in app/src/main/java/org/apache/roller/weblogger/ui/struts2/editor/Members.java [68:153]
public String save() {
log.debug("Attempting to process weblog permissions updates");
int numAdmins = 0; // make sure at least one admin
int removed = 0;
int changed = 0;
List<WeblogPermission> permsList = new ArrayList<>();
try {
UserManager userMgr = WebloggerFactory.getWeblogger().getUserManager();
List<WeblogPermission> permsFromDB = userMgr.getWeblogPermissionsIncludingPending(getActionWeblog());
// we have to copy the permissions list so that when we remove permissions
// below we don't get ConcurrentModificationExceptions
for (WeblogPermission perm : permsFromDB) {
permsList.add(perm);
}
/* Check to see at least one admin would remain defined as a result of the save.
* Not normally a problem, as only a blog admin can access this page and admins can't
* demote themselves. However, the blog server admin can always access this page and
* remove everyone even if not a member of the blog, causing orphan blogs unless this
* check is in place.
*
* Also checking here to make sure an Admin is not demoting or removing himself.
*/
User user = getAuthenticatedUser();
boolean error = false;
for (WeblogPermission perms : permsList) {
String sval = getParameter("perm-" + perms.getUser().getId());
if (sval != null) {
if (sval.equals(WeblogPermission.ADMIN) && !perms.isPending()) {
numAdmins++;
}
if (perms.getUser().getUserName().equals(user.getUserName())) {
// can't modify self
if (!sval.equals(WeblogPermission.ADMIN)) {
error = true;
addError("memberPermissions.noSelfModifications");
}
}
}
}
if (numAdmins == 0) {
addError("memberPermissions.oneAdminRequired");
error = true;
}
// one iteration for each line (user) in the members table
for (WeblogPermission perms : permsList) {
String sval = getParameter("perm-" + perms.getUser().getId());
if (sval != null) {
if (!error && !perms.hasAction(sval)) {
if ("-1".equals(sval)) {
userMgr.revokeWeblogPermission(
perms.getWeblog(), perms.getUser(), WeblogPermission.ALL_ACTIONS);
removed++;
} else {
userMgr.revokeWeblogPermission(
perms.getWeblog(), perms.getUser(), WeblogPermission.ALL_ACTIONS);
userMgr.grantWeblogPermission(
perms.getWeblog(), perms.getUser(), Utilities.stringToStringList(sval, ","));
changed++;
}
}
}
}
if (removed > 0 || changed > 0) {
log.debug("Weblog permissions updated, flushing changes");
WebloggerFactory.getWeblogger().flush();
}
} catch (Exception ex) {
log.error("Error saving permissions on weblog - "+getActionWeblog().getHandle(), ex);
addError("memberPermissions.saveError");
}
if (removed > 0) {
addMessage("memberPermissions.membersRemoved", Integer.toString(removed));
}
if (changed > 0) {
addMessage("memberPermissions.membersChanged", Integer.toString(changed));
}
return LIST;
}