if (log.isDebugEnabled()) {
log.debug("Verifying that '" + currentUser + "' can modify '" + username + "'");
}
if (!administrator) {
log.warn("Access Denied: '" + currentUser + "' tried to modify '" + username + "'!");
throw new AccessDeniedException(ACCESS_DENIED);
}
} else {
if (log.isDebugEnabled()) {
log.debug("Registering new user '" + username + "'");
}
}
}
// fix for http://issues.appfuse.org/browse/APF-96
// don't allow users with "user" role to upgrade to "admin" role
else if (username != null && username.equalsIgnoreCase(currentUser) && !administrator) {
// get the list of roles the user is trying add
Set userRoles = new HashSet();
if (user.getRoles() != null) {
for (Iterator it = user.getRoles().iterator(); it.hasNext();) {
Role role = (Role) it.next();
userRoles.add(role.getName());
}
}
// get the list of roles the user currently has
Set authorizedRoles = new HashSet();
for (int i=0; i < roles.length; i++) {
authorizedRoles.add(roles[i].getAuthority());
}
// if they don't match - access denied
// users aren't allowed to change their roles
if (!CollectionUtils.isEqualCollection(userRoles, authorizedRoles)) {
log.warn("Access Denied: '" + currentUser + "' tried to change their role(s)!");
throw new AccessDeniedException(ACCESS_DENIED);
}
}
}
}