← Back to branch summary

~drizzle-trunk/drizzle/development

« back to all changes in this revision

Viewing changes to drizzled/plugin/authorization.cc

  • Committer: Joe Daly
  • Date: 2010-06-08 03:11:13 UTC
  • mto: This revision was merged to the branch mainline in revision 1614.
  • Revision ID: skinny.moey@gmail.com-20100608031113-wt8o9k2bbyawwazs
add missing guard in header

Show diffs side-by-side

added added

removed removed

Lines of Context:
drizzled/plugin/authorization.cc
24
24
 
25
25
#include "drizzled/plugin/authorization.h"
26
26
#include "drizzled/security_context.h"
 
27
#include "drizzled/table_identifier.h"
27
28
#include "drizzled/error.h"
28
29
#include "drizzled/session.h"
29
 
#include "drizzled/plugin/registry.h"
30
30
#include "drizzled/gettext.h"
31
31
 
32
32
using namespace std;
61
61
  public unary_function<plugin::Authorization *, bool>
62
62
{
63
63
  const SecurityContext &user_ctx;
64
 
  const string &schema;
 
64
  SchemaIdentifier &schema;
65
65
public:
66
66
  RestrictDbFunctor(const SecurityContext &user_ctx_arg,
67
 
                    const string &schema_arg) :
 
67
                    SchemaIdentifier &schema_arg) :
68
68
    unary_function<plugin::Authorization *, bool>(),
69
69
    user_ctx(user_ctx_arg),
70
70
    schema(schema_arg)
80
80
  public unary_function<plugin::Authorization *, bool>
81
81
{
82
82
  const SecurityContext &user_ctx;
83
 
  const string &schema;
84
 
  const string &table;
 
83
  TableIdentifier &table;
85
84
public:
86
85
  RestrictTableFunctor(const SecurityContext &user_ctx_arg,
87
 
                       const string &schema_arg,
88
 
                       const string &table_arg) :
 
86
                       TableIdentifier &table_arg) :
89
87
    unary_function<plugin::Authorization *, bool>(),
90
88
    user_ctx(user_ctx_arg),
91
 
    schema(schema_arg),
92
89
    table(table_arg)
93
90
  { }
94
91
 
95
92
  inline result_type operator()(argument_type auth)
96
93
  {
97
 
    return auth->restrictTable(user_ctx, schema, table);
 
94
    return auth->restrictTable(user_ctx, table);
98
95
  }
99
96
};
100
97
 
117
114
  }
118
115
};
119
116
 
 
117
class PruneSchemaFunctor :
 
118
  public unary_function<SchemaIdentifier&, bool>
 
119
{
 
120
  const SecurityContext &user_ctx;
 
121
public:
 
122
  PruneSchemaFunctor(const SecurityContext &user_ctx_arg) :
 
123
    unary_function<SchemaIdentifier&, bool>(),
 
124
    user_ctx(user_ctx_arg)
 
125
  { }
 
126
 
 
127
  inline result_type operator()(argument_type auth)
 
128
  {
 
129
    return not plugin::Authorization::isAuthorized(user_ctx, auth, false);
 
130
  }
 
131
};
 
132
 
120
133
} /* namespace */
121
134
 
122
135
bool plugin::Authorization::isAuthorized(const SecurityContext &user_ctx,
131
144
  vector<plugin::Authorization *>::const_iterator iter=
132
145
    find_if(authorization_plugins.begin(),
133
146
            authorization_plugins.end(),
134
 
            RestrictDbFunctor(user_ctx, schema_identifier.getPath()));
 
147
            RestrictDbFunctor(user_ctx, schema_identifier));
 
148
 
135
149
 
136
150
  /*
137
151
   * If iter is == end() here, that means that all of the plugins returned
153
167
}
154
168
 
155
169
bool plugin::Authorization::isAuthorized(const SecurityContext &user_ctx,
156
 
                                         const string &schema,
157
 
                                         const string &table,
 
170
                                         TableIdentifier &table,
158
171
                                         bool send_error)
159
172
{
160
173
  /* If we never loaded any authorization plugins, just return true */
165
178
  vector<plugin::Authorization *>::const_iterator iter=
166
179
    find_if(authorization_plugins.begin(),
167
180
            authorization_plugins.end(),
168
 
            RestrictTableFunctor(user_ctx, schema, table));
 
181
            RestrictTableFunctor(user_ctx, table));
169
182
 
170
183
  /*
171
184
   * If iter is == end() here, that means that all of the plugins returned
179
192
      my_error(ER_DBACCESS_DENIED_ERROR, MYF(0),
180
193
               user_ctx.getUser().c_str(),
181
194
               user_ctx.getIp().c_str(),
182
 
               schema.c_str());
 
195
               table.getSQLPath().c_str());
183
196
    }
184
197
    return false;
185
198
  }
222
235
void plugin::Authorization::pruneSchemaNames(const SecurityContext &user_ctx,
223
236
                                             SchemaIdentifierList &set_of_schemas)
224
237
{
225
 
  SchemaIdentifierList pruned_set_of_names;
226
 
 
227
238
  /* If we never loaded any authorization plugins, just return true */
228
239
  if (authorization_plugins.empty())
229
240
    return;
230
241
 
231
 
  /**
232
 
   * @TODO: It would be stellar if we could find a way to do this with a
233
 
   * functor and an STL algoritm
234
 
   */
235
 
  for (SchemaIdentifierList::iterator iter; iter != set_of_schemas.end(); iter++)
236
 
  {
237
 
    if (not plugin::Authorization::isAuthorized(user_ctx, *iter, false))
238
 
    {
239
 
      iter= pruned_set_of_names.erase(iter);
240
 
    }
241
 
  }
242
 
  set_of_schemas.swap(pruned_set_of_names);
 
242
  set_of_schemas.erase(remove_if(set_of_schemas.begin(),
 
243
                                 set_of_schemas.end(),
 
244
                                 PruneSchemaFunctor(user_ctx)),
 
245
                       set_of_schemas.end());
243
246
}
244
247
 
245
248
} /* namespace drizzled */