[GEOS-7007] CQL_FILTER is ignored against a mosaic if the ResourceAcc…

…essManager also adds its own filter

src/main/src/main/java/org/geoserver/security/decorators/SecuredGridCoverage2DReader.java

@@ -11,6 +11,7 @@
 import java.util.Iterator;
 import java.util.List;
 
+import org.geoserver.catalog.Predicates;
 import org.geoserver.data.util.CoverageUtils;
 import org.geoserver.security.CoverageAccessLimits;
 import org.geoserver.security.WrapperPolicy;
@@ -25,6 +26,7 @@
 import org.opengis.filter.Filter;
 import org.opengis.parameter.GeneralParameterDescriptor;
 import org.opengis.parameter.GeneralParameterValue;
+import org.opengis.parameter.ParameterValue;
 import org.opengis.parameter.ParameterValueGroup;
 
 import com.vividsolutions.jts.geom.Envelope;
@@ -90,17 +92,38 @@ public GridCoverage2D read(GeneralParameterValue[] parameters) throws IllegalArg
                     params.add(lparam);
                 }
 
-                parameters = (GeneralParameterValue[]) params
+                parameters = params
                         .toArray(new GeneralParameterValue[params.size()]);
             }
 
             if(readFilter != null && !Filter.INCLUDE.equals(readFilter)) {
+                Format format = delegate.getFormat();
+                ParameterValueGroup readParameters = format.getReadParameters();
+                List<GeneralParameterDescriptor> descriptors = readParameters.getDescriptor()
+                        .descriptors();
+
+                // scan all the params looking for the one we want to add
+                boolean replacedOriginalFilter = false;
+                for (GeneralParameterValue pv : parameters) {
+                    String pdCode = pv.getDescriptor().getName().getCode();
+                    if ("FILTER".equals(pdCode) || "Filter".equals(pdCode)) {
+                        replacedOriginalFilter = true;
+                        ParameterValue pvalue = (ParameterValue) pv;
+                        Filter originalFilter = (Filter) pvalue.getValue();
+                        if (Filter.INCLUDE.equals(originalFilter)) {
+                            pvalue.setValue(readFilter);
+                        } else {
+                            Filter combined = Predicates.and(originalFilter, readFilter);
+                            pvalue.setValue(combined);
+                        }
+                    }
+                }
+                if (!replacedOriginalFilter) {
+                    parameters = CoverageUtils.mergeParameter(descriptors, parameters, readFilter,
+                            "FILTER", "Filter");
+                }
+
 
-
-                ParameterValueGroup readParameters = delegate.getFormat().getReadParameters();
-                List<GeneralParameterDescriptor> descriptors = readParameters.getDescriptor().descriptors();
-                parameters = CoverageUtils.mergeParameter(descriptors, 
-                        parameters, readFilter, "FILTER", "Filter");
             }
         }
 
@@ -111,7 +134,7 @@ public GridCoverage2D read(GeneralParameterValue[] parameters) throws IllegalArg
 
             Geometry coverageBounds = JTS.toGeometry((Envelope) new ReferencedEnvelope(grid.getEnvelope2D()));
             if(coverageBounds.intersects(rasterFilter)) {
-                final ParameterValueGroup param = (ParameterValueGroup) processor.getOperation("CoverageCrop").getParameters();
+                final ParameterValueGroup param = processor.getOperation("CoverageCrop").getParameters();
                 param.parameter("source").setValue(grid);
                 param.parameter("ROI").setValue(rasterFilter);
                 grid = (GridCoverage2D) ((Crop)processor.getOperation("CoverageCrop")).doOperation(param, null);

src/main/src/test/java/org/geoserver/security/decorators/SecuredGridCoverage2DReaderTest.java

@@ -0,0 +1,67 @@
+package org.geoserver.security.decorators;
+
+import static org.easymock.EasyMock.expect;
+import static org.easymock.EasyMock.isA;
+import static org.easymock.classextension.EasyMock.createNiceMock;
+import static org.junit.Assert.assertEquals;
+
+import org.easymock.IAnswer;
+import org.easymock.classextension.EasyMock;
+import org.geoserver.catalog.Predicates;
+import org.geoserver.security.CatalogMode;
+import org.geoserver.security.CoverageAccessLimits;
+import org.geoserver.security.WrapperPolicy;
+import org.geoserver.security.impl.SecureObjectsTest;
+import org.geotools.coverage.grid.GridCoverage2D;
+import org.geotools.coverage.grid.io.GridCoverage2DReader;
+import org.geotools.filter.text.ecql.ECQL;
+import org.geotools.gce.imagemosaic.ImageMosaicFormat;
+import org.junit.Test;
+import org.opengis.coverage.grid.Format;
+import org.opengis.filter.Filter;
+import org.opengis.parameter.GeneralParameterValue;
+import org.opengis.parameter.ParameterValue;
+
+public class SecuredGridCoverage2DReaderTest extends SecureObjectsTest {
+
+    @Test
+    public void testFilter() throws Exception {
+        final Filter securityFilter = ECQL.toFilter("A > 10");
+        final Filter requestFilter = ECQL.toFilter("B < 10");
+
+        // create the mocks we need
+        Format format = createNiceMock(Format.class);
+        expect(format.getReadParameters()).andReturn(new ImageMosaicFormat().getReadParameters())
+                .anyTimes();
+        EasyMock.replay(format);
+        GridCoverage2DReader reader = createNiceMock(GridCoverage2DReader.class);
+        expect(reader.getFormat()).andReturn(format).anyTimes();
+
+
+        // the assertion
+        expect(reader.read(isA(GeneralParameterValue[].class))).andAnswer(
+                new IAnswer<GridCoverage2D>() {
+
+                    @Override
+                    public GridCoverage2D answer() throws Throwable {
+                        GeneralParameterValue[] params = (GeneralParameterValue[]) EasyMock
+                                .getCurrentArguments()[0];
+                        ParameterValue param = (ParameterValue) params[0];
+                        Filter filter = (Filter) param.getValue();
+                        assertEquals(Predicates.and(requestFilter, securityFilter), filter);
+
+                        return null;
+                    }
+                });
+        EasyMock.replay(reader);
+
+        CoverageAccessLimits accessLimits = new CoverageAccessLimits(CatalogMode.HIDE, securityFilter, null, null);
+        SecuredGridCoverage2DReader secured = new SecuredGridCoverage2DReader(reader,
+                WrapperPolicy.readOnlyHide(accessLimits));
+
+        final ParameterValue pv = ImageMosaicFormat.FILTER.createValue();
+        pv.setValue(requestFilter);
+        secured.read(new GeneralParameterValue[] { pv });
+
+    }
+}