Tighten up remote api access through ServerInvokerServlet.

modules/enterprise/binding/src/main/java/org/rhq/bindings/client/ResourceClientProxy.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -606,7 +606,7 @@ public void updateBackingContent(String filename, String displayVersion) {
 
             ContentManagerRemote contentManager = remoteClient.getProxy(ContentManagerRemote.class);
 
-            ContentUploader contentUploader = new ContentUploader(contentManager);
+            ContentUploader contentUploader = new ContentUploader(remoteClient.getSubject(), contentManager);
             String temporaryContentHandle = contentUploader.upload(file);
 
             PackageVersion pv = contentManager.createPackageVersionWithDisplayVersion(remoteClient.getSubject(),

modules/enterprise/binding/src/main/java/org/rhq/bindings/util/ContentUploader.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -24,6 +24,7 @@
 import java.io.FileInputStream;
 import java.io.IOException;
 
+import org.rhq.core.domain.auth.Subject;
 import org.rhq.core.util.StringUtil;
 import org.rhq.core.util.stream.StreamUtil;
 import org.rhq.enterprise.server.content.ContentManagerRemote;
@@ -42,19 +43,22 @@
 public class ContentUploader {
     private static final int SIZE_32K = 1024 * 32;
 
-    private ContentManagerRemote contentManager;
+    private final Subject subject;
+    private final ContentManagerRemote contentManager;
 
-    public ContentUploader(ContentManagerRemote contentManager) {
+    public ContentUploader(Subject subject, ContentManagerRemote contentManager) {
+        this.subject = subject;
         this.contentManager = contentManager;
     }
 
     /**
      * Uploads the file specified by its absolute <code>filename</code>.
      *
      * @param filename absolute path of the file to upload
+     *
      * @return a temporary content handle
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle()
-     * @see ContentManagerRemote#uploadContentFragment(String, byte[], int, int)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle(org.rhq.core.domain.auth.Subject)
+     * @see ContentManagerRemote#uploadContentFragment(org.rhq.core.domain.auth.Subject, String, byte[], int, int)
      * @throws IllegalArgumentException if <code>filename</code> is empty, if the file does not exist or if it is a
      * directory
      */
@@ -69,9 +73,10 @@ public String upload(String filename) {
      * Uploads a file.
      *
      * @param file the file to upload
+     *
      * @return a temporary content handle
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle()
-     * @see ContentManagerRemote#uploadContentFragment(String, byte[], int, int)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle(org.rhq.core.domain.auth.Subject)
+     * @see ContentManagerRemote#uploadContentFragment(org.rhq.core.domain.auth.Subject, String, byte[], int, int)
      * @throws IllegalArgumentException if <code>file</code> is null, if the file does not exist or if it is a directory
      */
     public String upload(File file) {
@@ -84,15 +89,15 @@ public String upload(File file) {
         if (file.isDirectory()) {
             throw new IllegalArgumentException("File expected, found directory: " + file.getAbsolutePath());
         }
-        String temporaryContentHandle = contentManager.createTemporaryContentHandle();
+        String temporaryContentHandle = contentManager.createTemporaryContentHandle(subject);
         FileInputStream fileInputStream = null;
         try {
             fileInputStream = new FileInputStream(file);
             BufferedInputStream bufferedInputStream = new BufferedInputStream(fileInputStream, SIZE_32K);
             int len;
             byte[] bytes = new byte[SIZE_32K];
             while ((len = bufferedInputStream.read(bytes, 0, bytes.length)) != -1) {
-                contentManager.uploadContentFragment(temporaryContentHandle, bytes, 0, len);
+                contentManager.uploadContentFragment(subject, temporaryContentHandle, bytes, 0, len);
             }
             return temporaryContentHandle;
         } catch (IOException e) {

modules/enterprise/binding/src/main/java/org/rhq/bindings/util/ScriptUtil.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -223,7 +223,8 @@ public String uploadContent(String filename) {
         if (remoteClient == null) {
             throw new IllegalStateException("The uploadContent method requires a connection to the RHQ server.");
         }
-        ContentUploader contentUploader = new ContentUploader(remoteClient.getProxy(ContentManagerRemote.class));
+        ContentUploader contentUploader = new ContentUploader(getSubjectFromEngine(),
+            remoteClient.getProxy(ContentManagerRemote.class));
         return contentUploader.upload(filename);
     }
 }

modules/enterprise/binding/src/test/java/org/rhq/bindings/util/ContentUploaderTest.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -45,6 +45,7 @@
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import org.rhq.core.domain.auth.Subject;
 import org.rhq.core.util.MessageDigestGenerator;
 import org.rhq.core.util.stream.StreamUtil;
 import org.rhq.enterprise.server.content.ContentManagerRemote;
@@ -55,15 +56,17 @@
 public class ContentUploaderTest {
     private static final String TEST_HANDLE = "calanques";
 
+    private Subject subject;
     private ContentUploader contentUploader;
     @Mock
     private ContentManagerRemote contentManager;
 
     @BeforeMethod
     public void setUp() throws Exception {
         MockitoAnnotations.initMocks(this);
-        when(contentManager.createTemporaryContentHandle()).thenReturn(TEST_HANDLE);
-        contentUploader = new ContentUploader(contentManager);
+        subject = new Subject(TEST_HANDLE, true, false);
+        when(contentManager.createTemporaryContentHandle(eq(subject))).thenReturn(TEST_HANDLE);
+        contentUploader = new ContentUploader(subject, contentManager);
     }
 
     @AfterMethod
@@ -102,8 +105,9 @@ public void testUploadByFileName() throws Exception {
             @Override
             public Void answer(InvocationOnMock invocation) throws Throwable {
                 Object[] invocationArguments = invocation.getArguments();
-                ByteArrayInputStream inputStream = new ByteArrayInputStream((byte[]) invocationArguments[1],
-                    (Integer) invocationArguments[2], (Integer) invocationArguments[3]);
+                int argIndex = 1;
+                ByteArrayInputStream inputStream = new ByteArrayInputStream((byte[]) invocationArguments[++argIndex],
+                    (Integer) invocationArguments[++argIndex], (Integer) invocationArguments[++argIndex]);
                 FileOutputStream fileOutputStream = null;
                 try {
                     fileOutputStream = new FileOutputStream(testFileReceived, true); // append == true
@@ -115,7 +119,8 @@ public Void answer(InvocationOnMock invocation) throws Throwable {
                 }
                 return null;
             }
-        }).when(contentManager).uploadContentFragment(eq(TEST_HANDLE), any(byte[].class), anyInt(), anyInt());
+        }).when(contentManager).uploadContentFragment(eq(subject), eq(TEST_HANDLE), any(byte[].class), anyInt(),
+            anyInt());
         String temporaryContentHandle = contentUploader.upload(testFileToSend.getAbsolutePath());
         assertEquals(temporaryContentHandle, TEST_HANDLE);
         // If file sizes and file hashes are equal, we can say they have the same content

modules/enterprise/remoting/cli/pom.xml

@@ -296,6 +296,43 @@
             </plugins>
          </build>
       </profile>
+
+    <profile>
+      <id>testBZ1198008</id>
+      <activation>
+        <property>
+          <name>testBZ1198008</name>
+        </property>
+      </activation>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>exec-maven-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>execute-test-broker</id>
+                <phase>install</phase>
+                <goals>
+                  <goal>java</goal>
+                </goals>
+              </execution>
+            </executions>
+            <configuration>
+              <mainClass>org.rhq.enterprise.client.RHQTestClient</mainClass>
+              <classpathScope>test</classpathScope>
+              <systemProperties>
+                <systemProperty>
+                  <key>log4j.configuration</key>
+                  <value>file:${basedir}/src/main/resources/log4j.xml</value>
+                </systemProperty>
+              </systemProperties>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+
    </profiles>
 </project>
 

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/bundle/BundleManagerRemote.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -338,8 +338,8 @@ BundleVersion createInitialBundleVersionViaRecipe(Subject subject, int[] bundleG
      *         understand all that this method did. Bundle files specifically are returned.
      * @throws Exception
      *
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle()
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(String, byte[], int, int)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle(org.rhq.core.domain.auth.Subject)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(org.rhq.core.domain.auth.Subject, String, byte[], int, int)
      * @see #createBundleVersionViaFile(org.rhq.core.domain.auth.Subject, java.io.File)
      *
      * @since 4.10
@@ -383,8 +383,8 @@ BundleVersion createInitialBundleVersionViaFile(Subject subject, int[] bundleGro
      *         understand all that this method did. Bundle files specifically are returned.
      * @throws Exception
      *
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle()
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(String, byte[], int, int)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle(org.rhq.core.domain.auth.Subject)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(org.rhq.core.domain.auth.Subject, String, byte[], int, int)
      * @see #createInitialBundleVersionViaFile(org.rhq.core.domain.auth.Subject, int[], java.io.File)
      *
      * @since 4.10

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/content/ContentManagerBean.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -2193,7 +2193,7 @@ public void writeBlobOutToStream(OutputStream stream, PackageBits bits, boolean
     }
 
     @Override
-    public String createTemporaryContentHandle() {
+    public String createTemporaryContentHandle(Subject subject) {
         try {
             return File.createTempFile(TMP_FILE_PREFIX, TMP_FILE_SUFFIX, getTempDirectory()).getName();
         } catch (IOException e) {
@@ -2207,7 +2207,7 @@ private File getTempDirectory() {
     }
 
     @Override
-    public void uploadContentFragment(String temporaryContentHandle, byte[] fragment, int off, int len) {
+    public void uploadContentFragment(Subject subject, String temporaryContentHandle, byte[] fragment, int off, int len) {
         File temporaryContentFile = getTemporaryContentFile(temporaryContentHandle);
         ByteArrayInputStream inputStream = new ByteArrayInputStream(fragment, off, len);
         FileOutputStream fileOutputStream = null;

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/content/ContentManagerLocal.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -357,7 +357,7 @@ PackageVersion getUploadedPackageVersion(Subject subject, String packageName, in
     /**
      * Get the file denoted by this <code>temporaryContentHandle</code>.
      *
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle()
+     * @see ContentManagerRemote#createTemporaryContentHandle(org.rhq.core.domain.auth.Subject)
      * @param temporaryContentHandle
      * @return the file denoted by this <code>temporaryContentHandle</code>
      */

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/content/ContentManagerRemote.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -241,26 +241,28 @@ PackageTypeAndVersionFormatComposite findPackageTypeWithVersionFormat(Subject su
     /**
      * Creates a temporary file for fragmented content upload.
      *
+     * @param subject logged in user
      * @return a temporary file handle
      *
      * @since 4.10
      */
-    String createTemporaryContentHandle();
+    String createTemporaryContentHandle(Subject subject);
 
     /**
      * Saves the fragment in the temporary file denoted by <code>temporaryContentHandle</code>.
      *
      * The <code>fragment</code> bytes will be copied starting from the <code>off</code> index up to the minimum of
      * <code>off+len</code> and <code>fragment.length</code>.
      *
+     * @param subject logged in user
      * @param temporaryContentHandle temporary file handle
      * @param fragment fragment bytes
      * @param off the offset
-     * @param len
+     * @param len number of bytes
      *
      * @since 4.10
      */
-    void uploadContentFragment(String temporaryContentHandle, byte[] fragment, int off, int len);
+    void uploadContentFragment(Subject subject, String temporaryContentHandle, byte[] fragment, int off, int len);
 
     /**
      * Creates a new package version in the system with content denoted by the <code>temporaryContentHandle</code>.

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/remote/RemoteSafeInvocationHandler.java

@@ -164,6 +164,9 @@ private static <T> String getLocalJNDIName(Class<?> remoteClass) {
     private static <T> String getRemoteJNDIName(Class<?> remoteClass) {
         String jndiName = REMOTE_JNDI_NAMES.get(remoteClass);
         if (jndiName == null) {
+            if (!remoteClass.getSimpleName().endsWith("Remote")) {
+                throw new RuntimeException("Illegal to access non-remote API: " + remoteClass);
+            }
             jndiName = "java:global/rhq/rhq-server/" + remoteClass.getSimpleName().replaceFirst("Remote$", "Bean")
                 + "!" + remoteClass.getName();
             REMOTE_JNDI_NAMES.put(remoteClass, jndiName);

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/ResourceFactoryManagerRemote.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2005-2013 Red Hat, Inc.
+ * Copyright (C) 2005-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -103,8 +103,8 @@ CreateResourceHistory createPackageBackedResource(Subject subject, int parentRes
      * @param timeout                     number of milliseconds before the agent suffers a timeout when creating the resource. If null uses default.
      * @return                            the create resource history record
      *
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle()
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(String, byte[], int, int)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle(org.rhq.core.domain.auth.Subject)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(org.rhq.core.domain.auth.Subject, String, byte[], int, int)
      * @see #createPackageBackedResource(org.rhq.core.domain.auth.Subject, int, int, String, org.rhq.core.domain.configuration.Configuration, String, String, Integer, org.rhq.core.domain.configuration.Configuration, byte[], Integer)
      *
      * @since 4.10

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/resource/metadata/PluginManagerRemote.java

@@ -1,6 +1,6 @@
 /*
  * RHQ Management Platform
- * Copyright (C) 2014 Red Hat, Inc.
+ * Copyright (C) 2014-2015 Red Hat, Inc.
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -114,8 +114,8 @@ public interface PluginManagerRemote {
      * @param handle the handle to the uploaded file
      *
      * @throws Exception on error
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle()
-     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(String, byte[], int, int)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#createTemporaryContentHandle(org.rhq.core.domain.auth.Subject)
+     * @see org.rhq.enterprise.server.content.ContentManagerRemote#uploadContentFragment(org.rhq.core.domain.auth.Subject, String, byte[], int, int)
      */
     List<Plugin> deployUsingContentHandle(Subject subject, String pluginJarName, String handle) throws Exception;
 

modules/enterprise/server/jar/src/main/java/org/rhq/enterprise/server/sync/SynchronizationManagerBean.java

@@ -210,7 +210,7 @@ public void validate(Subject subject, byte[] exportFile) throws ValidationExcept
     }
 
     @Override
-    public ImportConfigurationDefinition getImportConfigurationDefinition(String synchronizerClass) {
+    public ImportConfigurationDefinition getImportConfigurationDefinition(Subject subject, String synchronizerClass) {
         try {
             Class<?> cls = Class.forName(synchronizerClass);
             if (!Synchronizer.class.isAssignableFrom(cls)) {
@@ -231,7 +231,7 @@ public ImportConfigurationDefinition getImportConfigurationDefinition(String syn
     }
 
     @Override
-    public List<ImportConfigurationDefinition> getImportConfigurationDefinitionOfAllSynchronizers() {
+    public List<ImportConfigurationDefinition> getImportConfigurationDefinitionOfAllSynchronizers(Subject subject) {
         List<ImportConfigurationDefinition> ret = new ArrayList<ImportConfigurationDefinition>();
 
         for (Synchronizer<?, ?> syn : synchronizerFactory.getAllSynchronizers()) {