   }
 
-  private void addSettings(GlobalRepositories ref, boolean hasScanPerm, boolean hasDryRunPerm, DbSession session) {
+  private void addSettings(GlobalRepositories ref, boolean hasScanPerm, boolean hasPreviewPerm, DbSession session) {
     for (PropertyDto propertyDto : propertiesDao.selectGlobalProperties(session)) {
       String key = propertyDto.getKey();
       String value = propertyDto.getValue();
 
-      if (isPropertyAllowed(key, hasScanPerm, hasDryRunPerm)) {
+      if (isPropertyAllowed(key, hasScanPerm, hasPreviewPerm)) {
         ref.addGlobalSetting(key, value);
       }
     }
   }
 
-  private static boolean isPropertyAllowed(String key, boolean hasScanPerm, boolean hasDryRunPerm) {
-    return !key.contains(".secured") || hasScanPerm || (key.contains(".license") && hasDryRunPerm);
+  private static boolean isPropertyAllowed(String key, boolean hasScanPerm, boolean hasPreviewPerm) {
+    return !key.contains(".secured") || hasScanPerm || (key.contains(".license") && hasPreviewPerm);
   }
 
 }

server/sonar-server/src/main/java/org/sonar/server/batch/Messages.java

@@ -0,0 +1,26 @@
+/*
+ * SonarQube, open source software quality management tool.
+ * Copyright (C) 2008-2014 SonarSource
+ * mailto:contact AT sonarsource DOT com
+ *
+ * SonarQube is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * SonarQube is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.batch;
+
+public interface Messages {
+
+  String NO_PERMISSION = "You're not authorized to execute any SonarQube analysis. Please contact your SonarQube administrator.";
+
+}

server/sonar-server/src/main/java/org/sonar/server/batch/ProjectRepositoryLoader.java

@@ -276,7 +276,7 @@ private void checkPermission(boolean preview) {
     boolean hasScanPerm = userSession.hasGlobalPermission(GlobalPermissions.SCAN_EXECUTION);
     boolean hasPreviewPerm = userSession.hasGlobalPermission(GlobalPermissions.PREVIEW_EXECUTION);
     if (!hasPreviewPerm && !hasScanPerm) {
-      throw new ForbiddenException("You're not authorized to execute any SonarQube analysis. Please contact your SonarQube administrator.");
+      throw new ForbiddenException(Messages.NO_PERMISSION);
     }
     if (!preview && !hasScanPerm) {
       throw new ForbiddenException("You're only authorized to execute a local (preview) SonarQube analysis without pushing the results to the SonarQube server. " +