Fix longstanding annoyance with proxy subscriber access control checking. If

we're proxying for a client, we now have to give up our ClientObject to anyone
who wants it, so that they can do access control checks.


git-svn-id: svn+ssh://src.earth.threerings.net/narya/trunk@5593 542714f4-19e9-0310-aa3c-eee0fc999fb1

src/java/com/threerings/presents/server/PresentsObjectAccess.java

@@ -28,6 +28,7 @@ import com.threerings.presents.dobj.DObject;
 import com.threerings.presents.dobj.InvocationRequestEvent;
 import com.threerings.presents.dobj.MessageEvent;
 import com.threerings.presents.dobj.NamedEvent;
+import com.threerings.presents.dobj.ProxySubscriber;
 import com.threerings.presents.dobj.Subscriber;
 
 import static com.threerings.presents.Log.log;
@@ -72,17 +73,17 @@ public class PresentsObjectAccess
         // documentation inherited from interface
         public boolean allowSubscribe (DObject object, Subscriber<?> sub)
         {
-            boolean allowed = true;
             // if the subscriber is a client, ensure that they are this same user
-            if (PresentsSession.class.isInstance(sub)) {
-                PresentsSession client = PresentsSession.class.cast(sub);
-                allowed = (client.getClientObject() == object);
-                if (!allowed) {
+            if (ProxySubscriber.class.isInstance(sub)) {
+                ProxySubscriber proxy = ProxySubscriber.class.cast(sub);
+                if (proxy.getClientObject() != object) {
                     log.warning("Refusing ClientObject subscription request " +
-                                "[obj=" + ((ClientObject)object).who() + ", sub=" + sub + "].");
+                                "[obj=" + ((ClientObject)object).who() +
+                                ", sub=" + proxy.getClientObject().who() + "].");
+                    return false;
                 }
             }
-            return allowed;
+            return true;
         }
 
         // documentation inherited from interface