Bug 508057 - Missing access rights check on EMFStoreImpl#invoke

Change-Id: I253dfe77d886e9b8e03c95a0530bd795e4eadf65 Signed-off-by: Johannes Faltermeier <jfaltermeier@eclipsesource.com>
eclipse-emfstore · Jan 25, 2017 · 4fc2c3e · 4fc2c3e
1 parent 7ed54ff
commit 4fc2c3e
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/...e.emf.emfstore.server/src/org/eclipse/emf/emfstore/internal/server/core/EMFStoreImpl.java b/...e.emf.emfstore.server/src/org/eclipse/emf/emfstore/internal/server/core/EMFStoreImpl.java
@@ -167,6 +167,7 @@ protected void addSubInterface(AbstractSubEmfstoreInterface iface) {
 	 */
 	public Object invoke(Object obj, final Method method, final Object[] args) throws ESException {
 		final ESMethodInvocation methodInvocation = new ESMethodInvocation(method.getName(), args);
+		getAccessControl().getAuthorizationService().checkAccess(methodInvocation);
 
 		final Object[] adjustedArgs = adjustParameters(args);
 

diff --git a/...server.test/src/org/eclipse/emf/emfstore/server/accesscontrol/test/CreateProjectTest.java b/...server.test/src/org/eclipse/emf/emfstore/server/accesscontrol/test/CreateProjectTest.java
@@ -44,7 +44,12 @@ public static void afterClass() {
 
 	@Test(expected = AccessControlException.class)
 	public void shareProjectNotPA() throws ESException {
-		ProjectUtil.share(getUsersession(), getLocalProject());
+		try {
+			ProjectUtil.share(getUsersession(), getLocalProject());
+		} catch (final ESException ex) {
+			assertTrue(getServerMock().getServerSpace().getProjects().isEmpty());
+			throw ex;
+		}
 	}
 
 	@Test