090 intermediate
This commit is contained in:
msyu
@@ -67,7 +67,7 @@
|
||||
<cfset local.cfsParamChecker = CreateObject("component", "instance_operation_cfs_param_ls")/>
|
||||
|
||||
<!--- we could check existence of required parameters right in the query,
|
||||
but for possible value chech and verbosity do it in the loop --->
|
||||
but for possible value check and verbosity do it in the loop --->
|
||||
<cfloop query=#local.qCheckCfsParams#>
|
||||
<cfif (local.qCheckCfsParams.is_required GT 0 AND NOT len(local.qCheckCfsParams.instance_operation_cfs_param_uid) GT 0)><!--- check CFS param existence --->
|
||||
<cfreturn representationOf(this.helper.formatMessage("required CFS parameter #local.qCheckCfsParams.svc_operation_cfs_param# (#local.qCheckCfsParams.svc_operation_cfs_param_id#) is missing", "Missing required CFS parameter")).withStatus(409)/>
|
||||
@@ -78,6 +78,8 @@
|
||||
|
||||
<!--- ***** тут должен быть контроль доступа на уровне параметров. Желательно по максимуму параноидальный --->
|
||||
<!--- ***** или при сабмите. Может быть, и на уровне RFS параметров тоже --->
|
||||
<cfset checkCfsResourceRealmAccess(arguments.instanceOperationUid)/>
|
||||
|
||||
<cfset generateRfsParams(arguments.instanceOperationUid, arguments.usrId, arguments.contragentId, arguments.contractId)/><!--- *** кроме usr_id остальные параметры избыточны - информация есть у инстанса --->
|
||||
|
||||
<cfset checkRfsResourceRealmAccess(arguments.instanceOperationUid)/>
|
||||
@@ -127,10 +129,10 @@
|
||||
<cfset setInstanceOperationRfsParam(arguments.instanceOperationUid, "contragentCode", getContragentCode(arguments.contragentId))/>
|
||||
</cfif>
|
||||
|
||||
<cfif listFind("create,redeploy",qSvcOperation.operation)>
|
||||
<!--- <cfif listFind("create,redeploy",qSvcOperation.operation)>
|
||||
<cfset CreateObject("component", "instance_operation_ls").checkResourceRealmId(qSvcOperation.resource_realm_id, qSvcOperation.instance_uid)/>
|
||||
<cfset setInstanceOperationRfsParam(arguments.instanceOperationUid, "resourceRealm", qSvcOperation.resource_realm)/><!--- *** для остальных операций не передаем? --->
|
||||
</cfif>
|
||||
<cfset setInstanceOperationRfsParam(arguments.instanceOperationUid, "resourceRealm", qSvcOperation.resource_realm)/>
|
||||
</cfif> --->
|
||||
|
||||
<cfquery name="qWriteRfsFromCfsParams">
|
||||
insert into instance_operation_param (instance_operation_uid,param,param_value)
|
||||
@@ -335,21 +337,85 @@
|
||||
</cffunction>
|
||||
|
||||
|
||||
<cffunction name="checkCfsResourceRealmAccess">
|
||||
<cfargument name="instanceOperationUid" type="guid">
|
||||
|
||||
<cfset var local={}/>
|
||||
|
||||
<!--- структура cfs и rfs параметров отличается, поэтому селекты разные --->
|
||||
<cfquery name="local.qParam">
|
||||
select sop.svc_operation_cfs_param
|
||||
from instance_operation io
|
||||
join instance e on (io.instance_uid=e.instance_uid)
|
||||
join svc_operation so on (e.service_id=so.svc_id)
|
||||
join svc_operation_cfs_param sop on (so.svc_operation_id=sop.svc_operation_id)
|
||||
where io.instance_operation_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationUid#" null=#!isValid("guid",arguments.instanceOperationUid)#/>
|
||||
AND LOWER(sop.svc_operation_cfs_param)=LOWER('resourceRealm')
|
||||
</cfquery><!--- Проверка на LOWER: возможная атака, поэтому трактуем расширенно --->
|
||||
|
||||
<cfif local.qParam.recordCount EQ 0>
|
||||
<cfreturn/><!--- нечего проверять --->
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qOperation">
|
||||
select io.operation
|
||||
from instance_operation io
|
||||
where io.instance_operation_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationUid#" null=#!isValid("guid",arguments.instanceOperationUid)#/>
|
||||
</cfquery>
|
||||
|
||||
<cfquery name="local.qContract">
|
||||
select c.contract_id
|
||||
from instance_operation io
|
||||
join instance e on (io.instance_uid=e.instance_uid)
|
||||
join specification_item si on (e.specification_item_id=si.specification_item_id)
|
||||
join specification s on (si.specification_id=s.specification_id)
|
||||
join contract c on (s.contract_id=c.contract_id)
|
||||
where io.instance_operation_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationUid#" null=#!isValid("guid",arguments.instanceOperationUid)#/>
|
||||
</cfquery>
|
||||
|
||||
<!--- пробегаемся по CFS параметрам данной операции--->
|
||||
<cfquery name="local.qCheckResourceRealmAccess">
|
||||
select r.resource_realm_id, r.resource_realm, iop.param, iop.param_value, a.contract_id, a.is_enabled
|
||||
from resource_realm r
|
||||
join resource_realm_access a on (r.resource_realm_id=a.resource_realm_id)
|
||||
join instance_operation_cfs_param iop on (r.resource_realm=iop.param_value AND iop.param='resourceRealm')
|
||||
where iop.instance_operation_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationUid#" null=#!isValid("guid",arguments.instanceOperationUid)#/>
|
||||
AND (a.contract_id=<cfqueryparam cfsqltype="CF_SQL_INTEGER" value=#local.qContract.contract_id# null=#!isValid("integer",local.qContract.contract_id)#/> OR a.contract_id=0)
|
||||
AND a.is_enabled
|
||||
</cfquery>
|
||||
|
||||
<cfif local.qCheckResourceRealmAccess.recordCount EQ 0>
|
||||
<cfthrow message="resource realm specified in CFS params is not available for current contract" detail="CFS resource realm unawailable. Instance operation UID #arguments.instanceOperationUid#. Contract ID #arguments.contractId#"/>
|
||||
<cfelse>
|
||||
<!--- <cfdump var=#local.qCheckResourceRealmAccess#/><cfabort/> --->
|
||||
<!--- <cfthrow detail="wefwewewewewewer2r24"/> --->
|
||||
</cfif>
|
||||
</cffunction>
|
||||
|
||||
|
||||
<cffunction name="checkRfsResourceRealmAccess">
|
||||
<cfargument name="instanceOperationUid" type="guid">
|
||||
|
||||
<cfset var local={}/>
|
||||
|
||||
<cfquery name="local.qParam">
|
||||
select iop.param
|
||||
from instance_operation io
|
||||
join instance_operation_param iop on (io.instance_operation_uid=iop.instance_operation_uid)
|
||||
where io.instance_operation_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationUid#" null=#!isValid("guid",arguments.instanceOperationUid)#/>
|
||||
AND LOWER(iop.param)=LOWER('resourceRealm')
|
||||
</cfquery> <!--- Проверка на LOWER: возможная атака, поэтому трактуем расширенно --->
|
||||
|
||||
<cfif local.qParam.recordCount EQ 0>
|
||||
<cfreturn/><!--- нечего проверять --->
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qOperation">
|
||||
select io.operation
|
||||
from instance_operation io
|
||||
where io.instance_operation_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationUid#" null=#!isValid("guid",arguments.instanceOperationUid)#/>
|
||||
</cfquery>
|
||||
|
||||
<cfif !listFind("create,redeploy", local.qOperation.operation)>
|
||||
<cfreturn/>
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qContract">
|
||||
select c.contract_id
|
||||
from instance_operation io
|
||||
@@ -372,7 +438,7 @@
|
||||
</cfquery>
|
||||
|
||||
<cfif local.qCheckResourceRealmAccess.recordCount EQ 0>
|
||||
<cfthrow message="resource realm specified in RFS params is not available for current contract" detail="resource realm unawailable. Instance operation UID #arguments.instanceOperationUid#. Contract ID #arguments.contractId#"/>
|
||||
<cfthrow message="resource realm specified in RFS params is not available for current contract" detail="RFS resource realm unawailable. Instance operation UID #arguments.instanceOperationUid#. Contract ID #arguments.contractId#"/>
|
||||
<cfelse>
|
||||
<!--- <cfdump var=#local.qCheckResourceRealmAccess#/><cfabort/> --->
|
||||
<!--- <cfthrow detail="wefwewewewewewer2r24"/> --->
|
||||
|
||||
Reference in New Issue
Block a user