org.craftercms.engine.security

Class CrafterPageAccessManager

java.lang.Object

org.craftercms.engine.security.CrafterPageAccessManager

public class CrafterPageAccessManager
extends Object

Manages access to Crafter pages, depending on the roles specified in the page and the current user's roles.

Author:

Russ Danner, Alfonso Vásquez

Field Summary

Fields

Modifier and Type	Field and Description
protected String	authorizedRolesXPathQuery

Constructor Summary

Constructors

Constructor and Description
CrafterPageAccessManager()

Method Summary

Modifier and Type	Method and Description
void	checkAccess(SiteItem page) Checks if the user has sufficient rights to access the specified page: If the page doesn't contain any required role, no authentication is needed. If the page has the role "Anonymous", no authentication is needed. If the page has the role "Authenticated", just authentication is needed. If the page has any other the roles, the user needs to have any of those roles.
protected boolean	containsRole(String role, List<String> roles)
protected List<String>	getAuthorizedRolesForPage(SiteItem page)
protected boolean	hasAnyRole(org.springframework.security.core.Authentication auth, List<String> roles)
void	setAuthorizedRolesXPathQuery(String authorizedRolesXPathQuery)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

authorizedRolesXPathQuery

protected String authorizedRolesXPathQuery

Constructor Detail

CrafterPageAccessManager

public CrafterPageAccessManager()

Method Detail

setAuthorizedRolesXPathQuery

public void setAuthorizedRolesXPathQuery(String authorizedRolesXPathQuery)

checkAccess

public void checkAccess(SiteItem page)

Checks if the user has sufficient rights to access the specified page:

1. If the page doesn't contain any required role, no authentication is needed.
2. If the page has the role "Anonymous", no authentication is needed.
3. If the page has the role "Authenticated", just authentication is needed.
4. If the page has any other the roles, the user needs to have any of those roles.

getAuthorizedRolesForPage

protected List<String> getAuthorizedRolesForPage(SiteItem page)

containsRole

protected boolean containsRole(String role,
                               List<String> roles)

hasAnyRole

protected boolean hasAnyRole(org.springframework.security.core.Authentication auth,
                             List<String> roles)