Add missing permissiong check on UserServiceImpl

Signed-off-by: Claudio Mezzasalma <claudio.mezzasalma@eurotech.com>
eclipse · May 5, 2020 · cec2ca6 · cec2ca6
1 parent 35bb08d
commit cec2ca6
Showing 1 changed file with 18 additions and 2 deletions.
diff --git a/.../user/internal/src/main/java/org/eclipse/kapua/service/user/internal/UserServiceImpl.java b/.../user/internal/src/main/java/org/eclipse/kapua/service/user/internal/UserServiceImpl.java
@@ -226,7 +226,15 @@ public User findByName(String name) throws KapuaException {
 
         //
         // Do the find
-        return entityManagerSession.onResult(em -> checkReadAccess(UserDAO.findByName(em, name)));
+        User user = entityManagerSession.onResult(em -> checkReadAccess(UserDAO.findByName(em, name)));
+
+        //
+        // Check Access
+        if (user != null) {
+            authorizationService.checkPermission(permissionFactory.newPermission(UserDomains.USER_DOMAIN, Actions.read, user.getScopeId()));
+        }
+
+        return user;
     }
 
     @Override
@@ -237,7 +245,15 @@ public User findByExternalId(String externalId) throws KapuaException {
 
         //
         // Do the find
-        return entityManagerSession.onResult(em -> checkReadAccess(UserDAO.findByExternalId(em, externalId)));
+        User user = entityManagerSession.onResult(em -> checkReadAccess(UserDAO.findByExternalId(em, externalId)));
+
+        //
+        // Check Access
+        if (user != null) {
+            authorizationService.checkPermission(permissionFactory.newPermission(UserDomains.USER_DOMAIN, Actions.read, user.getScopeId()));
+        }
+
+        return user;
     }
 
     @Override