MM-893: Solved Authentication Bypass to System Administration

api/src/main/java/org/openmrs/module/coreapps/CoreAppsConstants.java

@@ -24,6 +24,7 @@ public class CoreAppsConstants {
    public static final String PRIVILEGE_PATIENT_DASHBOARD = "App: coreapps.patientDashboard";
    public static final String PRIVILEGE_SUMMARY_DASHBOARD = "App: coreapps.summaryDashboard";
    public static final String PRIVILEGE_PATIENT_VISITS = "App: coreapps.patientVisits";
+   public static final String PRIVILEGE_SYSTEM_ADMINISTRATOR = "App: coreapps.systemAdministration";
    public static final String PRIVILEGE_START_VISIT = "Task: coreapps.createVisit";
    public static final String PRIVILEGE_END_VISIT = "Task: coreapps.endVisit";
    public static final String PRIVILEGE_DELETE_PATIENT = "Task: coreapps.deletePatient";

omod/src/main/java/org/openmrs/module/coreapps/filter/AdminAuthorisationFilter.java

@@ -0,0 +1,71 @@
+/**
+ * This Source Code Form is subject to the terms of the Mozilla Public License,
+ * v. 2.0. If a copy of the MPL was not distributed with this file, You can
+ * obtain one at http://mozilla.org/MPL/2.0/. OpenMRS is also distributed under
+ * the terms of the Healthcare Disclaimer located at http://openmrs.org/license.
+ *
+ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS
+ * graphic logo is a trademark of OpenMRS Inc.
+ */
+package org.openmrs.module.coreapps.filter;
+
+import java.io.IOException;
+import java.util.Collection;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.openmrs.User;
+import org.openmrs.api.context.Context;
+import org.openmrs.module.coreapps.CoreAppsConstants;
+import org.openmrs.web.WebConstants;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * This filter checks if an authenticated user trying to access administrative functions has the
+ * <STRONG>System Administration<STRONG> privelege. It will intercept any requests with *admin/* in
+ * its url. Unauthorised user will be redirected to the home page.
+ */
+public class AdminAuthorisationFilter implements Filter {
+
+	private static final Logger log = LoggerFactory.getLogger(AdminAuthorisationFilter.class);
+
+	/**
+	 * @see Filter#init(FilterConfig)
+	 */
+	public void init(FilterConfig filterConfig) throws ServletException {
+
+	}
+
+	/**
+	 * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest,
+	 *      javax.servlet.ServletResponse, javax.servlet.FilterChain)
+	 */
+	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
+		HttpServletRequest httpReq = (HttpServletRequest) req;
+		User user = Context.getAuthenticatedUser();
+		if (user != null && !user.hasPrivilege(CoreAppsConstants.PRIVILEGE_SYSTEM_ADMINISTRATOR)) {
+			httpReq.getSession().setAttribute(WebConstants.DENIED_PAGE, httpReq.getRequestURI());
+			HttpServletResponse httpRes = (HttpServletResponse) res;
+			log.info("User {} lacks the privilege {}", user, CoreAppsConstants.PRIVILEGE_SYSTEM_ADMINISTRATOR);
+			httpRes.sendRedirect(httpReq.getContextPath() + "/login.htm");
+			return;
+		}
+		chain.doFilter(req, res);
+	}
+
+	/**
+	 * @see Filter#destroy()
+	 */
+	public void destroy() {
+
+	}
+}

omod/src/main/resources/config.xml

@@ -86,6 +86,16 @@
 
 	</mappingFiles>
 
+    <filter>
+        <filter-name>${project.parent.artifactId}AdminAuthorisationFilter</filter-name>
+        <filter-class>${project.parent.groupId}.${project.parent.artifactId}.filter.AdminAuthorisationFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>${project.parent.artifactId}AdminAuthorisationFilter</filter-name>
+        <url-pattern>/admin/*</url-pattern>
+    </filter-mapping>
+
 	<!-- Internationalization -->
 	<!-- All message codes should start with ${project.parent.artifactId}. -->
 	<messages>