topic AuthorityService, SearchService and document ownership in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/authorityservice-searchservice-and-document-ownership/m-p/262375#M215505 <HTML><HEAD></HEAD><BODY><SPAN>Hi,</SPAN><BR /><BR /><SPAN>if a user has the&nbsp; ownership of a document (inside a Share document library) he can modify it even if he doesn't belong to the site anymore.</SPAN><BR /><SPAN>This is considered a security issue by a client.</SPAN><BR /><SPAN>To solve this problem, I'm trying to develop a custom AuthorityService that intercepts the removing of a user from a group to verify if, after this removing, he cannot see a site anymore. </SPAN><BR /><SPAN>What I want to do is to verify which subfolders of the "Company Home/Sites" folder the user can see before and after the removing: if a subfolder is not visible anymore, I suppose that the user has been removed from the corresponding site. With the list of all sites from which he has been removed, I can easily find the documents that he owns.</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />&nbsp;&nbsp;&nbsp;public void removeAuthority(String parentName, String childName)<BR />&nbsp;&nbsp;&nbsp;{<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;List&lt;NodeRef&gt; sitesBefore = null;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;List&lt;NodeRef&gt; sitesAfter;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (!childName.startsWith("GROUP_")) {<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sitesBefore = getVisibleSites(childName, null);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;authorityDAO.removeAuthority(parentName, childName);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (sitesBefore != null) {<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sitesAfter = getVisibleSites(childName, sitesBefore);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />&nbsp;&nbsp;&nbsp;}<BR /><BR />&nbsp;&nbsp;&nbsp;private List&lt;NodeRef&gt; getVisibleSites(String childName, final List&lt;NodeRef&gt; excludes) {<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork&lt;List&lt;NodeRef&gt;&gt;() {<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;public List&lt;NodeRef&gt; doWork() throws Exception<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;String luceneSearch = "PATH:\"/app:company_home/st:sites/*\"";<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; StoreRef storeRef = new StoreRef(StoreRef.PROTOCOL_WORKSPACE, "SpacesStore");<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ResultSet rs = searchService.query(storeRef, SearchService.LANGUAGE_LUCENE, luceneSearch);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;List&lt;NodeRef&gt; sites = rs.getNodeRefs();<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (excludes != null) {<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sites.removeAll(excludes);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;QName name = QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "name");<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; for (NodeRef site: sites) {<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Serializable siteName = nodeService.getProperty(site, name);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; System.out.println("siteName = " + siteName);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return sites;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<BR /><BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}, childName);<BR />&nbsp;&nbsp;&nbsp;}<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>Unfortunately when I call the getVisibleSites the second time the user can still see the same list of sites. It seems that the SearchService doesn't see the removing that has been already executed.</SPAN><BR /><BR /><SPAN>To set the searchService of the custom AuthorityService I have used the bean SearchService.</SPAN><BR /><BR /><SPAN>Can you help me please?</SPAN><BR /><BR /><SPAN>Thanks,</SPAN><BR /><SPAN>Marco</SPAN></BODY></HTML> Fri, 18 Feb 2011 06:52:38 GMT marco_altieri 2011-02-18T06:52:38Z AuthorityService, SearchService and document ownership https://connect.hyland.com/t5/alfresco-archive/authorityservice-searchservice-and-document-ownership/m-p/262375#M215505 Hi,if a user has the&nbsp; ownership of a document (inside a Share document library) he can modify it even if he doesn't belong to the site anymore.This is considered a security issue by a client.To solve this problem, I'm trying to develop a custom AuthorityService that intercepts the removing of a user Fri, 18 Feb 2011 06:52:38 GMT https://connect.hyland.com/t5/alfresco-archive/authorityservice-searchservice-and-document-ownership/m-p/262375#M215505 marco_altieri 2011-02-18T06:52:38Z Re: AuthorityService, SearchService and document ownership https://connect.hyland.com/t5/alfresco-archive/authorityservice-searchservice-and-document-ownership/m-p/262376#M215506 <HTML><HEAD></HEAD><BODY><SPAN>I found the solution: it's necessary to verify the permission of each node that lucene returns.</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />if (permissionService.hasPermission(nodeRef, PermissionService.READ) == AccessStatus.ALLOWED) {<BR />&nbsp;&nbsp; /* This is a valid nodeRef */<BR />}<BR />else {<BR />&nbsp;&nbsp; /* the user cannot access this node */<BR />}<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE></BODY></HTML> Wed, 23 Feb 2011 18:49:27 GMT https://connect.hyland.com/t5/alfresco-archive/authorityservice-searchservice-and-document-ownership/m-p/262376#M215506 marco_altieri 2011-02-23T18:49:27Z