AfflictionNetworks/narya
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Well, that took a while to track down. Both the permissions check and the validation need to be done on the body, not the client.

Browse Source 
git-svn-id: svn+ssh://src.earth.threerings.net/narya/trunk@6311 542714f4-19e9-0310-aa3c-eee0fc999fb1
This commit is contained in:
Par Winzell
2010-11-30 01:23:59 +00:00
parent 9572a8464d
commit 3146ca071e
6 changed files with 189 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.idea_module/narya.iml
+151
View File
@@ -0,0 +1,151 @@
<?xml version="1.0" encoding="UTF-8"?>
<module type="JAVA_MODULE" version="4">
<component name="NewModuleRootManager" inherit-compiler-output="false">
<output url="file://$MODULE_DIR$/../bin" />
<exclude-output />
<content url="file://$MODULE_DIR$/..">
<sourceFolder url="file://$MODULE_DIR$/../src/java" isTestSource="false" />
<sourceFolder url="file://$MODULE_DIR$/../src/as" isTestSource="false" />
<sourceFolder url="file://$MODULE_DIR$/../tests/src/as" isTestSource="true" />
<sourceFolder url="file://$MODULE_DIR$/../tests/src/java" isTestSource="true" />
</content>
<orderEntry type="sourceFolder" forTests="false" />
<orderEntry type="module-library">
<library name="javassist.jar">
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/javassist.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library name="guava.jar">
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/guava.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library name="guice.jar">
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/guice-2.0.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES>
<root url="file://$USER_SRC$/google-guice-read-only/src" />
</SOURCES>
</library>
</orderEntry>
<orderEntry type="module" module-name="depot" />
<orderEntry type="module-library">
<library name="commons-lang.jar">
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/commons-lang.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library name="atunit.jar">
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/atunit-1.0.1.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="inheritedJdk" />
<orderEntry type="module-library">
<library name="jsr250-api.jar">
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/jsr250-api.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module" module-name="aspirin" />
<orderEntry type="module-library">
<library>
<CLASSES>
<root url="jar://$MODULE_DIR$/../../extlibs/flash/corelib.swc!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library>
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/ehcache.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library>
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/ant.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library>
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/velocity-dev.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library>
<CLASSES>
<root url="jar://$EXT_LIBS_DIR$/junit4.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library name="AUTOGENERATED library equal to Flex SDK Flex SDK (player 9)">
<CLASSES>
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/libs/flex.swc!/" />
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/libs/framework.swc!/" />
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/libs/rpc.swc!/" />
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/libs/utilities.swc!/" />
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/locale/en_US/airframework_rb.swc!/" />
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/locale/en_US/framework_rb.swc!/" />
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/locale/en_US/rpc_rb.swc!/" />
<root url="jar://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/libs/player/9/playerglobal.swc!/" />
</CLASSES>
<JAVADOC />
<SOURCES>
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/air/ApplicationUpdater/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/air/ServiceMonitor/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/airframework/bundles/en_US/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/airframework/bundles/ja_JP/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/airframework/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/flex/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/framework/bundles/en_US/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/framework/bundles/ja_JP/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/framework/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/haloclassic/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/rpc/bundles/en_US/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/rpc/bundles/ja_JP/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/rpc/src" />
<root url="file://$MODULE_DIR$/../../lib/flex_sdk_3.3.0.4852/frameworks/projects/utilities/src" />
</SOURCES>
</library>
</orderEntry>
<orderEntry type="module" module-name="samskivert" />
</component>
</module>
as-pom.xml
+1 -1
View File
@@ -4,7 +4,7 @@
<groupId>com.threerings</groupId>
<artifactId>naryalib</artifactId>
<packaging>swc</packaging>
<version>1.3-SNAPSHOT</version>
<version>1.4-SNAPSHOT</version>
<name>narya</name>
<description>Facilities for making networked multiplayer games.</description>
<url>http://code.google.com/p/narya/</url>
narya.iml
+19 -57
View File
@@ -1,19 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
<module type="JAVA_MODULE" version="4">
<component name="EclipseModuleManager">
<varelement var="jar://$M2_REPO$/aopalliance/aopalliance/1.0/aopalliance-1.0.jar!/" value="M2_REPO/aopalliance/aopalliance/1.0/aopalliance-1.0.jar" />
<varelement var="jar://$M2_REPO$/aopalliance/aopalliance/1.0/aopalliance-1.0-sources.jar!/" value="src:M2_REPO/aopalliance/aopalliance/1.0/aopalliance-1.0-sources.jar" />
<varelement var="jar://$M2_REPO$/com/google/inject/guice/2.0/guice-2.0.jar!/" value="M2_REPO/com/google/inject/guice/2.0/guice-2.0.jar" />
<varelement var="jar://$M2_REPO$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA.jar!/" value="M2_REPO/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA.jar" />
<varelement var="jar://$M2_REPO$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA-sources.jar!/" value="src:M2_REPO/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA-sources.jar" />
<varelement var="jar://$M2_REPO$/com/samskivert/jmustache/1.0/jmustache-1.0.jar!/" value="M2_REPO/com/samskivert/jmustache/1.0/jmustache-1.0.jar" />
<varelement var="jar://$M2_REPO$/com/samskivert/jmustache/1.0/jmustache-1.0-sources.jar!/" value="src:M2_REPO/com/samskivert/jmustache/1.0/jmustache-1.0-sources.jar" />
<varelement var="jar://$M2_REPO$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar!/" value="M2_REPO/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar" />
<varelement var="jar://$M2_REPO$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0-sources.jar!/" value="src:M2_REPO/javax/annotation/jsr250-api/1.0/jsr250-api-1.0-sources.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/aopalliance/aopalliance/1.0/aopalliance-1.0.jar!/" value="M2_REPO/aopalliance/aopalliance/1.0/aopalliance-1.0.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/aopalliance/aopalliance/1.0/aopalliance-1.0-sources.jar!/" value="src:M2_REPO/aopalliance/aopalliance/1.0/aopalliance-1.0-sources.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/com/google/inject/guice/2.0/guice-2.0.jar!/" value="M2_REPO/com/google/inject/guice/2.0/guice-2.0.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA.jar!/" value="M2_REPO/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA-sources.jar!/" value="src:M2_REPO/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA-sources.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/com/samskivert/jmustache/1.0/jmustache-1.0.jar!/" value="M2_REPO/com/samskivert/jmustache/1.0/jmustache-1.0.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/com/samskivert/jmustache/1.0/jmustache-1.0-sources.jar!/" value="src:M2_REPO/com/samskivert/jmustache/1.0/jmustache-1.0-sources.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar!/" value="M2_REPO/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar" />
<varelement var="jar://$MAVEN_REPOSITORY$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0-sources.jar!/" value="src:M2_REPO/javax/annotation/jsr250-api/1.0/jsr250-api-1.0-sources.jar" />
</component>
<component name="FacetManager">
<facet type="flex" name="Flex">
<configuration flex_sdk="Flex SDK (player 10)">
<configuration>
<option name="DO_BUILD" value="true" />
<option name="OUTPUT_TYPE" value="Library" />
<option name="USE_DEFAULT_SDK_CONFIG_FILE" value="true" />
@@ -42,30 +42,23 @@
</component>
<component name="NewModuleRootManager" inherit-compiler-output="true">
<exclude-output />
<content url="file://$MODULE_DIR$">
<sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
<sourceFolder url="file://$MODULE_DIR$/src/test/resources" isTestSource="true" />
<sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
<sourceFolder url="file://$MODULE_DIR$/src/main/resources" isTestSource="false" />
<sourceFolder url="file://$MODULE_DIR$/src/as" isTestSource="false" />
</content>
<orderEntry type="sourceFolder" forTests="false" />
<orderEntry type="inheritedJdk" />
<orderEntry type="module-library" exported="">
<library name="aopalliance-1.0.jar">
<CLASSES>
<root url="jar://$M2_REPO$/aopalliance/aopalliance/1.0/aopalliance-1.0.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/aopalliance/aopalliance/1.0/aopalliance-1.0.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES>
<root url="jar://$M2_REPO$/aopalliance/aopalliance/1.0/aopalliance-1.0-sources.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/aopalliance/aopalliance/1.0/aopalliance-1.0-sources.jar!/" />
</SOURCES>
</library>
</orderEntry>
<orderEntry type="module-library" exported="">
<library name="guice-2.0.jar">
<CLASSES>
<root url="jar://$M2_REPO$/com/google/inject/guice/2.0/guice-2.0.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/com/google/inject/guice/2.0/guice-2.0.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES />
@@ -74,35 +67,35 @@
<orderEntry type="module-library" exported="">
<library name="javassist-3.8.0.GA.jar">
<CLASSES>
<root url="jar://$M2_REPO$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES>
<root url="jar://$M2_REPO$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA-sources.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/javassist/javassist/3.8.0.GA/javassist-3.8.0.GA-sources.jar!/" />
</SOURCES>
</library>
</orderEntry>
<orderEntry type="module-library" exported="">
<library name="jmustache-1.0.jar">
<CLASSES>
<root url="jar://$M2_REPO$/com/samskivert/jmustache/1.0/jmustache-1.0.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/com/samskivert/jmustache/1.0/jmustache-1.0.jar!/" />
</CLASSES>
<JAVADOC>
<root url="jar:file://Users/groves/.m2/repository/com/samskivert/jmustache/1.0/jmustache-1.0-javadoc.jar!/" />
</JAVADOC>
<SOURCES>
<root url="jar://$M2_REPO$/com/samskivert/jmustache/1.0/jmustache-1.0-sources.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/com/samskivert/jmustache/1.0/jmustache-1.0-sources.jar!/" />
</SOURCES>
</library>
</orderEntry>
<orderEntry type="module-library" exported="">
<library name="jsr250-api-1.0.jar">
<CLASSES>
<root url="jar://$M2_REPO$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar!/" />
</CLASSES>
<JAVADOC />
<SOURCES>
<root url="jar://$M2_REPO$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0-sources.jar!/" />
<root url="jar://$MAVEN_REPOSITORY$/javax/annotation/jsr250-api/1.0/jsr250-api-1.0-sources.jar!/" />
</SOURCES>
</library>
</orderEntry>
@@ -118,37 +111,6 @@
<SOURCES />
</library>
</orderEntry>
<orderEntry type="module-library">
<library name="AUTOGENERATED library equal to Flex SDK Flex SDK (player 10)">
<CLASSES>
<root url="jar://$FLEX_DIR$/frameworks/libs/flex.swc!/" />
<root url="jar://$FLEX_DIR$/frameworks/libs/framework.swc!/" />
<root url="jar://$FLEX_DIR$/frameworks/libs/rpc.swc!/" />
<root url="jar://$FLEX_DIR$/frameworks/libs/utilities.swc!/" />
<root url="jar://$FLEX_DIR$/frameworks/locale/en_US/airframework_rb.swc!/" />
<root url="jar://$FLEX_DIR$/frameworks/locale/en_US/framework_rb.swc!/" />
<root url="jar://$FLEX_DIR$/frameworks/locale/en_US/rpc_rb.swc!/" />
<root url="jar://$FLEX_DIR$/frameworks/libs/player/10/playerglobal.swc!/" />
</CLASSES>
<JAVADOC />
<SOURCES>
<root url="file://$FLEX_DIR$/frameworks/projects/air/ApplicationUpdater/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/air/ServiceMonitor/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/airframework/bundles/en_US/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/airframework/bundles/ja_JP/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/airframework/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/flex/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/framework/bundles/en_US/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/framework/bundles/ja_JP/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/framework/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/haloclassic/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/rpc/bundles/en_US/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/rpc/bundles/ja_JP/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/rpc/src" />
<root url="file://$FLEX_DIR$/frameworks/projects/utilities/src" />
</SOURCES>
</library>
</orderEntry>
</component>
</module>
src/main/java/com/threerings/crowd/chat/server/SpeakHandler.java
+1 -1
View File
@@ -103,7 +103,7 @@ public class SpeakHandler
// ensure that the speaker is valid
if ((mode == ChatCodes.BROADCAST_MODE) ||
(_validator != null && !_validator.isValidSpeaker(_speakObj, caller, mode))) {
(_validator != null && !_validator.isValidSpeaker(_speakObj, source, mode))) {
log.warning("Refusing invalid speak request", "caller", caller.who(),
"speakObj", _speakObj.which(), "message", message, "mode", mode);
src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java
+9 -2
View File
@@ -21,25 +21,30 @@
package com.threerings.crowd.data;
import com.google.inject.Inject;
import com.google.inject.Singleton;
import com.threerings.presents.data.ClientObject;
import com.threerings.presents.data.Permission;
import com.threerings.presents.data.PermissionPolicy;
import com.threerings.crowd.chat.data.ChatCodes;
import com.threerings.crowd.server.BodyLocator;
/**
* Implements some Crowd permissions.
*/
@Singleton
public class CrowdPermissionPolicy extends PermissionPolicy
{
@Override // from PermissionPolicy
public String checkAccess (ClientObject clobj, Permission perm, Object context)
{
if (!(clobj instanceof BodyObject)) {
BodyObject body = _locator.forClient(clobj);
if (body == null) {
return super.checkAccess(clobj, perm, context);
}
BodyObject body = (BodyObject)clobj;
if (perm == ChatCodes.BROADCAST_ACCESS) {
return body.getTokens().isAdmin() ? null : ACCESS_DENIED;
} else if (perm == ChatCodes.CHAT_ACCESS) {
@@ -48,4 +53,6 @@ public class CrowdPermissionPolicy extends PermissionPolicy
return super.checkAccess(clobj, perm, context);
}
}
@Inject protected transient BodyLocator _locator;
}
src/main/java/com/threerings/crowd/server/CrowdClientResolver.java
+8 -1
View File
@@ -21,6 +21,10 @@
package com.threerings.crowd.server;
import com.google.inject.Inject;
import com.google.inject.Injector;
import com.google.inject.Singleton;
import com.threerings.presents.data.ClientObject;
import com.threerings.presents.data.PermissionPolicy;
import com.threerings.presents.server.ClientLocal;
@@ -32,6 +36,7 @@ import com.threerings.crowd.data.CrowdPermissionPolicy;
/**
* Used to configure crowd-specific client object data.
*/
@Singleton
public class CrowdClientResolver extends ClientResolver
{
@Override // from ClientResolver
@@ -49,6 +54,8 @@ public class CrowdClientResolver extends ClientResolver
@Override // from ClientResolver
public PermissionPolicy createPermissionPolicy ()
{
return new CrowdPermissionPolicy();
return _injector.getInstance(CrowdPermissionPolicy.class);
}
@Inject protected Injector _injector;
}