From 3146ca071ed232d2007bdff31028334cab8d4e07 Mon Sep 17 00:00:00 2001 From: Par Winzell Date: Tue, 30 Nov 2010 01:23:59 +0000 Subject: [PATCH] Well, that took a while to track down. Both the permissions check and the validation need to be done on the body, not the client. git-svn-id: svn+ssh://src.earth.threerings.net/narya/trunk@6311 542714f4-19e9-0310-aa3c-eee0fc999fb1 --- .idea_module/narya.iml | 151 ++++++++++++++++++ as-pom.xml | 2 +- narya.iml | 76 +++------ .../crowd/chat/server/SpeakHandler.java | 2 +- .../crowd/data/CrowdPermissionPolicy.java | 11 +- .../crowd/server/CrowdClientResolver.java | 9 +- 6 files changed, 189 insertions(+), 62 deletions(-) create mode 100644 .idea_module/narya.iml diff --git a/.idea_module/narya.iml b/.idea_module/narya.iml new file mode 100644 index 000000000..b2b423f47 --- /dev/null +++ b/.idea_module/narya.iml @@ -0,0 +1,151 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/as-pom.xml b/as-pom.xml index 648ae659a..9ee335b7f 100644 --- a/as-pom.xml +++ b/as-pom.xml @@ -4,7 +4,7 @@ com.threerings naryalib swc - 1.3-SNAPSHOT + 1.4-SNAPSHOT narya Facilities for making networked multiplayer games. http://code.google.com/p/narya/ diff --git a/narya.iml b/narya.iml index d32ec0a31..b2f058cfe 100644 --- a/narya.iml +++ b/narya.iml @@ -1,19 +1,19 @@ - - - - - - - - - + + + + + + + + + - + - - - - - - - - + - + - + @@ -74,35 +67,35 @@ - + - + - + - + - + - + @@ -118,37 +111,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/src/main/java/com/threerings/crowd/chat/server/SpeakHandler.java b/src/main/java/com/threerings/crowd/chat/server/SpeakHandler.java index 5c4b33b0c..de879335c 100644 --- a/src/main/java/com/threerings/crowd/chat/server/SpeakHandler.java +++ b/src/main/java/com/threerings/crowd/chat/server/SpeakHandler.java @@ -103,7 +103,7 @@ public class SpeakHandler // ensure that the speaker is valid if ((mode == ChatCodes.BROADCAST_MODE) || - (_validator != null && !_validator.isValidSpeaker(_speakObj, caller, mode))) { + (_validator != null && !_validator.isValidSpeaker(_speakObj, source, mode))) { log.warning("Refusing invalid speak request", "caller", caller.who(), "speakObj", _speakObj.which(), "message", message, "mode", mode); diff --git a/src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java b/src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java index 42527eef8..10d43f49e 100644 --- a/src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java +++ b/src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java @@ -21,25 +21,30 @@ package com.threerings.crowd.data; +import com.google.inject.Inject; +import com.google.inject.Singleton; + import com.threerings.presents.data.ClientObject; import com.threerings.presents.data.Permission; import com.threerings.presents.data.PermissionPolicy; import com.threerings.crowd.chat.data.ChatCodes; +import com.threerings.crowd.server.BodyLocator; /** * Implements some Crowd permissions. */ +@Singleton public class CrowdPermissionPolicy extends PermissionPolicy { @Override // from PermissionPolicy public String checkAccess (ClientObject clobj, Permission perm, Object context) { - if (!(clobj instanceof BodyObject)) { + BodyObject body = _locator.forClient(clobj); + if (body == null) { return super.checkAccess(clobj, perm, context); } - BodyObject body = (BodyObject)clobj; if (perm == ChatCodes.BROADCAST_ACCESS) { return body.getTokens().isAdmin() ? null : ACCESS_DENIED; } else if (perm == ChatCodes.CHAT_ACCESS) { @@ -48,4 +53,6 @@ public class CrowdPermissionPolicy extends PermissionPolicy return super.checkAccess(clobj, perm, context); } } + + @Inject protected transient BodyLocator _locator; } diff --git a/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java b/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java index 1a087a904..af8449de2 100644 --- a/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java +++ b/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java @@ -21,6 +21,10 @@ package com.threerings.crowd.server; +import com.google.inject.Inject; +import com.google.inject.Injector; +import com.google.inject.Singleton; + import com.threerings.presents.data.ClientObject; import com.threerings.presents.data.PermissionPolicy; import com.threerings.presents.server.ClientLocal; @@ -32,6 +36,7 @@ import com.threerings.crowd.data.CrowdPermissionPolicy; /** * Used to configure crowd-specific client object data. */ +@Singleton public class CrowdClientResolver extends ClientResolver { @Override // from ClientResolver @@ -49,6 +54,8 @@ public class CrowdClientResolver extends ClientResolver @Override // from ClientResolver public PermissionPolicy createPermissionPolicy () { - return new CrowdPermissionPolicy(); + return _injector.getInstance(CrowdPermissionPolicy.class); } + + @Inject protected Injector _injector; }