getSpecialGroups(Context context, HttpServletRequest request)
* otherwise
*/
public default boolean areSpecialGroupsApplicable(Context context, HttpServletRequest request) {
- return getName().equals(context.getAuthenticationMethod());
+ return getName().equals(context.getAuthenticationMethod()) || isUsed(context, request);
}
/**
@@ -188,7 +188,7 @@ public default boolean areSpecialGroupsApplicable(Context context, HttpServletRe
* Meaning:
*
SUCCESS - authenticated OK.
*
BAD_CREDENTIALS - user exists, but credentials (e.g. passwd) don't match
- *
CERT_REQUIRED - not allowed to login this way without X.509 cert.
+ *
CERT_REQUIRED - not allowed to login this way without a cert.
*
NO_SUCH_USER - user not found using this method.
*
BAD_ARGS - user/pw not appropriate for this method
* @throws SQLException if database error
diff --git a/dspace-api/src/main/java/org/dspace/authenticate/AuthenticationServiceImpl.java b/dspace-api/src/main/java/org/dspace/authenticate/AuthenticationServiceImpl.java
index 2b07f73c489c..c0dde49b13a3 100644
--- a/dspace-api/src/main/java/org/dspace/authenticate/AuthenticationServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/authenticate/AuthenticationServiceImpl.java
@@ -38,11 +38,11 @@
* Configuration
* The stack of authentication methods is defined by one property in the DSpace configuration:
*
- * plugin.sequence.org.dspace.eperson.AuthenticationMethod = a list of method class names
+ * plugin.sequence.org.dspace.authenticate.AuthenticationMethod = a list of method class names
* e.g.
- * plugin.sequence.org.dspace.eperson.AuthenticationMethod = \
- * org.dspace.eperson.X509Authentication, \
- * org.dspace.eperson.PasswordAuthentication
+ * plugin.sequence.org.dspace.authenticate.AuthenticationMethod = \
+ * org.dspace.authenticate.IPAuthentication, \
+ * org.dspace.authenticate.PasswordAuthentication
*
*
* The "stack" is always traversed in order, with the methods
@@ -110,6 +110,7 @@ protected int authenticateInternal(Context context,
}
if (ret == AuthenticationMethod.SUCCESS) {
updateLastActiveDate(context);
+ context.setAuthenticationMethod(aMethodStack.getName());
return ret;
}
if (ret < bestRet) {
diff --git a/dspace-api/src/main/java/org/dspace/authenticate/LDAPAuthentication.java b/dspace-api/src/main/java/org/dspace/authenticate/LDAPAuthentication.java
index 40b8f48078c9..b199cdb94685 100644
--- a/dspace-api/src/main/java/org/dspace/authenticate/LDAPAuthentication.java
+++ b/dspace-api/src/main/java/org/dspace/authenticate/LDAPAuthentication.java
@@ -9,27 +9,13 @@
import static org.dspace.eperson.service.EPersonService.MD_PHONE;
-import java.io.IOException;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
-import java.util.Hashtable;
import java.util.Iterator;
import java.util.List;
import java.util.Optional;
-import javax.naming.NamingEnumeration;
-import javax.naming.NamingException;
-import javax.naming.directory.Attribute;
-import javax.naming.directory.Attributes;
-import javax.naming.directory.BasicAttribute;
-import javax.naming.directory.BasicAttributes;
-import javax.naming.directory.SearchControls;
-import javax.naming.directory.SearchResult;
-import javax.naming.ldap.InitialLdapContext;
-import javax.naming.ldap.LdapContext;
-import javax.naming.ldap.StartTlsRequest;
-import javax.naming.ldap.StartTlsResponse;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
@@ -47,6 +33,16 @@
import org.dspace.eperson.service.GroupService;
import org.dspace.services.ConfigurationService;
import org.dspace.services.factory.DSpaceServicesFactory;
+import org.springframework.ldap.core.ContextMapper;
+import org.springframework.ldap.core.DirContextOperations;
+import org.springframework.ldap.core.LdapTemplate;
+import org.springframework.ldap.core.support.LdapContextSource;
+import org.springframework.ldap.filter.EqualsFilter;
+import org.springframework.ldap.filter.PresentFilter;
+import org.springframework.ldap.query.LdapQueryBuilder;
+import org.springframework.ldap.support.LdapNameBuilder;
+import org.springframework.ldap.support.LdapUtils;
+
/**
* This combined LDAP authentication method supersedes both the 'LDAPAuthentication'
@@ -203,7 +199,7 @@ public List getSpecialGroups(Context context, HttpServletRequest request)
* Meaning:
*
SUCCESS - authenticated OK.
*
BAD_CREDENTIALS - user exists, but credentials (e.g. passwd) don't match
- *
CERT_REQUIRED - not allowed to login this way without X.509 cert.
+ *
CERT_REQUIRED - not allowed to login this way without a cert.
*
NO_SUCH_USER - user not found using this method.
*
BAD_ARGS - user/pw not appropriate for this method
*/
@@ -238,12 +234,18 @@ public int authenticate(Context context,
String idField = configurationService.getProperty("authentication-ldap.id_field");
String dn = "";
- // If adminUser is blank and anonymous search is not allowed, then we can't search so construct the DN
- // instead of searching it
if ((StringUtils.isBlank(adminUser) || StringUtils.isBlank(adminPassword)) && !anonymousSearch) {
- dn = idField + "=" + netid + "," + objectContext;
+ try {
+ dn = LdapNameBuilder.newInstance(objectContext)
+ .add(idField, netid)
+ .build()
+ .toString();
+ } catch (Exception e) {
+ log.warn("Failed to build DN for user " + netid, e);
+ return BAD_ARGS;
+ }
} else {
- dn = ldap.getDNOfUser(adminUser, adminPassword, context, netid);
+ dn = ldap.getDNOfUser(context, netid);
}
// Check a DN was found
@@ -322,7 +324,7 @@ public int authenticate(Context context,
log.info(LogHelper.getHeader(context,
"type=ldap-login", "type=ldap_but_already_email"));
context.turnOffAuthorisationSystem();
- setEpersonAttributes(context, eperson, ldap, Optional.of(netid));
+ setEpersonAttributes(context, eperson, ldap, Optional.of(netid), email);
ePersonService.update(context, eperson);
context.dispatchEvents();
context.restoreAuthSystemState();
@@ -339,7 +341,7 @@ public int authenticate(Context context,
try {
context.turnOffAuthorisationSystem();
eperson = ePersonService.create(context);
- setEpersonAttributes(context, eperson, ldap, Optional.of(netid));
+ setEpersonAttributes(context, eperson, ldap, Optional.of(netid), email);
eperson.setCanLogIn(true);
authenticationService.initEPerson(context, request, eperson);
ePersonService.update(context, eperson);
@@ -381,11 +383,24 @@ public int authenticate(Context context,
* Update eperson's attributes
*/
private void setEpersonAttributes(Context context, EPerson eperson, SpeakerToLDAP ldap, Optional netid)
- throws SQLException {
+ throws SQLException {
+ setEpersonAttributes(context, eperson, ldap, netid, null);
+ }
+
+ /**
+ * Update eperson's attributes
+ */
+ private void setEpersonAttributes(Context context, EPerson eperson, SpeakerToLDAP ldap, Optional netid,
+ String email)
+ throws SQLException {
+ // Set email address: first try LDAP email, then fallback to provided email parameter
if (StringUtils.isNotEmpty(ldap.ldapEmail)) {
eperson.setEmail(ldap.ldapEmail);
+ } else if (StringUtils.isNotEmpty(email)) {
+ eperson.setEmail(email);
}
+
if (StringUtils.isNotEmpty(ldap.ldapGivenName)) {
eperson.setFirstName(context, ldap.ldapGivenName);
}
@@ -429,6 +444,7 @@ private static class SpeakerToLDAP {
final String ldap_group_field;
final boolean useTLS;
+ private LdapTemplate ldapTemplate;
SpeakerToLDAP(Logger thelog) {
ConfigurationService configurationService
@@ -445,252 +461,112 @@ private static class SpeakerToLDAP {
ldap_phone_field = configurationService.getProperty("authentication-ldap.phone_field");
ldap_group_field = configurationService.getProperty("authentication-ldap.login.groupmap.attribute");
useTLS = configurationService.getBooleanProperty("authentication-ldap.starttls", false);
- }
- protected String getDNOfUser(String adminUser, String adminPassword, Context context, String netid) {
- // The resultant DN
- String resultDN;
+ setupSpringLdap(configurationService);
+ }
- // The search scope to use (default to 0)
- int ldap_search_scope_value = 0;
- try {
- ldap_search_scope_value = Integer.parseInt(ldap_search_scope.trim());
- } catch (NumberFormatException e) {
- // Log the error if it has been set but is invalid
- if (ldap_search_scope != null) {
- log.warn(LogHelper.getHeader(context,
- "ldap_authentication", "invalid search scope: " + ldap_search_scope));
- }
+ private void setupSpringLdap(ConfigurationService cfg) {
+ LdapContextSource contextSource = new LdapContextSource();
+ if (StringUtils.isBlank(ldap_provider_url)) {
+ throw new IllegalStateException(
+ "LDAP provider URL is empty! Please check 'authentication-ldap.provider_url' in your configuration."
+ );
}
+ contextSource.setUrl(ldap_provider_url);
- // Set up environment for creating initial context
- @SuppressWarnings("UseOfObsoleteCollectionType")
- Hashtable env = new Hashtable<>();
- env.put(javax.naming.Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
- env.put(javax.naming.Context.PROVIDER_URL, ldap_provider_url);
-
- LdapContext ctx = null;
- StartTlsResponse startTLSResponse = null;
+ String adminUser = cfg.getProperty("authentication-ldap.search.user");
+ String adminPass = cfg.getProperty("authentication-ldap.search.password");
- try {
- if ((adminUser != null) && (!adminUser.trim().equals("")) &&
- (adminPassword != null) && (!adminPassword.trim().equals(""))) {
- if (useTLS) {
- ctx = new InitialLdapContext(env, null);
- // start TLS
- startTLSResponse = (StartTlsResponse) ctx
- .extendedOperation(new StartTlsRequest());
-
- startTLSResponse.negotiate();
-
- // perform simple client authentication
- ctx.addToEnvironment(javax.naming.Context.SECURITY_AUTHENTICATION, "simple");
- ctx.addToEnvironment(javax.naming.Context.SECURITY_PRINCIPAL,
- adminUser);
- ctx.addToEnvironment(javax.naming.Context.SECURITY_CREDENTIALS,
- adminPassword);
- } else {
- // Use admin credentials for search// Authenticate
- env.put(javax.naming.Context.SECURITY_AUTHENTICATION, "simple");
- env.put(javax.naming.Context.SECURITY_PRINCIPAL, adminUser);
- env.put(javax.naming.Context.SECURITY_CREDENTIALS, adminPassword);
- }
- } else {
- // Use anonymous authentication
- env.put(javax.naming.Context.SECURITY_AUTHENTICATION, "none");
- }
+ if (StringUtils.isNotBlank(adminUser) && StringUtils.isNotBlank(adminPass)) {
+ contextSource.setUserDn(adminUser);
+ contextSource.setPassword(adminPass);
+ } else {
+ contextSource.setAnonymousReadOnly(true);
+ }
- if (ctx == null) {
- // Create initial context
- ctx = new InitialLdapContext(env, null);
- }
+ contextSource.setPooled(true);
+ contextSource.afterPropertiesSet();
+ this.ldapTemplate = new LdapTemplate(contextSource);
+ this.ldapTemplate.setIgnorePartialResultException(true);
+ }
- Attributes matchAttrs = new BasicAttributes(true);
- matchAttrs.put(new BasicAttribute(ldap_id_field, netid));
+ protected String getDNOfUser(Context context, String netid) {
+ try {
+ EqualsFilter filter = new EqualsFilter(ldap_id_field, netid);
- // look up attributes
- try {
- SearchControls ctrls = new SearchControls();
- ctrls.setSearchScope(ldap_search_scope_value);
- // Fetch both user attributes '*' (eg. uid, cn) and operational attributes '+' (eg. memberOf)
- ctrls.setReturningAttributes(new String[] {"*", "+"});
-
- String searchName;
- if (useTLS) {
- searchName = ldap_search_context;
- } else {
- searchName = ldap_provider_url + ldap_search_context;
- }
- @SuppressWarnings("BanJNDI")
- NamingEnumeration answer = ctx.search(
- searchName,
- "(&({0}={1}))", new Object[] {ldap_id_field,
- netid}, ctrls);
-
- while (answer.hasMoreElements()) {
- SearchResult sr = answer.next();
- if (StringUtils.isEmpty(ldap_search_context)) {
- resultDN = sr.getName();
- } else {
- resultDN = (sr.getName() + "," + ldap_search_context);
- }
+ log.debug("Searching for user using Spring LDAP filter: {}", filter.toString());
- String attlist[] = {ldap_email_field, ldap_givenname_field,
- ldap_surname_field, ldap_phone_field, ldap_group_field};
- Attributes atts = sr.getAttributes();
- Attribute att;
+ List foundDNs = ldapTemplate.search(
+ LdapQueryBuilder.query().base(ldap_search_context).filter(filter),
+ (ContextMapper) (originalCtx) -> {
+ DirContextOperations ctx = (DirContextOperations) originalCtx;
- if (attlist[0] != null) {
- att = atts.get(attlist[0]);
- if (att != null) {
- ldapEmail = (String) att.get();
- }
+ if (ldap_email_field != null) {
+ this.ldapEmail = ctx.getStringAttribute(ldap_email_field);
}
- if (attlist[1] != null) {
- att = atts.get(attlist[1]);
- if (att != null) {
- ldapGivenName = (String) att.get();
- }
+ if (ldap_givenname_field != null) {
+ this.ldapGivenName = ctx.getStringAttribute(ldap_givenname_field);
}
- if (attlist[2] != null) {
- att = atts.get(attlist[2]);
- if (att != null) {
- ldapSurname = (String) att.get();
- }
+ if (ldap_surname_field != null) {
+ this.ldapSurname = ctx.getStringAttribute(ldap_surname_field);
}
- if (attlist[3] != null) {
- att = atts.get(attlist[3]);
- if (att != null) {
- ldapPhone = (String) att.get();
- }
+ if (ldap_phone_field != null) {
+ this.ldapPhone = ctx.getStringAttribute(ldap_phone_field);
}
- if (attlist[4] != null) {
- att = atts.get(attlist[4]);
- if (att != null) {
- // loop through all groups returned by LDAP
- ldapGroup = new ArrayList<>();
- for (NamingEnumeration val = att.getAll(); val.hasMoreElements(); ) {
- ldapGroup.add((String) val.next());
- }
+ if (ldap_group_field != null) {
+ String[] groups = ctx.getStringAttributes(ldap_group_field);
+ if (groups != null) {
+ this.ldapGroup = new ArrayList<>(Arrays.asList(groups));
}
}
-
- if (answer.hasMoreElements()) {
- // Oh dear - more than one match
- // Ambiguous user, can't continue
-
- } else {
- log.debug(LogHelper.getHeader(context, "got DN", resultDN));
- return resultDN;
- }
+ return ctx.getNameInNamespace();
}
- } catch (NamingException e) {
- // if the lookup fails go ahead and create a new record for them because the authentication
- // succeeded
- log.warn(LogHelper.getHeader(context,
- "ldap_attribute_lookup", "type=failed_search "
- + e));
- }
- } catch (NamingException | IOException e) {
- log.warn(LogHelper.getHeader(context,
- "ldap_authentication", "type=failed_auth " + e));
- } finally {
- // Close the context when we're done
- try {
- if (startTLSResponse != null) {
- startTLSResponse.close();
- }
- if (ctx != null) {
- ctx.close();
- }
- } catch (NamingException | IOException e) {
- // ignore
+ );
+
+ if (foundDNs.isEmpty()) {
+ log.debug(LogHelper.getHeader(context, "getDNOfUser", "no DN found for user " + netid));
+ return null;
+ } else if (foundDNs.size() > 1) {
+ log.warn(LogHelper.getHeader(context, "getDNOfUser", "multiple DN found for user " + netid));
+ return null;
}
+ String resultDN = foundDNs.get(0);
+ log.debug(LogHelper.getHeader(context, "got DN", resultDN));
+ return resultDN;
+ } catch (Exception e) {
+ log.warn(LogHelper.getHeader(context, "ldap_authentication", "type=failed_search " + e));
+ return null;
}
-
- // No DN match found
- return null;
}
/**
* contact the ldap server and attempt to authenticate
*/
- protected boolean ldapAuthenticate(String netid, String password,
- Context context) {
- if (!password.equals("")) {
-
- LdapContext ctx = null;
- StartTlsResponse startTLSResponse = null;
-
-
- // Set up environment for creating initial context
- @SuppressWarnings("UseOfObsoleteCollectionType")
- Hashtable env = new Hashtable<>();
- env.put(javax.naming.Context.INITIAL_CONTEXT_FACTORY,
- "com.sun.jndi.ldap.LdapCtxFactory");
- env.put(javax.naming.Context.PROVIDER_URL, ldap_provider_url);
-
- try {
- if (useTLS) {
- ctx = new InitialLdapContext(env, null);
- // start TLS
- startTLSResponse = (StartTlsResponse) ctx
- .extendedOperation(new StartTlsRequest());
-
- startTLSResponse.negotiate();
-
- // perform simple client authentication
- ctx.addToEnvironment(javax.naming.Context.SECURITY_AUTHENTICATION, "simple");
- ctx.addToEnvironment(javax.naming.Context.SECURITY_PRINCIPAL,
- netid);
- ctx.addToEnvironment(javax.naming.Context.SECURITY_CREDENTIALS,
- password);
- ctx.addToEnvironment(javax.naming.Context.AUTHORITATIVE, "true");
- ctx.addToEnvironment(javax.naming.Context.REFERRAL, "follow");
- // dummy operation to check if authentication has succeeded
- @SuppressWarnings("BanJNDI")
- Attributes trash = ctx.getAttributes("");
- } else if (!useTLS) {
- // Authenticate
- env.put(javax.naming.Context.SECURITY_AUTHENTICATION, "Simple");
- env.put(javax.naming.Context.SECURITY_PRINCIPAL, netid);
- env.put(javax.naming.Context.SECURITY_CREDENTIALS, password);
- env.put(javax.naming.Context.AUTHORITATIVE, "true");
- env.put(javax.naming.Context.REFERRAL, "follow");
-
- // Try to bind
- ctx = new InitialLdapContext(env, null);
- }
- } catch (NamingException | IOException e) {
- // something went wrong (like wrong password) so return false
- log.warn(LogHelper.getHeader(context,
- "ldap_authentication", "type=failed_auth " + e));
- return false;
- } finally {
- // Close the context when we're done
- try {
- if (startTLSResponse != null) {
- startTLSResponse.close();
- }
- if (ctx != null) {
- ctx.close();
- }
- } catch (NamingException | IOException e) {
- // ignore
- }
- }
- } else {
+ protected boolean ldapAuthenticate(String dn, String password, Context context) {
+ if (StringUtils.isBlank(password)) {
return false;
}
- return true;
+ try {
+ boolean authenticated = ldapTemplate.authenticate(
+ LdapUtils.newLdapName(dn),
+ new PresentFilter(ldap_id_field).toString(),
+ password
+ );
+ return authenticated;
+
+ } catch (Exception e) {
+ log.warn(LogHelper.getHeader(context, "ldap_authentication", "type=failed_auth " + e));
+ return false;
+ }
}
}
+
/**
* Returns the URL of an external login page which is not applicable for this authn method.
*
diff --git a/dspace-api/src/main/java/org/dspace/authenticate/OrcidAuthenticationBean.java b/dspace-api/src/main/java/org/dspace/authenticate/OrcidAuthenticationBean.java
index 590bbf6cf0ef..be2111fad9bc 100644
--- a/dspace-api/src/main/java/org/dspace/authenticate/OrcidAuthenticationBean.java
+++ b/dspace-api/src/main/java/org/dspace/authenticate/OrcidAuthenticationBean.java
@@ -120,7 +120,7 @@ public String loginPageURL(Context context, HttpServletRequest request, HttpServ
@Override
public boolean isUsed(Context context, HttpServletRequest request) {
- return request.getAttribute(ORCID_AUTH_ATTRIBUTE) != null;
+ return request != null && request.getAttribute(ORCID_AUTH_ATTRIBUTE) != null;
}
@Override
diff --git a/dspace-api/src/main/java/org/dspace/authenticate/PasswordAuthentication.java b/dspace-api/src/main/java/org/dspace/authenticate/PasswordAuthentication.java
index 8e030305c957..035a235422a6 100644
--- a/dspace-api/src/main/java/org/dspace/authenticate/PasswordAuthentication.java
+++ b/dspace-api/src/main/java/org/dspace/authenticate/PasswordAuthentication.java
@@ -188,7 +188,7 @@ public List getSpecialGroups(Context context, HttpServletRequest request)
* Meaning:
*
SUCCESS - authenticated OK.
*
BAD_CREDENTIALS - user exists, but password doesn't match
- *
CERT_REQUIRED - not allowed to login this way without X.509 cert.
+ *
CERT_REQUIRED - not allowed to login this way without a cert.
*
NO_SUCH_USER - no EPerson with matching email address.
*
BAD_ARGS - missing username, or user matched but cannot login.
* @throws SQLException if database error
@@ -213,7 +213,7 @@ public int authenticate(Context context,
// cannot login this way
return BAD_ARGS;
} else if (eperson.getRequireCertificate()) {
- // this user can only login with x.509 certificate
+ // this user can only login with a certificate
log.warn(LogHelper.getHeader(context, "authenticate",
"rejecting PasswordAuthentication because " + username + " requires " +
"certificate."));
diff --git a/dspace-api/src/main/java/org/dspace/authenticate/ShibAuthentication.java b/dspace-api/src/main/java/org/dspace/authenticate/ShibAuthentication.java
index 24d8266012d4..13a5ae6d0dfd 100644
--- a/dspace-api/src/main/java/org/dspace/authenticate/ShibAuthentication.java
+++ b/dspace-api/src/main/java/org/dspace/authenticate/ShibAuthentication.java
@@ -160,7 +160,7 @@ public class ShibAuthentication implements AuthenticationMethod {
* SUCCESS - authenticated OK.
* BAD_CREDENTIALS - user exists, but credentials (e.g. passwd)
* don't match
- * CERT_REQUIRED - not allowed to login this way without X.509 cert.
+ * CERT_REQUIRED - not allowed to login this way without a cert.
*
* NO_SUCH_USER - user not found using this method.
* BAD_ARGS - user/pw not appropriate for this method
@@ -417,8 +417,7 @@ public boolean allowSetPassword(Context context,
* Predicate, is this an implicit authentication method. An implicit method
* gets credentials from the environment (such as an HTTP request or even
* Java system properties) rather than the explicit username and password.
- * For example, a method that reads the X.509 certificates in an HTTPS
- * request is implicit.
+ * For example, a method that provides IP-based authentication is implicit.
*
* @return true if this method uses implicit authentication.
*/
@@ -871,7 +870,7 @@ protected void updateEPerson(Context context, HttpServletRequest request, EPerso
String[] nameParts = MetadataFieldName.parse(field);
ePersonService.setMetadataSingleValue(context, eperson,
- nameParts[0], nameParts[1], nameParts[2], value, null);
+ nameParts[0], nameParts[1], nameParts[2], null, value);
log.debug("Updated the eperson's '{}' metadata using header: '{}' = '{}'.",
field, header, value);
}
@@ -917,7 +916,7 @@ protected int swordCompatibility(Context context, String username, String passwo
" is not allowed to login.");
return BAD_ARGS;
} else if (eperson.getRequireCertificate()) {
- // this user can only login with x.509 certificate
+ // this user can only login with a certificate
log.error(
"Shibboleth-based password authentication failed for user " + username + " because the eperson object" +
" requires a certificate to authenticate..");
diff --git a/dspace-api/src/main/java/org/dspace/authenticate/X509Authentication.java b/dspace-api/src/main/java/org/dspace/authenticate/X509Authentication.java
deleted file mode 100644
index 55843c710760..000000000000
--- a/dspace-api/src/main/java/org/dspace/authenticate/X509Authentication.java
+++ /dev/null
@@ -1,616 +0,0 @@
-/**
- * The contents of this file are subject to the license and copyright
- * detailed in the LICENSE and NOTICE files at the root of the source
- * tree and available online at
- *
- * http://www.dspace.org/license/
- */
-package org.dspace.authenticate;
-
-import java.io.BufferedInputStream;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.GeneralSecurityException;
-import java.security.KeyStore;
-import java.security.Principal;
-import java.security.PublicKey;
-import java.security.cert.Certificate;
-import java.security.cert.CertificateException;
-import java.security.cert.CertificateFactory;
-import java.security.cert.X509Certificate;
-import java.sql.SQLException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.List;
-import java.util.StringTokenizer;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import jakarta.servlet.http.HttpSession;
-import org.apache.commons.lang3.ArrayUtils;
-import org.apache.logging.log4j.Logger;
-import org.dspace.authenticate.factory.AuthenticateServiceFactory;
-import org.dspace.authenticate.service.AuthenticationService;
-import org.dspace.authorize.AuthorizeException;
-import org.dspace.core.Context;
-import org.dspace.core.LogHelper;
-import org.dspace.eperson.EPerson;
-import org.dspace.eperson.Group;
-import org.dspace.eperson.factory.EPersonServiceFactory;
-import org.dspace.eperson.service.EPersonService;
-import org.dspace.eperson.service.GroupService;
-import org.dspace.services.ConfigurationService;
-import org.dspace.services.factory.DSpaceServicesFactory;
-
-/**
- * Implicit authentication method that gets credentials from the X.509 client
- * certificate supplied by the HTTPS client when connecting to this server. The
- * email address in that certificate is taken as the authenticated user name
- * with no further checking, so be sure your HTTP server (e.g. Tomcat) is
- * configured correctly to accept only client certificates it can validate.
- *
- * See the AuthenticationMethod interface for more details.
- *
- * Configuration:
- *
- *
- * x509.keystore.path =
- *
- * path to Java keystore file
- *
- * keystore.password =
- *
- * password to access the keystore
- *
- * ca.cert =
- *
- * path to certificate file for CA whose client certs to accept.
- *
- * autoregister =
- *
- * "true" if E-Person is created automatically for unknown new users.
- *
- * groups =
- *
- * comma-delimited list of special groups to add user to if authenticated.
- *
- * emaildomain =
- *
- * email address domain (after the 'at' symbol) to match before allowing
- * membership in special groups.
- *
- *
- *
- * Only one of the "keystore.path" or "ca.cert"
- * options is required. If you supply a keystore, then all of the "trusted"
- * certificates in the keystore represent CAs whose client certificates will be
- * accepted. The ca.cert option only allows a single CA to be
- * named.
- *
- * You can configure both a keystore and a CA cert, and both will be
- * used.
- *
- * The autoregister configuration parameter determines what the
- * canSelfRegister() method returns. It also allows an EPerson
- * record to be created automatically when the presented certificate is
- * acceptable but there is no corresponding EPerson.
- *
- * @author Larry Stone
- * @version $Revision$
- */
-public class X509Authentication implements AuthenticationMethod {
-
- /**
- * log4j category
- */
- private static Logger log = org.apache.logging.log4j.LogManager.getLogger(X509Authentication.class);
-
- /**
- * public key of CA to check client certs against.
- */
- private static PublicKey caPublicKey = null;
-
- /**
- * key store for CA certs if we use that
- */
- private static KeyStore caCertKeyStore = null;
-
- private static String loginPageTitle = null;
-
- private static String loginPageURL = null;
-
- protected AuthenticationService authenticationService = AuthenticateServiceFactory.getInstance()
- .getAuthenticationService();
- protected EPersonService ePersonService = EPersonServiceFactory.getInstance().getEPersonService();
- protected GroupService groupService = EPersonServiceFactory.getInstance().getGroupService();
- protected ConfigurationService configurationService =
- DSpaceServicesFactory.getInstance().getConfigurationService();
-
- private static final String X509_AUTHENTICATED = "x509.authenticated";
-
-
- /**
- * Initialization: Set caPublicKey and/or keystore. This loads the
- * information needed to check if a client cert presented is valid and
- * acceptable.
- */
- static {
- ConfigurationService configurationService =
- DSpaceServicesFactory.getInstance().getConfigurationService();
- /*
- * allow identification of alternative entry points for certificate
- * authentication when selected by the user rather than implicitly.
- */
- loginPageTitle = configurationService
- .getProperty("authentication-x509.chooser.title.key");
- loginPageURL = configurationService
- .getProperty("authentication-x509.chooser.uri");
-
- String keystorePath = configurationService
- .getProperty("authentication-x509.keystore.path");
- String keystorePassword = configurationService
- .getProperty("authentication-x509.keystore.password");
- String caCertPath = configurationService
- .getProperty("authentication-x509.ca.cert");
-
- // First look for keystore full of trusted certs.
- if (keystorePath != null) {
- FileInputStream fis = null;
- if (keystorePassword == null) {
- keystorePassword = "";
- }
- try {
- KeyStore ks = KeyStore.getInstance("JKS");
- fis = new FileInputStream(keystorePath);
- ks.load(fis, keystorePassword.toCharArray());
- caCertKeyStore = ks;
- } catch (IOException e) {
- log
- .error("X509Authentication: Failed to load CA keystore, file="
- + keystorePath + ", error=" + e.toString());
- } catch (GeneralSecurityException e) {
- log
- .error("X509Authentication: Failed to extract CA keystore, file="
- + keystorePath + ", error=" + e.toString());
- } finally {
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException ioe) {
- // ignore
- }
- }
- }
- }
-
- // Second, try getting public key out of CA cert, if that's configured.
- if (caCertPath != null) {
- InputStream is = null;
- FileInputStream fis = null;
- try {
- fis = new FileInputStream(caCertPath);
- is = new BufferedInputStream(fis);
- X509Certificate cert = (X509Certificate) CertificateFactory
- .getInstance("X.509").generateCertificate(is);
- if (cert != null) {
- caPublicKey = cert.getPublicKey();
- }
- } catch (IOException e) {
- log.error("X509Authentication: Failed to load CA cert, file="
- + caCertPath + ", error=" + e.toString());
- } catch (CertificateException e) {
- log
- .error("X509Authentication: Failed to extract CA cert, file="
- + caCertPath + ", error=" + e.toString());
- } finally {
- if (is != null) {
- try {
- is.close();
- } catch (IOException ioe) {
- // ignore
- }
- }
-
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException ioe) {
- // ignore
- }
- }
- }
- }
- }
-
- /**
- * Return the email address from certificate, or null if an
- * email address cannot be found in the certificate.
- *
- * Note that the certificate parsing has only been tested with certificates
- * granted by the MIT Certification Authority, and may not work elsewhere.
- *
- * @param certificate -
- * An X509 certificate object
- * @return - The email address found in certificate, or null if an email
- * address cannot be found in the certificate.
- */
- private static String getEmail(X509Certificate certificate)
- throws SQLException {
- Principal principal = certificate.getSubjectDN();
-
- if (principal == null) {
- return null;
- }
-
- String dn = principal.getName();
- if (dn == null) {
- return null;
- }
-
- StringTokenizer tokenizer = new StringTokenizer(dn, ",");
- String token = null;
- while (tokenizer.hasMoreTokens()) {
- int len = "emailaddress=".length();
-
- token = (String) tokenizer.nextToken();
-
- if (token.toLowerCase().startsWith("emailaddress=")) {
- // Make sure the token actually contains something
- if (token.length() <= len) {
- return null;
- }
-
- return token.substring(len).toLowerCase();
- }
- }
-
- return null;
- }
-
- /**
- * Verify CERTIFICATE against KEY. Return true if and only if CERTIFICATE is
- * valid and can be verified against KEY.
- *
- * @param context The current DSpace context
- * @param certificate -
- * An X509 certificate object
- * @return - True if CERTIFICATE is valid and can be verified against KEY,
- * false otherwise.
- */
- private static boolean isValid(Context context, X509Certificate certificate) {
- if (certificate == null) {
- return false;
- }
-
- // This checks that current time is within cert's validity window:
- try {
- certificate.checkValidity();
- } catch (CertificateException e) {
- log.info(LogHelper.getHeader(context, "authentication",
- "X.509 Certificate is EXPIRED or PREMATURE: "
- + e.toString()));
- return false;
- }
-
- // Try CA public key, if available.
- if (caPublicKey != null) {
- try {
- certificate.verify(caPublicKey);
- return true;
- } catch (GeneralSecurityException e) {
- log.info(LogHelper.getHeader(context, "authentication",
- "X.509 Certificate FAILED SIGNATURE check: "
- + e.toString()));
- }
- }
-
- // Try it with keystore, if available.
- if (caCertKeyStore != null) {
- try {
- Enumeration ke = caCertKeyStore.aliases();
-
- while (ke.hasMoreElements()) {
- String alias = (String) ke.nextElement();
- if (caCertKeyStore.isCertificateEntry(alias)) {
- Certificate ca = caCertKeyStore.getCertificate(alias);
- try {
- certificate.verify(ca.getPublicKey());
- return true;
- } catch (CertificateException ce) {
- // ignore
- }
- }
- }
- log
- .info(LogHelper
- .getHeader(context, "authentication",
- "Keystore method FAILED SIGNATURE check on client cert."));
- } catch (GeneralSecurityException e) {
- log.info(LogHelper.getHeader(context, "authentication",
- "X.509 Certificate FAILED SIGNATURE check: "
- + e.toString()));
- }
-
- }
- return false;
- }
-
- /**
- * Predicate, can new user automatically create EPerson. Checks
- * configuration value. You'll probably want this to be true to take
- * advantage of a Web certificate infrastructure with many more users than
- * are already known by DSpace.
- *
- * @throws SQLException if database error
- */
- @Override
- public boolean canSelfRegister(Context context, HttpServletRequest request,
- String username) throws SQLException {
- return configurationService
- .getBooleanProperty("authentication-x509.autoregister");
- }
-
- /**
- * Nothing extra to initialize.
- *
- * @throws SQLException if database error
- */
- @Override
- public void initEPerson(Context context, HttpServletRequest request,
- EPerson eperson) throws SQLException {
- }
-
- /**
- * We don't use EPerson password so there is no reason to change it.
- *
- * @throws SQLException if database error
- */
- @Override
- public boolean allowSetPassword(Context context,
- HttpServletRequest request, String username) throws SQLException {
- return false;
- }
-
- /**
- * Returns true, this is an implicit method.
- */
- @Override
- public boolean isImplicit() {
- return true;
- }
-
- /**
- * Returns a list of group names that the user should be added to upon
- * successful authentication, configured in dspace.cfg.
- *
- * @return List of special groups configured for this authenticator
- */
- private List getX509Groups() {
- List groupNames = new ArrayList();
-
- String[] groups = configurationService
- .getArrayProperty("authentication-x509.groups");
-
- if (ArrayUtils.isNotEmpty(groups)) {
- for (String group : groups) {
- groupNames.add(group.trim());
- }
- }
-
- return groupNames;
- }
-
- /**
- * Checks for configured email domain required to grant special groups
- * membership. If no email domain is configured to verify, special group
- * membership is simply granted.
- *
- * @param request -
- * The current request object
- * @param email -
- * The email address from the x509 certificate
- */
- private void setSpecialGroupsFlag(HttpServletRequest request, String email) {
- String emailDomain = null;
- emailDomain = (String) request
- .getAttribute("authentication.x509.emaildomain");
-
- HttpSession session = request.getSession(true);
-
- if (null != emailDomain && !"".equals(emailDomain)) {
- if (email.substring(email.length() - emailDomain.length()).equals(
- emailDomain)) {
- session.setAttribute("x509Auth", Boolean.TRUE);
- }
- } else {
- // No configured email domain to verify. Just flag
- // as authenticated so special groups are granted.
- session.setAttribute("x509Auth", Boolean.TRUE);
- }
- }
-
- /**
- * Return special groups configured in dspace.cfg for X509 certificate
- * authentication.
- *
- * @param context context
- * @param request object potentially containing the cert
- * @return An int array of group IDs
- * @throws SQLException if database error
- */
- @Override
- public List getSpecialGroups(Context context, HttpServletRequest request)
- throws SQLException {
- if (request == null) {
- return Collections.EMPTY_LIST;
- }
-
- Boolean authenticated = false;
- HttpSession session = request.getSession(false);
- authenticated = (Boolean) session.getAttribute("x509Auth");
- authenticated = (null == authenticated) ? false : authenticated;
-
- if (authenticated) {
- List groupNames = getX509Groups();
- List groups = new ArrayList<>();
-
- if (groupNames != null) {
- for (String groupName : groupNames) {
- if (groupName != null) {
- Group group = groupService.findByName(context, groupName);
- if (group != null) {
- groups.add(group);
- } else {
- log.warn(LogHelper.getHeader(context,
- "configuration_error", "unknown_group="
- + groupName));
- }
- }
- }
- }
-
- return groups;
- }
-
- return Collections.EMPTY_LIST;
- }
-
- /**
- * X509 certificate authentication. The client certificate is obtained from
- * the ServletRequest object.
- *
- * - If the certificate is valid, and corresponds to an existing EPerson,
- * and the user is allowed to login, return success.
- * - If the user is matched but is not allowed to login, it fails.
- * - If the certificate is valid, but there is no corresponding EPerson,
- * the
"authentication.x509.autoregister" configuration
- * parameter is checked (via canSelfRegister())
- *
- * - If it's true, a new EPerson record is created for the certificate,
- * and the result is success.
- * - If it's false, return that the user was unknown.
- *
- *
- *
- *
- * @return One of: SUCCESS, BAD_CREDENTIALS, NO_SUCH_USER, BAD_ARGS
- * @throws SQLException if database error
- */
- @Override
- public int authenticate(Context context, String username, String password,
- String realm, HttpServletRequest request) throws SQLException {
- // Obtain the certificate from the request, if any
- X509Certificate[] certs = null;
- if (request != null) {
- certs = (X509Certificate[]) request
- .getAttribute("jakarta.servlet.request.X509Certificate");
- }
-
- if ((certs == null) || (certs.length == 0)) {
- return BAD_ARGS;
- } else {
- // We have a cert -- check it and get username from it.
- try {
- if (!isValid(context, certs[0])) {
- log
- .warn(LogHelper
- .getHeader(context, "authenticate",
- "type=x509certificate, status=BAD_CREDENTIALS (not valid)"));
- return BAD_CREDENTIALS;
- }
-
- // And it's valid - try and get an e-person
- String email = getEmail(certs[0]);
- EPerson eperson = null;
- if (email != null) {
- eperson = ePersonService.findByEmail(context, email);
- }
- if (eperson == null) {
- // Cert is valid, but no record.
- if (email != null
- && canSelfRegister(context, request, null)) {
- // Register the new user automatically
- log.info(LogHelper.getHeader(context, "autoregister",
- "from=x.509, email=" + email));
-
- // TEMPORARILY turn off authorisation
- context.turnOffAuthorisationSystem();
- eperson = ePersonService.create(context);
- eperson.setEmail(email);
- eperson.setCanLogIn(true);
- authenticationService.initEPerson(context, request,
- eperson);
- ePersonService.update(context, eperson);
- context.dispatchEvents();
- context.restoreAuthSystemState();
- context.setCurrentUser(eperson);
- request.setAttribute(X509_AUTHENTICATED, true);
- setSpecialGroupsFlag(request, email);
- return SUCCESS;
- } else {
- // No auto-registration for valid certs
- log
- .warn(LogHelper
- .getHeader(context, "authenticate",
- "type=cert_but_no_record, cannot auto-register"));
- return NO_SUCH_USER;
- }
- } else if (!eperson.canLogIn()) { // make sure this is a login account
- log.warn(LogHelper.getHeader(context, "authenticate",
- "type=x509certificate, email=" + email
- + ", canLogIn=false, rejecting."));
- return BAD_ARGS;
- } else {
- log.info(LogHelper.getHeader(context, "login",
- "type=x509certificate"));
- context.setCurrentUser(eperson);
- request.setAttribute(X509_AUTHENTICATED, true);
- setSpecialGroupsFlag(request, email);
- return SUCCESS;
- }
- } catch (AuthorizeException ce) {
- log.warn(LogHelper.getHeader(context, "authorize_exception",
- ""), ce);
- }
-
- return BAD_ARGS;
- }
- }
-
- /**
- * Returns URL of password-login servlet.
- *
- * @param context DSpace context, will be modified (EPerson set) upon success.
- * @param request The HTTP request that started this operation, or null if not
- * applicable.
- * @param response The HTTP response from the servlet method.
- * @return fully-qualified URL
- */
- @Override
- public String loginPageURL(Context context, HttpServletRequest request,
- HttpServletResponse response) {
- return loginPageURL;
- }
-
- @Override
- public String getName() {
- return "x509";
- }
-
- @Override
- public boolean isUsed(final Context context, final HttpServletRequest request) {
- if (request != null &&
- context.getCurrentUser() != null &&
- request.getAttribute(X509_AUTHENTICATED) != null) {
- return true;
- }
- return false;
- }
-
- @Override
- public boolean canChangePassword(Context context, EPerson ePerson, String currentPassword) {
- return false;
- }
-}
diff --git a/dspace-api/src/main/java/org/dspace/authenticate/service/AuthenticationService.java b/dspace-api/src/main/java/org/dspace/authenticate/service/AuthenticationService.java
index 45ad8932daec..8409f1e27d05 100644
--- a/dspace-api/src/main/java/org/dspace/authenticate/service/AuthenticationService.java
+++ b/dspace-api/src/main/java/org/dspace/authenticate/service/AuthenticationService.java
@@ -29,11 +29,11 @@
* Configuration
* The stack of authentication methods is defined by one property in the DSpace configuration:
*
- * plugin.sequence.org.dspace.eperson.AuthenticationMethod = a list of method class names
+ * plugin.sequence.org.dspace.authenticate.AuthenticationMethod = a list of method class names
* e.g.
- * plugin.sequence.org.dspace.eperson.AuthenticationMethod = \
- * org.dspace.eperson.X509Authentication, \
- * org.dspace.eperson.PasswordAuthentication
+ * plugin.sequence.org.dspace.authenticate.AuthenticationMethod = \
+ * org.dspace.authenticate.IPAuthentication, \
+ * org.dspace.authenticate.PasswordAuthentication
*
*
* The "stack" is always traversed in order, with the methods
@@ -64,7 +64,7 @@ public interface AuthenticationService {
*
Meaning:
*
SUCCESS - authenticated OK.
*
BAD_CREDENTIALS - user exists, but credentials (e.g. password) don't match
- *
CERT_REQUIRED - not allowed to login this way without X.509 cert.
+ *
CERT_REQUIRED - not allowed to login this way without a cert.
*
NO_SUCH_USER - user not found using this method.
*
BAD_ARGS - user/password not appropriate for this method
*/
@@ -91,7 +91,7 @@ public int authenticate(Context context,
*
Meaning:
*
SUCCESS - authenticated OK.
*
BAD_CREDENTIALS - user exists, but credentials (e.g. password) don't match
- *
CERT_REQUIRED - not allowed to login this way without X.509 cert.
+ *
CERT_REQUIRED - not allowed to login this way without a cert.
*
NO_SUCH_USER - user not found using this method.
*
BAD_ARGS - user/password not appropriate for this method
*/
diff --git a/dspace-api/src/main/java/org/dspace/authority/orcid/Orcidv3SolrAuthorityImpl.java b/dspace-api/src/main/java/org/dspace/authority/orcid/Orcidv3SolrAuthorityImpl.java
index 494daa97734a..312a00c146af 100644
--- a/dspace-api/src/main/java/org/dspace/authority/orcid/Orcidv3SolrAuthorityImpl.java
+++ b/dspace-api/src/main/java/org/dspace/authority/orcid/Orcidv3SolrAuthorityImpl.java
@@ -10,6 +10,7 @@
import java.io.IOException;
import java.io.InputStream;
import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Collections;
import java.util.LinkedList;
@@ -20,6 +21,7 @@
import org.apache.logging.log4j.Logger;
import org.dspace.authority.AuthorityValue;
import org.dspace.authority.SolrAuthorityInterface;
+import org.dspace.external.OrcidConnectionException;
import org.dspace.external.OrcidRestConnector;
import org.dspace.external.provider.orcid.xml.XMLtoBio;
import org.dspace.orcid.model.factory.OrcidFactoryUtils;
@@ -142,9 +144,15 @@ public Person getBio(String id) {
return null;
}
initializeAccessToken();
- InputStream bioDocument = orcidRestConnector.get(id + ((id.endsWith("/person")) ? "" : "/person"), accessToken);
- XMLtoBio converter = new XMLtoBio();
- return converter.convertSinglePerson(bioDocument);
+ try {
+ InputStream bioDocument = orcidRestConnector.get(id + ((id.endsWith("/person")) ? "" : "/person"),
+ accessToken);
+ XMLtoBio converter = new XMLtoBio();
+ return converter.convertSinglePerson(bioDocument);
+ } catch (OrcidConnectionException e) {
+ log.error("Error retrieving ORCID bio for ID=" + id, e);
+ return null;
+ }
}
@@ -167,29 +175,35 @@ public List queryBio(String text, int start, int rows) {
// Check / init access token
initializeAccessToken();
- String searchPath = "search?q=" + URLEncoder.encode(text) + "&start=" + start + "&rows=" + rows;
+ String searchPath = "search?q=" + URLEncoder.encode(text, StandardCharsets.UTF_8) + "&start=" + start +
+ "&rows=" + rows;
log.debug("queryBio searchPath=" + searchPath + " accessToken=" + accessToken);
- InputStream bioDocument = orcidRestConnector.get(searchPath, accessToken);
- XMLtoBio converter = new XMLtoBio();
- List results = converter.convert(bioDocument);
- List bios = new LinkedList<>();
- for (Result result : results) {
- OrcidIdentifier orcidIdentifier = result.getOrcidIdentifier();
- if (orcidIdentifier != null) {
- log.debug("Found OrcidId=" + orcidIdentifier.toString());
- String orcid = orcidIdentifier.getPath();
- Person bio = getBio(orcid);
- if (bio != null) {
- bios.add(bio);
+ try {
+ InputStream bioDocument = orcidRestConnector.get(searchPath, accessToken);
+ XMLtoBio converter = new XMLtoBio();
+ List results = converter.convert(bioDocument);
+ List bios = new LinkedList<>();
+ for (Result result : results) {
+ OrcidIdentifier orcidIdentifier = result.getOrcidIdentifier();
+ if (orcidIdentifier != null) {
+ log.debug("Found OrcidId=" + orcidIdentifier);
+ String orcid = orcidIdentifier.getPath();
+ Person bio = getBio(orcid);
+ if (bio != null) {
+ bios.add(bio);
+ }
}
}
+ try {
+ bioDocument.close();
+ } catch (IOException e) {
+ log.error(e.getMessage(), e);
+ }
+ return bios;
+ } catch (OrcidConnectionException e) {
+ log.error("Error searching ORCID for query=" + text, e);
+ return Collections.emptyList();
}
- try {
- bioDocument.close();
- } catch (IOException e) {
- log.error(e.getMessage(), e);
- }
- return bios;
}
/**
diff --git a/dspace-api/src/main/java/org/dspace/authorize/AuthorizeServiceImpl.java b/dspace-api/src/main/java/org/dspace/authorize/AuthorizeServiceImpl.java
index f2692cf394fc..bb94198f7961 100644
--- a/dspace-api/src/main/java/org/dspace/authorize/AuthorizeServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/authorize/AuthorizeServiceImpl.java
@@ -16,6 +16,7 @@
import java.util.Arrays;
import java.util.Date;
import java.util.List;
+import java.util.Objects;
import java.util.UUID;
import org.apache.commons.collections4.CollectionUtils;
@@ -48,6 +49,7 @@
import org.dspace.eperson.EPerson;
import org.dspace.eperson.Group;
import org.dspace.eperson.service.GroupService;
+import org.dspace.services.ConfigurationService;
import org.dspace.workflow.WorkflowItemService;
import org.springframework.beans.factory.annotation.Autowired;
@@ -84,6 +86,8 @@ public class AuthorizeServiceImpl implements AuthorizeService {
protected WorkflowItemService workflowItemService;
@Autowired(required = true)
private SearchService searchService;
+ @Autowired(required = true)
+ private ConfigurationService configurationService;
protected AuthorizeServiceImpl() {
@@ -508,17 +512,26 @@ public List getPoliciesActionFilter(Context c, DSpaceObject o,
return resourcePolicyService.find(c, o, actionID);
}
+ @Override
+ public void inheritPolicies(Context c, DSpaceObject src, DSpaceObject dest)
+ throws SQLException, AuthorizeException {
+ inheritPolicies(c, src, dest, false);
+ }
+
@Override
public void inheritPolicies(Context c, DSpaceObject src,
- DSpaceObject dest) throws SQLException, AuthorizeException {
+ DSpaceObject dest, boolean includeCustom) throws SQLException, AuthorizeException {
// find all policies for the source object
List policies = getPolicies(c, src);
- //Only inherit non-ADMIN policies (since ADMIN policies are automatically inherited)
- //and non-custom policies as these are manually applied when appropriate
+ // Only inherit non-ADMIN policies (since ADMIN policies are automatically inherited)
+ // and non-custom policies (usually applied manually?) UNLESS specified otherwise with includCustom
+ // (for example, item.addBundle() will inherit custom policies to enforce access conditions)
List nonAdminPolicies = new ArrayList<>();
for (ResourcePolicy rp : policies) {
- if (rp.getAction() != Constants.ADMIN && !StringUtils.equals(rp.getRpType(), ResourcePolicy.TYPE_CUSTOM)) {
+ if (rp.getAction() != Constants.ADMIN && (!StringUtils.equals(rp.getRpType(), ResourcePolicy.TYPE_CUSTOM)
+ || (includeCustom && StringUtils.equals(rp.getRpType(), ResourcePolicy.TYPE_CUSTOM)
+ && isNotAlreadyACustomRPOfThisTypeOnDSO(c, dest)))) {
nonAdminPolicies.add(rp);
}
}
@@ -729,15 +742,15 @@ public List getPoliciesActionFilterExceptRpType(Context c, DSpac
/**
* Checks that the context's current user is a community admin in the site by querying the solr database.
+ * This query doesn't use authorization inheritance because direct community admin is enough to perform this check.
*
* @param context context with the current user
* @return true if the current user is a community admin in the site
* false when this is not the case, or an exception occurred
- * @throws java.sql.SQLException passed through.
*/
@Override
- public boolean isCommunityAdmin(Context context) throws SQLException {
- return performCheck(context, RESOURCE_TYPE_FIELD + ":" + IndexableCommunity.TYPE);
+ public boolean isCommunityAdmin(Context context) {
+ return performCheck(context, RESOURCE_TYPE_FIELD + ":" + IndexableCommunity.TYPE, false);
}
/**
@@ -746,11 +759,10 @@ public boolean isCommunityAdmin(Context context) throws SQLException {
* @param context context with the current user
* @return true if the current user is a collection admin in the site
* false when this is not the case, or an exception occurred
- * @throws java.sql.SQLException passed through.
*/
@Override
- public boolean isCollectionAdmin(Context context) throws SQLException {
- return performCheck(context, RESOURCE_TYPE_FIELD + ":" + IndexableCollection.TYPE);
+ public boolean isCollectionAdmin(Context context) {
+ return performCheck(context, RESOURCE_TYPE_FIELD + ":" + IndexableCollection.TYPE, true);
}
/**
@@ -759,26 +771,26 @@ public boolean isCollectionAdmin(Context context) throws SQLException {
* @param context context with the current user
* @return true if the current user is an item admin in the site
* false when this is not the case, or an exception occurred
- * @throws java.sql.SQLException passed through.
*/
@Override
- public boolean isItemAdmin(Context context) throws SQLException {
- return performCheck(context, RESOURCE_TYPE_FIELD + ":" + IndexableItem.TYPE);
+ public boolean isItemAdmin(Context context) {
+ return performCheck(context, RESOURCE_TYPE_FIELD + ":" + IndexableItem.TYPE, true);
}
/**
* Checks that the context's current user is a community or collection admin in the site.
+ * This query doesn't use authorization inheritance because direct community/collection admin is enough to
+ * perform this check.
*
* @param context context with the current user
* @return true if the current user is a community or collection admin in the site
* false when this is not the case, or an exception occurred
- * @throws java.sql.SQLException passed through.
*/
@Override
- public boolean isComColAdmin(Context context) throws SQLException {
+ public boolean isComColAdmin(Context context) {
return performCheck(context,
"(" + RESOURCE_TYPE_FIELD + ":" + IndexableCommunity.TYPE + " OR " +
- RESOURCE_TYPE_FIELD + ":" + IndexableCollection.TYPE + ")");
+ RESOURCE_TYPE_FIELD + ":" + IndexableCollection.TYPE + ")", false);
}
/**
@@ -793,11 +805,30 @@ public boolean isComColAdmin(Context context) throws SQLException {
*/
@Override
public List findAdminAuthorizedCommunity(Context context, String query, int offset, int limit)
- throws SearchServiceException, SQLException {
+ throws SearchServiceException {
+ return findAuthorizedCommunityByAction(context, query, Constants.ADMIN, offset, limit);
+ }
+
+ /**
+ * Finds communities for which the logged in user has the rights specified by the action parameter.
+ *
+ * @param context the context whose user is checked against
+ * @param query the optional extra query
+ * @param action the action to check for
+ * @param offset the offset for pagination
+ * @param limit the amount of dso's to return
+ * @return a list of communities for which the logged in user has the rights specified by the action
+ * @throws SearchServiceException
+ */
+ @Override
+ public List findAuthorizedCommunityByAction(Context context, String query, int action, int offset,
+ int limit)
+ throws SearchServiceException {
List communities = new ArrayList<>();
+ query = searchService.formatAutoCompleteQuery(query, "dc.title_sort");
query = formatCustomQuery(query);
DiscoverResult discoverResult = getDiscoverResult(context, query + RESOURCE_TYPE_FIELD + ":" +
- IndexableCommunity.TYPE,
+ IndexableCommunity.TYPE, action, true,
offset, limit, null, null);
for (IndexableObject solrCollections : discoverResult.getIndexableObjects()) {
Community community = ((IndexableCommunity) solrCollections).getIndexedObject();
@@ -816,10 +847,26 @@ public List findAdminAuthorizedCommunity(Context context, String quer
*/
@Override
public long countAdminAuthorizedCommunity(Context context, String query)
- throws SearchServiceException, SQLException {
+ throws SearchServiceException {
+ return countAuthorizedCommunityByAction(context, query, Constants.ADMIN);
+ }
+
+ /**
+ * Counts communities for which the current user has the rights specified by the action parameter.
+ *
+ * @param context context with the current user
+ * @param query the query for which to filter the results more
+ * @param action the action to check for
+ * @return the matching communities
+ * @throws SearchServiceException
+ */
+ @Override
+ public long countAuthorizedCommunityByAction(Context context, String query, int action)
+ throws SearchServiceException {
+ query = searchService.formatAutoCompleteQuery(query, "dc.title_sort");
query = formatCustomQuery(query);
DiscoverResult discoverResult = getDiscoverResult(context, query + RESOURCE_TYPE_FIELD + ":" +
- IndexableCommunity.TYPE,
+ IndexableCommunity.TYPE, action, true,
null, 0, null, null);
return discoverResult.getTotalSearchResults();
}
@@ -836,15 +883,34 @@ public long countAdminAuthorizedCommunity(Context context, String query)
*/
@Override
public List findAdminAuthorizedCollection(Context context, String query, int offset, int limit)
- throws SearchServiceException, SQLException {
+ throws SearchServiceException {
+ return findAuthorizedCollectionByAction(context, query, Constants.ADMIN, offset, limit);
+ }
+
+ /**
+ * Finds collections for which the logged in user has the rights specified by the action parameter.
+ *
+ * @param context the context whose user is checked against
+ * @param query the optional extra query
+ * @param action the action to check for
+ * @param offset the offset for pagination
+ * @param limit the amount of dso's to return
+ * @return a list of collections for which the logged in user has the rights specified by the action
+ * @throws SearchServiceException
+ */
+ @Override
+ public List findAuthorizedCollectionByAction(Context context, String query,
+ int action, int offset, int limit)
+ throws SearchServiceException {
List collections = new ArrayList<>();
if (context.getCurrentUser() == null) {
return collections;
}
+ query = searchService.formatAutoCompleteQuery(query, "dc.title_sort");
query = formatCustomQuery(query);
DiscoverResult discoverResult = getDiscoverResult(context, query + RESOURCE_TYPE_FIELD + ":" +
- IndexableCollection.TYPE,
+ IndexableCollection.TYPE, action, true,
offset, limit, CollectionService.SOLR_SORT_FIELD, SORT_ORDER.asc);
for (IndexableObject solrCollections : discoverResult.getIndexableObjects()) {
Collection collection = ((IndexableCollection) solrCollections).getIndexedObject();
@@ -863,31 +929,44 @@ public List findAdminAuthorizedCollection(Context context, String qu
*/
@Override
public long countAdminAuthorizedCollection(Context context, String query)
- throws SearchServiceException, SQLException {
+ throws SearchServiceException {
+ return countAuthorizedCollectionByAction(context, query, Constants.ADMIN);
+ }
+
+ /**
+ * Counts collections for which the current user has the rights specified by the action parameter.
+ *
+ * @param context context with the current user
+ * @param query the query for which to filter the results more
+ * @param action the action to check for
+ * @return the matching collections
+ * @throws SearchServiceException
+ */
+ @Override
+ public long countAuthorizedCollectionByAction(Context context, String query, int action)
+ throws SearchServiceException {
+ query = searchService.formatAutoCompleteQuery(query, "dc.title_sort");
query = formatCustomQuery(query);
DiscoverResult discoverResult = getDiscoverResult(context, query + RESOURCE_TYPE_FIELD + ":" +
- IndexableCollection.TYPE,
- null, 0, null, null);
+ IndexableCollection.TYPE, action,
+ true, null, 0, null, null);
return discoverResult.getTotalSearchResults();
}
@Override
public boolean isAccountManager(Context context) {
- try {
- return (canCommunityAdminManageAccounts() && isCommunityAdmin(context)
- || canCollectionAdminManageAccounts() && isCollectionAdmin(context));
- } catch (SQLException e) {
- throw new RuntimeException(e);
- }
+ return (canCommunityAdminManageAccounts() && isCommunityAdmin(context)
+ || canCollectionAdminManageAccounts() && isCollectionAdmin(context));
}
- private boolean performCheck(Context context, String query) throws SQLException {
+ private boolean performCheck(Context context, String query, boolean inheritAuthorizations) {
if (context.getCurrentUser() == null) {
return false;
}
try {
- DiscoverResult discoverResult = getDiscoverResult(context, query, null, null, null, null);
+ DiscoverResult discoverResult = getDiscoverResult(context, query, Constants.ADMIN, inheritAuthorizations,
+ null, 0, null, null);
if (discoverResult.getTotalSearchResults() > 0) {
return true;
}
@@ -899,16 +978,11 @@ private boolean performCheck(Context context, String query) throws SQLException
return false;
}
- private DiscoverResult getDiscoverResult(Context context, String query, Integer offset, Integer limit,
- String sortField, SORT_ORDER sortOrder)
- throws SearchServiceException, SQLException {
- String groupQuery = getGroupToQuery(groupService.allMemberGroups(context, context.getCurrentUser()));
+ private DiscoverResult getDiscoverResult(Context context, String query, int action, boolean inheritAuthorizations,
+ Integer offset, Integer limit, String sortField, SORT_ORDER sortOrder)
+ throws SearchServiceException {
DiscoverQuery discoverQuery = new DiscoverQuery();
- if (!this.isAdmin(context)) {
- query = query + " AND (" +
- "admin:e" + context.getCurrentUser().getID() + groupQuery + ")";
- }
discoverQuery.setQuery(query);
if (offset != null) {
discoverQuery.setStart(offset);
@@ -919,28 +993,113 @@ private DiscoverResult getDiscoverResult(Context context, String query, Integer
if (sortField != null && sortOrder != null) {
discoverQuery.setSortField(sortField, sortOrder);
}
+ discoverQuery.addRequiredAuthorization(action);
+ discoverQuery.setInheritAuthorizations(inheritAuthorizations);
return searchService.search(context, discoverQuery);
}
- private String getGroupToQuery(List groups) {
- StringBuilder groupQuery = new StringBuilder();
+ private String formatCustomQuery(String query) {
+ if (StringUtils.isBlank(query)) {
+ return "";
+ } else {
+ return query + " AND ";
+ }
+ }
- if (groups != null) {
- for (Group group: groups) {
- groupQuery.append(" OR admin:g");
- groupQuery.append(group.getID());
+ /**
+ * Add the default policies, which have not been already added to the given DSpace object
+ *
+ * @param context The relevant DSpace Context.
+ * @param dso The DSpace Object to add policies to
+ * @param defaultCollectionPolicies list of policies
+ * @throws SQLException An exception that provides information on a database access error or other errors.
+ * @throws AuthorizeException Exception indicating the current user of the context does not have permission
+ * to perform a particular action.
+ */
+ @Override
+ public void addDefaultPoliciesNotInPlace(Context context, DSpaceObject dso,
+ List defaultCollectionPolicies) throws SQLException, AuthorizeException {
+ boolean appendMode = configurationService
+ .getBooleanProperty("core.authorization.installitem.inheritance-read.append-mode", false);
+ for (ResourcePolicy defaultPolicy : defaultCollectionPolicies) {
+ if (!isAnIdenticalPolicyAlreadyInPlace(context, dso, defaultPolicy.getGroup(), Constants.READ,
+ defaultPolicy.getID()) &&
+ (!appendMode && isNotAlreadyACustomRPOfThisTypeOnDSO(context, dso) ||
+ appendMode && shouldBeAppended(context, dso, defaultPolicy))) {
+ ResourcePolicy newPolicy = resourcePolicyService.clone(context, defaultPolicy);
+ newPolicy.setdSpaceObject(dso);
+ newPolicy.setAction(Constants.READ);
+ newPolicy.setRpType(ResourcePolicy.TYPE_INHERITED);
+ resourcePolicyService.update(context, newPolicy);
}
}
+ }
- return groupQuery.toString();
+ /**
+ * Add a list of custom policies if there are already NO custom policies in place
+ *
+ */
+ @Override
+ public void addCustomPoliciesNotInPlace(Context context, DSpaceObject dso, List customPolicies)
+ throws SQLException, AuthorizeException {
+ boolean customPoliciesAlreadyInPlace =
+ findPoliciesByDSOAndType(context, dso, ResourcePolicy.TYPE_CUSTOM).size() > 0;
+ if (!customPoliciesAlreadyInPlace) {
+ addPolicies(context, customPolicies, dso);
+ }
}
- private String formatCustomQuery(String query) {
- if (StringUtils.isBlank(query)) {
- return "";
- } else {
- return query + " AND ";
+ /**
+ * Check whether or not there is already an RP on the given dso, which has actionId={@link Constants.READ} and
+ * resourceTypeId={@link ResourcePolicy.TYPE_CUSTOM}
+ *
+ * @param context DSpace context
+ * @param dso DSpace object to check for custom read RP
+ * @return True if there is no RP on the item with custom read RP, otherwise false
+ * @throws SQLException If something goes wrong retrieving the RP on the DSO
+ */
+ private boolean isNotAlreadyACustomRPOfThisTypeOnDSO(Context context, DSpaceObject dso) throws SQLException {
+ return isNotAlreadyACustomRPOfThisTypeOnDSO(context, dso, Constants.READ);
+ }
+
+ private boolean isNotAlreadyACustomRPOfThisTypeOnDSO(Context context, DSpaceObject dso, int action)
+ throws SQLException {
+ List rps = resourcePolicyService.find(context, dso, action);
+ for (ResourcePolicy rp : rps) {
+ if (rp.getRpType() != null && rp.getRpType().equals(ResourcePolicy.TYPE_CUSTOM)) {
+ return false;
+ }
}
+ return true;
+ }
+
+ /**
+ * Check if the provided default policy should be appended or not to the final
+ * item. If an item has at least one custom READ policy any anonymous READ
+ * policy with empty start/end date should be skipped
+ *
+ * @param context DSpace context
+ * @param dso DSpace object to check for custom read RP
+ * @param defaultPolicy The policy to check
+ * @return
+ * @throws SQLException If something goes wrong retrieving the RP on the DSO
+ */
+ private boolean shouldBeAppended(Context context, DSpaceObject dso, ResourcePolicy defaultPolicy)
+ throws SQLException {
+ boolean hasCustomPolicy = resourcePolicyService.find(context, dso, Constants.READ)
+ .stream()
+ .filter(rp -> (Objects.nonNull(rp.getRpType()) &&
+ Objects.equals(rp.getRpType(), ResourcePolicy.TYPE_CUSTOM)))
+ .findFirst()
+ .isPresent();
+
+ boolean isAnonymousGroup = Objects.nonNull(defaultPolicy.getGroup())
+ && StringUtils.equals(defaultPolicy.getGroup().getName(), Group.ANONYMOUS);
+
+ boolean datesAreNull = Objects.isNull(defaultPolicy.getStartDate())
+ && Objects.isNull(defaultPolicy.getEndDate());
+
+ return !(hasCustomPolicy && isAnonymousGroup && datesAreNull);
}
}
diff --git a/dspace-api/src/main/java/org/dspace/authorize/dao/impl/ResourcePolicyDAOImpl.java b/dspace-api/src/main/java/org/dspace/authorize/dao/impl/ResourcePolicyDAOImpl.java
index 3b09f9cf300b..1f9e5ea26677 100644
--- a/dspace-api/src/main/java/org/dspace/authorize/dao/impl/ResourcePolicyDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/authorize/dao/impl/ResourcePolicyDAOImpl.java
@@ -182,7 +182,7 @@ public List findByEPersonGroupTypeIdAction(Context context, EPer
compareEpersonOrGroups
)
);
- return list(context, criteriaQuery, false, ResourcePolicy.class, 1, -1);
+ return list(context, criteriaQuery, false, ResourcePolicy.class, -1, -1);
}
@Override
diff --git a/dspace-api/src/main/java/org/dspace/authorize/service/AuthorizeService.java b/dspace-api/src/main/java/org/dspace/authorize/service/AuthorizeService.java
index e0a94833d76c..95e4ec1ee627 100644
--- a/dspace-api/src/main/java/org/dspace/authorize/service/AuthorizeService.java
+++ b/dspace-api/src/main/java/org/dspace/authorize/service/AuthorizeService.java
@@ -322,6 +322,19 @@ public void addPolicy(Context c, DSpaceObject o, int actionID, Group g, String t
*/
public List getPoliciesActionFilterExceptRpType(Context c, DSpaceObject o, int actionID,
String rpType) throws SQLException;
+ /**
+ * Add policies to an object to match those from a previous object
+ *
+ * @param c context
+ * @param src source of policies
+ * @param dest destination of inherited policies
+ * @param includeCustom whether TYPE_CUSTOM policies should be inherited
+ * @throws SQLException if there's a database problem
+ * @throws AuthorizeException if the current user is not authorized to add these policies
+ */
+ public void inheritPolicies(Context c, DSpaceObject src, DSpaceObject dest, boolean includeCustom)
+ throws SQLException, AuthorizeException;
+
/**
* Add policies to an object to match those from a previous object
*
@@ -546,6 +559,20 @@ void switchPoliciesAction(Context context, DSpaceObject dso, int fromAction, int
List findAdminAuthorizedCommunity(Context context, String query, int offset, int limit)
throws SearchServiceException, SQLException;
+ /**
+ * Finds communities for which the logged in user has the rights specified by the action parameter.
+ *
+ * @param context the context whose user is checked against
+ * @param query the optional extra query
+ * @param action the action to check for
+ * @param offset the offset for pagination
+ * @param limit the amount of dso's to return
+ * @return a list of communities for which the logged in user has the rights specified by the action
+ * @throws SearchServiceException
+ */
+ List findAuthorizedCommunityByAction(Context context, String query, int action, int offset, int limit)
+ throws SearchServiceException, SQLException;
+
/**
* Counts communities for which the current user is admin, AND which match the query.
*
@@ -558,6 +585,18 @@ List findAdminAuthorizedCommunity(Context context, String query, int
long countAdminAuthorizedCommunity(Context context, String query)
throws SearchServiceException, SQLException;
+ /**
+ * Counts communities for which the current user has the rights specified by the action parameter.
+ *
+ * @param context context with the current user
+ * @param query the query for which to filter the results more
+ * @param action the action to check for
+ * @return the matching communities
+ * @throws SearchServiceException
+ */
+ long countAuthorizedCommunityByAction(Context context, String query, int action)
+ throws SearchServiceException;
+
/**
* Finds collections for which the current user is admin, AND which match the query.
*
@@ -567,10 +606,24 @@ long countAdminAuthorizedCommunity(Context context, String query)
* @param limit used for pagination of the results
* @return the matching collections
* @throws SearchServiceException
- * @throws SQLException
*/
List findAdminAuthorizedCollection(Context context, String query, int offset, int limit)
- throws SearchServiceException, SQLException;
+ throws SearchServiceException;
+
+ /**
+ * Finds collections for which the current user has the rights specified by the action parameter.
+ *
+ * @param context context with the current user
+ * @param query the query for which to filter the results more
+ * @param action the action to check for
+ * @param offset used for pagination of the results
+ * @param limit used for pagination of the results
+ * @return the matching collections
+ * @throws SearchServiceException
+ */
+ List findAuthorizedCollectionByAction(Context context, String query, int action, int offset,
+ int limit)
+ throws SearchServiceException;
/**
* Counts collections for which the current user is admin, AND which match the query.
@@ -582,7 +635,19 @@ List findAdminAuthorizedCollection(Context context, String query, in
* @throws SQLException
*/
long countAdminAuthorizedCollection(Context context, String query)
- throws SearchServiceException, SQLException;
+ throws SearchServiceException;
+
+ /**
+ * Counts collections for which the current user has the rights specified by the action parameter.
+ *
+ * @param context context with the current user
+ * @param query the query for which to filter the results more
+ * @param action the action to check for
+ * @return the number of matching collections
+ * @throws SearchServiceException
+ */
+ long countAuthorizedCollectionByAction(Context context, String query, int action)
+ throws SearchServiceException;
/**
* Returns true if the current user can manage accounts.
@@ -604,4 +669,10 @@ long countAdminAuthorizedCollection(Context context, String query)
public void replaceAllPolicies(Context context, DSpaceObject source, DSpaceObject dest)
throws SQLException, AuthorizeException;
+ public void addDefaultPoliciesNotInPlace(Context context, DSpaceObject dso,
+ List defaultCollectionPolicies) throws SQLException, AuthorizeException;
+
+ public void addCustomPoliciesNotInPlace(Context context, DSpaceObject dso,
+ List defaultCollectionPolicies) throws SQLException, AuthorizeException;
+
}
diff --git a/dspace-api/src/main/java/org/dspace/browse/BrowseDAO.java b/dspace-api/src/main/java/org/dspace/browse/BrowseDAO.java
index 03130e39e78b..26983303a152 100644
--- a/dspace-api/src/main/java/org/dspace/browse/BrowseDAO.java
+++ b/dspace-api/src/main/java/org/dspace/browse/BrowseDAO.java
@@ -396,4 +396,6 @@ public interface BrowseDAO {
public void setStartsWith(String startsWith);
public String getStartsWith();
+
+ public void setDateStartsWith(String dateStartsWith);
}
diff --git a/dspace-api/src/main/java/org/dspace/browse/BrowseEngine.java b/dspace-api/src/main/java/org/dspace/browse/BrowseEngine.java
index be7a34086a46..f7f5f2ff7df7 100644
--- a/dspace-api/src/main/java/org/dspace/browse/BrowseEngine.java
+++ b/dspace-api/src/main/java/org/dspace/browse/BrowseEngine.java
@@ -203,12 +203,8 @@ private BrowseInfo browseByItem(BrowserScope bs)
// get the table name that we are going to be getting our data from
dao.setTable(browseIndex.getTableName());
- if (scope.getBrowseIndex() != null && OrderFormat.TITLE.equals(scope.getBrowseIndex().getDataType())) {
- // For browsing by title, apply the same normalization applied to indexed titles
- dao.setStartsWith(normalizeJumpToValue(scope.getStartsWith()));
- } else {
- dao.setStartsWith(StringUtils.lowerCase(scope.getStartsWith()));
- }
+ // Set startsWith or dateStartsWith params on SolrBrowseDAO
+ addStartsWithParams(bs);
// tell the browse query whether we are ascending or descending on the value
dao.setAscending(scope.isAscending());
@@ -367,6 +363,30 @@ private BrowseInfo browseByItem(BrowserScope bs)
}
}
+ private void addStartsWithParams(BrowserScope bs) throws BrowseException {
+ if (StringUtils.isNotBlank(scope.getStartsWith())) {
+ boolean isDateBrowse = bs.getSortOption().getType().equals("date");
+ if (!isDateBrowse) {
+ if (scope.getBrowseIndex() != null
+ && OrderFormat.TITLE.equals(scope.getBrowseIndex().getDataType())) {
+ // For browsing by title, apply the same normalization applied to indexed titles
+ dao.setStartsWith(normalizeJumpToValue(scope.getStartsWith()));
+ } else {
+ dao.setStartsWith(StringUtils.lowerCase(scope.getStartsWith()));
+ }
+ // clear the old date starts with
+ dao.setDateStartsWith(null);
+ } else {
+ // For "date" sort browses ({@code webui.itemlist.sort-option.*} config):
+ // sets a date specific filter where the startsWith query is the start date,
+ // eg `fq=bi_sort_*_sort:+["1940-02" TO + ]`
+ dao.setDateStartsWith(scope.getStartsWith().trim());
+ // clear the old non date starts with
+ dao.setStartsWith(null);
+ }
+ }
+ }
+
/**
* Browse the archive by single values (such as the name of an author). This
* produces a BrowseInfo object that contains Strings as the results of
diff --git a/dspace-api/src/main/java/org/dspace/browse/ItemCountDAOSolr.java b/dspace-api/src/main/java/org/dspace/browse/ItemCountDAOSolr.java
index e4d0079fe20b..723b49d63aea 100644
--- a/dspace-api/src/main/java/org/dspace/browse/ItemCountDAOSolr.java
+++ b/dspace-api/src/main/java/org/dspace/browse/ItemCountDAOSolr.java
@@ -7,121 +7,62 @@
*/
package org.dspace.browse;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
+import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
+import org.apache.solr.client.solrj.SolrClient;
+import org.apache.solr.client.solrj.SolrQuery;
+import org.apache.solr.client.solrj.response.QueryResponse;
import org.dspace.content.Collection;
import org.dspace.content.Community;
import org.dspace.content.DSpaceObject;
import org.dspace.core.Context;
-import org.dspace.discovery.DiscoverFacetField;
-import org.dspace.discovery.DiscoverQuery;
-import org.dspace.discovery.DiscoverResult;
-import org.dspace.discovery.DiscoverResult.FacetResult;
-import org.dspace.discovery.SearchService;
-import org.dspace.discovery.SearchServiceException;
-import org.dspace.discovery.configuration.DiscoveryConfigurationParameters;
+import org.dspace.discovery.SolrSearchCore;
import org.dspace.discovery.indexobject.IndexableItem;
import org.springframework.beans.factory.annotation.Autowired;
/**
* Discovery (Solr) driver implementing ItemCountDAO interface to look up item
- * count information in communities and collections. Caching operations are
- * intentionally not implemented because Solr already is our cache.
+ * count information in communities and collections.
+ *
+ * Counts are computed by querying Solr for archived, non-withdrawn, discoverable
+ * items using {@code location.comm} / {@code location.coll} filters.
+ * The query returns only {@code numFound} (rows=0), making it very fast.
*/
public class ItemCountDAOSolr implements ItemCountDAO {
- /**
- * Log4j logger
- */
- private static Logger log = org.apache.logging.log4j.LogManager.getLogger(ItemCountDAOSolr.class);
-
- /**
- * Hold the communities item count obtained from SOLR after the first query. This only works
- * well if the ItemCountDAO lifecycle is bound to the request lifecycle as
- * it is now. If we switch to a Spring-based instantiation we should mark
- * this bean as prototype
- **/
- private Map communitiesCount = null;
-
- /**
- * Hold the collection item count obtained from SOLR after the first query
- **/
- private Map collectionsCount = null;
+ private static final Logger log = LogManager.getLogger(ItemCountDAOSolr.class);
- /**
- * Solr search service
- */
@Autowired
- protected SearchService searchService;
+ private SolrSearchCore solrSearchCore;
- /**
- * Get the count of the items in the given container.
- *
- * @param context DSpace context
- * @param dso DspaceObject
- * @return count
- */
@Override
public int getCount(Context context, DSpaceObject dso) {
- loadCount(context);
- Integer val = null;
+ String locationFilter;
if (dso instanceof Collection) {
- val = collectionsCount.get(dso.getID().toString());
+ locationFilter = "location.coll:" + dso.getID().toString();
} else if (dso instanceof Community) {
- val = communitiesCount.get(dso.getID().toString());
- }
-
- if (val != null) {
- return val;
+ locationFilter = "location.comm:" + dso.getID().toString();
} else {
return 0;
}
- }
- /**
- * make sure that the counts are actually fetched from Solr (if haven't been
- * cached in a Map yet)
- *
- * @param context DSpace Context
- */
- private void loadCount(Context context) {
- if (communitiesCount != null || collectionsCount != null) {
- return;
- }
-
- communitiesCount = new HashMap<>();
- collectionsCount = new HashMap<>();
-
- DiscoverQuery query = new DiscoverQuery();
- query.setFacetMinCount(1);
- query.addFacetField(new DiscoverFacetField("location.comm",
- DiscoveryConfigurationParameters.TYPE_STANDARD, -1,
- DiscoveryConfigurationParameters.SORT.COUNT));
- query.addFacetField(new DiscoverFacetField("location.coll",
- DiscoveryConfigurationParameters.TYPE_STANDARD, -1,
- DiscoveryConfigurationParameters.SORT.COUNT));
- query.addFilterQueries("search.resourcetype:" + IndexableItem.TYPE); // count only items
- query.addFilterQueries("NOT(discoverable:false)"); // only discoverable
- query.addFilterQueries("withdrawn:false"); // only not withdrawn
- query.addFilterQueries("archived:true"); // only archived
- query.setMaxResults(0);
-
- DiscoverResult sResponse;
try {
- sResponse = searchService.search(context, query);
- List commCount = sResponse.getFacetResult("location.comm");
- List collCount = sResponse.getFacetResult("location.coll");
- for (FacetResult c : commCount) {
- communitiesCount.put(c.getAsFilterQuery(), (int) c.getCount());
- }
- for (FacetResult c : collCount) {
- collectionsCount.put(c.getAsFilterQuery(), (int) c.getCount());
+ SolrClient solr = solrSearchCore.getSolr();
+ if (solr == null) {
+ return 0;
}
- } catch (SearchServiceException e) {
- log.error("Could not initialize Community/Collection Item Counts from Solr: ", e);
+ SolrQuery query = new SolrQuery("*:*");
+ query.addFilterQuery(locationFilter);
+ query.addFilterQuery("search.resourcetype:" + IndexableItem.TYPE);
+ query.addFilterQuery("NOT(discoverable:false)");
+ query.addFilterQuery("withdrawn:false");
+ query.addFilterQuery("archived:true");
+ query.setRows(0);
+ QueryResponse response = solr.query(query, solrSearchCore.REQUEST_METHOD);
+ return (int) response.getResults().getNumFound();
+ } catch (Exception e) {
+ log.error("Error counting items in Solr for {}: ", dso.getID(), e);
}
+ return 0;
}
}
diff --git a/dspace-api/src/main/java/org/dspace/browse/SolrBrowseDAO.java b/dspace-api/src/main/java/org/dspace/browse/SolrBrowseDAO.java
index a0a7725fa13a..32841e6c4b34 100644
--- a/dspace-api/src/main/java/org/dspace/browse/SolrBrowseDAO.java
+++ b/dspace-api/src/main/java/org/dspace/browse/SolrBrowseDAO.java
@@ -11,6 +11,7 @@
import static org.dspace.discovery.SearchUtils.RESOURCE_TYPE_FIELD;
import java.io.Serializable;
+import java.time.YearMonth;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Comparator;
@@ -99,6 +100,8 @@ public int compare(Object o1, Object o2) {
private String startsWith = null;
+ private String dateStartsWith = null;
+
/**
* field to look for value in
*/
@@ -221,10 +224,33 @@ private DiscoverResult getSolrResponse() throws BrowseException {
} else if (valuePartial) {
query.addFilterQueries("{!field f=" + facetField + "_partial}" + value);
}
+
if (StringUtils.isNotBlank(startsWith) && orderField != null) {
query.addFilterQueries(
"bi_" + orderField + "_sort:" + ClientUtils.escapeQueryChars(startsWith) + "*");
}
+ if (StringUtils.isNotBlank(dateStartsWith)) {
+ if (!ascending) {
+ String raw = dateStartsWith.trim();
+ String upperBound;
+ if (raw.length() == 4) { // YYYY
+ upperBound = raw + "-12-31";
+ } else if (raw.length() == 7) { // YYYY-MM
+ YearMonth ym = YearMonth.parse(raw);
+ upperBound = ym.atEndOfMonth().toString();
+ } else { // YYYY-MM-DD
+ upperBound = raw;
+ }
+ query.addFilterQueries("bi_" + orderField + "_sort" + ": [* TO \"" + upperBound + "\"]");
+ } else {
+ query.addFilterQueries("bi_" + orderField + "_sort" + ": [\"" + dateStartsWith + "\" TO *]");
+ }
+ }
+ if (StringUtils.isNotBlank(startsWith) && StringUtils.isNotBlank(dateStartsWith)) {
+ log.warn(String.format("dateStartsWith %s and startsWith %s both given, only one should " +
+ "be given since different type of sort filterquery applied depending on which is not blank",
+ dateStartsWith, startsWith));
+ }
// filter on item to be sure to don't include any other object
// indexed in the Discovery Search core
query.addFilterQueries("search.resourcetype:" + IndexableItem.TYPE);
@@ -466,6 +492,11 @@ public int getLimit() {
return limit;
}
+ @Override
+ public void setDateStartsWith(String dateStartsWith) {
+ this.dateStartsWith = dateStartsWith;
+ }
+
/*
* (non-Javadoc)
*
diff --git a/dspace-api/src/main/java/org/dspace/checker/CheckerCommand.java b/dspace-api/src/main/java/org/dspace/checker/CheckerCommand.java
index c82eb365277d..9ad9f553b445 100644
--- a/dspace-api/src/main/java/org/dspace/checker/CheckerCommand.java
+++ b/dspace-api/src/main/java/org/dspace/checker/CheckerCommand.java
@@ -131,13 +131,7 @@ public void process() throws SQLException {
collector.collect(context, info);
}
- // UMD Customization
- // This change was provided to DSpace in Pull Request 10508
- // This customization markers can be removed once the
- // application has been upgraded to a DSpace version containing
- // the pull request.
context.commit();
- // End UMD Customization
bitstream = dispatcher.next();
}
}
diff --git a/dspace-api/src/main/java/org/dspace/checker/DailyReportEmailer.java b/dspace-api/src/main/java/org/dspace/checker/DailyReportEmailer.java
index 50ef4baa98e3..481b055fbb7d 100644
--- a/dspace-api/src/main/java/org/dspace/checker/DailyReportEmailer.java
+++ b/dspace-api/src/main/java/org/dspace/checker/DailyReportEmailer.java
@@ -75,6 +75,7 @@ public void sendReport(File attachment, int numberOfBitstreams)
email.setContent("Checker Report", "report is attached ...");
email.addAttachment(attachment, "checksum_checker_report.txt");
email.addRecipient(configurationService.getProperty("mail.admin"));
+ log.info("Sending checker report email to " + configurationService.getProperty("mail.admin"));
email.send();
}
}
@@ -109,18 +110,19 @@ public static void main(String[] args) {
Options options = new Options();
options.addOption("h", "help", false, "Help");
- options.addOption("d", "Deleted", false,
- "Send E-mail report for all bitstreams set as deleted for today");
- options.addOption("m", "Missing", false,
- "Send E-mail report for all bitstreams not found in assetstore for today");
- options.addOption("c", "Changed", false,
- "Send E-mail report for all bitstreams where checksum has been changed for today");
- options.addOption("a", "All", false,
- "Send all E-mail reports");
- options.addOption("u", "Unchecked", false,
- "Send the Unchecked bitstream report");
- options.addOption("n", "Not Processed", false,
- "Send E-mail report for all bitstreams set to longer be processed for today");
+ options.addOption("d", "deleted", false,
+ "Send email report for all bitstreams set as deleted for today");
+ options.addOption("m", "missing", false,
+ "Send email report for all bitstreams not found in assetstore for today");
+ options.addOption("c", "changed", false,
+ "Send email report for all bitstreams where checksum has been changed for today");
+ options.addOption("a", "all", false,
+ "Send all email reports (used by default)");
+ options.addOption("u", "unchecked", false,
+ "Send the unchecked (i.e. recently added) bitstream email report");
+ options.addOption("n", "not-processed", false,
+ "Send email report for all bitstreams set to no longer be processed for today (includes"
+ + " bitstreams marked as deleted or not found)");
try {
line = parser.parse(options, args);
@@ -133,13 +135,15 @@ public static void main(String[] args) {
if (line.hasOption('h')) {
HelpFormatter myhelp = new HelpFormatter();
- myhelp.printHelp("Checksum Reporter\n", options);
- System.out.println("\nSend Deleted bitstream email report: DailyReportEmailer -d");
- System.out.println("\nSend Missing bitstreams email report: DailyReportEmailer -m");
- System.out.println("\nSend Checksum Changed email report: DailyReportEmailer -c");
- System.out.println("\nSend bitstream not to be processed email report: DailyReportEmailer -n");
- System.out.println("\nSend Un-checked bitstream report: DailyReportEmailer -u");
- System.out.println("\nSend All email reports: DailyReportEmailer");
+ myhelp.printHelp("checker-emailer\n", options);
+ System.out.println("\nChecksum Checker Reporter usage examples:\n");
+ System.out.println(" - Send all email reports: checker-emailer -a");
+ System.out.println(" - Send deleted bitstream email report: checker-emailer -d");
+ System.out.println(" - Send missing bitstreams email report: checker-emailer -m");
+ System.out.println(" - Send checksum changed email report: checker-emailer -c");
+ System.out.println(" - Send bitstream not to be processed email report: checker-emailer -n");
+ System.out.println(" - Send unchecked bitstream email report: checker-emailer -u");
+ System.out.println("\nDefault (no arguments) is equivalent to 'checker-emailer -a'\n");
System.exit(0);
}
@@ -191,7 +195,9 @@ public static void main(String[] args) {
writer.write("\n--------------------------------- Report Spacer ---------------------------\n\n");
numBitstreams += reporter.getBitstreamNotFoundReport(context, yesterday, tomorrow, writer);
writer.write("\n--------------------------------- Report Spacer ---------------------------\n\n");
- numBitstreams += reporter.getNotToBeProcessedReport(context, yesterday, tomorrow, writer);
+ // not to be processed report includes deleted and not found bitstreams so it is not necessary to
+ // include the sum in the counter
+ reporter.getNotToBeProcessedReport(context, yesterday, tomorrow, writer);
writer.write("\n--------------------------------- Report Spacer ---------------------------\n\n");
numBitstreams += reporter.getUncheckedBitstreamsReport(context, writer);
writer.write("\n--------------------------------- End Report ---------------------------\n\n");
diff --git a/dspace-api/src/main/java/org/dspace/checker/MostRecentChecksumServiceImpl.java b/dspace-api/src/main/java/org/dspace/checker/MostRecentChecksumServiceImpl.java
index d267171aa0d9..9ee777a3e15b 100644
--- a/dspace-api/src/main/java/org/dspace/checker/MostRecentChecksumServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/checker/MostRecentChecksumServiceImpl.java
@@ -90,61 +90,16 @@ public List findBitstreamResultTypeReport(Context context, D
/**
* Queries the bitstream table for bitstream IDs that are not yet in the
* most_recent_checksum table, and inserts them into the
- * most_recent_checksum and checksum_history tables.
- *
+ * most_recent_checksum table.
* @param context Context
* @throws SQLException if database error
*/
@Override
public void updateMissingBitstreams(Context context) throws SQLException {
-// "insert into most_recent_checksum ( "
-// + "bitstream_id, to_be_processed, expected_checksum, current_checksum, "
-// + "last_process_start_date, last_process_end_date, "
-// + "checksum_algorithm, matched_prev_checksum, result ) "
-// + "select bitstream.bitstream_id, "
-// + "CASE WHEN bitstream.deleted = false THEN true ELSE false END, "
-// + "CASE WHEN bitstream.checksum IS NULL THEN '' ELSE bitstream.checksum END, "
-// + "CASE WHEN bitstream.checksum IS NULL THEN '' ELSE bitstream.checksum END, "
-// + "?, ?, CASE WHEN bitstream.checksum_algorithm IS NULL "
-// + "THEN 'MD5' ELSE bitstream.checksum_algorithm END, true, "
-// + "CASE WHEN bitstream.deleted = true THEN 'BITSTREAM_MARKED_DELETED' else 'CHECKSUM_MATCH' END "
-// + "from bitstream where not exists( "
-// + "select 'x' from most_recent_checksum "
-// + "where most_recent_checksum.bitstream_id = bitstream.bitstream_id )";
-
- List unknownBitstreams = bitstreamService.findBitstreamsWithNoRecentChecksum(context);
- for (Bitstream bitstream : unknownBitstreams) {
- log.info(bitstream + " " + bitstream.getID().toString() + " " + bitstream.getName());
-
- MostRecentChecksum mostRecentChecksum = new MostRecentChecksum();
- mostRecentChecksum.setBitstream(bitstream);
- //Only process if our bitstream isn't deleted
- mostRecentChecksum.setToBeProcessed(!bitstream.isDeleted());
- if (bitstream.getChecksum() == null) {
- mostRecentChecksum.setCurrentChecksum("");
- mostRecentChecksum.setExpectedChecksum("");
- } else {
- mostRecentChecksum.setCurrentChecksum(bitstream.getChecksum());
- mostRecentChecksum.setExpectedChecksum(bitstream.getChecksum());
- }
- mostRecentChecksum.setProcessStartDate(new Date());
- mostRecentChecksum.setProcessEndDate(new Date());
- if (bitstream.getChecksumAlgorithm() == null) {
- mostRecentChecksum.setChecksumAlgorithm("MD5");
- } else {
- mostRecentChecksum.setChecksumAlgorithm(bitstream.getChecksumAlgorithm());
- }
- mostRecentChecksum.setMatchedPrevChecksum(true);
- ChecksumResult checksumResult;
- if (bitstream.isDeleted()) {
- checksumResult = checksumResultService.findByCode(context, ChecksumResultCode.BITSTREAM_MARKED_DELETED);
- } else {
- checksumResult = checksumResultService.findByCode(context, ChecksumResultCode.CHECKSUM_MATCH);
- }
- mostRecentChecksum.setChecksumResult(checksumResult);
- mostRecentChecksumDAO.create(context, mostRecentChecksum);
- mostRecentChecksumDAO.save(context, mostRecentChecksum);
- }
+ log.info("Retrieving missing bitsreams (bitstream IDs that are not yet in most_recent_checksum table)...");
+ int updated = mostRecentChecksumDAO.updateMissingBitstreams(context);
+ log.info("Updated most_recent_checksum for " + updated + " bitstreams.");
+ log.info("Missing bitsreams processing done.");
}
@Override
diff --git a/dspace-api/src/main/java/org/dspace/checker/SimpleReporterServiceImpl.java b/dspace-api/src/main/java/org/dspace/checker/SimpleReporterServiceImpl.java
index ddefb28e1b57..6c69764fdc79 100644
--- a/dspace-api/src/main/java/org/dspace/checker/SimpleReporterServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/checker/SimpleReporterServiceImpl.java
@@ -70,6 +70,7 @@ public int getDeletedBitstreamReport(Context context, Date startDate, Date endDa
osw.write("\n");
osw.write(msg("deleted-bitstream-intro"));
+ osw.write(" ");
osw.write(applyDateFormatShort(startDate));
osw.write(" ");
osw.write(msg("date-range-to"));
@@ -111,7 +112,6 @@ public int getChangedChecksumReport(Context context, Date startDate, Date endDat
osw.write("\n");
osw.write(msg("checksum-did-not-match"));
osw.write(" ");
- osw.write("\n");
osw.write(applyDateFormatShort(startDate));
osw.write(" ");
osw.write(msg("date-range-to"));
diff --git a/dspace-api/src/main/java/org/dspace/checker/dao/MostRecentChecksumDAO.java b/dspace-api/src/main/java/org/dspace/checker/dao/MostRecentChecksumDAO.java
index 56485c9b4b4b..73a81e4d9b4f 100644
--- a/dspace-api/src/main/java/org/dspace/checker/dao/MostRecentChecksumDAO.java
+++ b/dspace-api/src/main/java/org/dspace/checker/dao/MostRecentChecksumDAO.java
@@ -33,6 +33,8 @@ public List findByNotProcessedInDateRange(Context context, D
public List findByResultTypeInDateRange(Context context, Date startDate, Date endDate,
ChecksumResultCode resultCode) throws SQLException;
+ public int updateMissingBitstreams(Context context) throws SQLException;
+
public void deleteByBitstream(Context context, Bitstream bitstream) throws SQLException;
public MostRecentChecksum getOldestRecord(Context context) throws SQLException;
diff --git a/dspace-api/src/main/java/org/dspace/checker/dao/impl/MostRecentChecksumDAOImpl.java b/dspace-api/src/main/java/org/dspace/checker/dao/impl/MostRecentChecksumDAOImpl.java
index 669621aeeb58..dd07f3e2e9fa 100644
--- a/dspace-api/src/main/java/org/dspace/checker/dao/impl/MostRecentChecksumDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/checker/dao/impl/MostRecentChecksumDAOImpl.java
@@ -56,8 +56,8 @@ public List findByNotProcessedInDateRange(Context context, D
criteriaQuery.where(criteriaBuilder.and(
criteriaBuilder.equal(mostRecentChecksumRoot.get(MostRecentChecksum_.toBeProcessed), false),
criteriaBuilder
- .lessThanOrEqualTo(mostRecentChecksumRoot.get(MostRecentChecksum_.processStartDate), startDate),
- criteriaBuilder.greaterThan(mostRecentChecksumRoot.get(MostRecentChecksum_.processStartDate), endDate)
+ .lessThanOrEqualTo(mostRecentChecksumRoot.get(MostRecentChecksum_.processStartDate), endDate),
+ criteriaBuilder.greaterThan(mostRecentChecksumRoot.get(MostRecentChecksum_.processStartDate), startDate)
)
);
List orderList = new LinkedList<>();
@@ -66,6 +66,24 @@ public List findByNotProcessedInDateRange(Context context, D
return list(context, criteriaQuery, false, MostRecentChecksum.class, -1, -1);
}
+ @Override
+ public int updateMissingBitstreams(Context context) throws SQLException {
+ String hql = "INSERT INTO MostRecentChecksum(bitstream, toBeProcessed, expectedChecksum, currentChecksum, " +
+ "processStartDate, processEndDate, checksumAlgorithm, matchedPrevChecksum, checksumResult) " +
+ "SELECT b, " +
+ "CASE WHEN deleted = false THEN true ELSE false END, " +
+ "CASE WHEN checksum IS NULL THEN '' ELSE checksum END, " +
+ "CASE WHEN checksum IS NULL THEN '' ELSE checksum END, " +
+ "current_timestamp(), current_timestamp(), " +
+ "CASE WHEN checksumAlgorithm IS NULL THEN 'MD5' ELSE checksumAlgorithm END, " +
+ "CAST(1 AS boolean), " +
+ "(SELECT cr FROM ChecksumResult AS cr WHERE " +
+ "(resultCode = 'BITSTREAM_MARKED_DELETED' AND b.deleted = true) " +
+ "OR (resultCode = 'CHECKSUM_MATCH' AND b.deleted = false)) " +
+ "FROM Bitstream AS b WHERE NOT EXISTS(SELECT 'x' FROM MostRecentChecksum AS c WHERE c.bitstream = b)";
+ Query query = createQuery(context, hql);
+ return query.executeUpdate();
+ }
@Override
public MostRecentChecksum findByBitstream(Context context, Bitstream bitstream) throws SQLException {
diff --git a/dspace-api/src/main/java/org/dspace/checker/service/SimpleReporterService.java b/dspace-api/src/main/java/org/dspace/checker/service/SimpleReporterService.java
index 1dc56c20a3de..f3e0b43d8899 100644
--- a/dspace-api/src/main/java/org/dspace/checker/service/SimpleReporterService.java
+++ b/dspace-api/src/main/java/org/dspace/checker/service/SimpleReporterService.java
@@ -72,7 +72,8 @@ public int getBitstreamNotFoundReport(Context context, Date startDate, Date endD
/**
* The bitstreams that were set to not be processed report for the specified
- * date range.
+ * date range. This includes bitstreams that are marked as deleted and bitstreams
+ * that are not found from the assetstore.
*
* @param context context
* @param startDate the start date range.
diff --git a/dspace-api/src/main/java/org/dspace/content/BitstreamServiceImpl.java b/dspace-api/src/main/java/org/dspace/content/BitstreamServiceImpl.java
index 880a72d0a6c7..4363e0c76bf5 100644
--- a/dspace-api/src/main/java/org/dspace/content/BitstreamServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/BitstreamServiceImpl.java
@@ -21,6 +21,8 @@
import org.apache.commons.collections4.CollectionUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.Logger;
+import org.dspace.app.requestitem.RequestItem;
+import org.dspace.app.requestitem.service.RequestItemService;
import org.dspace.authorize.AuthorizeException;
import org.dspace.authorize.service.AuthorizeService;
import org.dspace.content.dao.BitstreamDAO;
@@ -65,6 +67,8 @@ public class BitstreamServiceImpl extends DSpaceObjectServiceImpl imp
protected BundleService bundleService;
@Autowired(required = true)
protected BitstreamStorageService bitstreamStorageService;
+ @Autowired(required = true)
+ protected RequestItemService requestItemService;
protected BitstreamServiceImpl() {
super();
@@ -289,6 +293,13 @@ public void delete(Context context, Bitstream bitstream) throws SQLException, Au
//Remove all bundles from the bitstream object, clearing the connection in 2 ways
bundles.clear();
+ // Remove any RequestItem entities associated with this bitstream ensuring there are no requests referencing
+ // a deleted bitstream
+ Iterator requestItems = requestItemService.findByBitstreamId(context, bitstream.getID());
+ while (requestItems.hasNext()) {
+ requestItemService.delete(context, requestItems.next());
+ }
+
// Remove policies only after the bitstream has been updated (otherwise the current user has not WRITE rights)
authorizeService.removeAllPolicies(context, bitstream);
}
@@ -350,6 +361,28 @@ public void expunge(Context context, Bitstream bitstream) throws SQLException, A
throw new IllegalStateException("Bitstream " + bitstream.getID().toString()
+ " must be deleted before it can be removed from the database.");
}
+
+ // Defensively remove any remaining bundle2bitstream references.
+ // Normally delete() already cleans these up, but orphaned rows from
+ // historical bugs can cause FK constraint violations on hard-delete.
+ final List bundles = bitstream.getBundles();
+ for (Bundle bundle : bundles) {
+ if (bitstream.equals(bundle.getPrimaryBitstream())) {
+ bundle.unsetPrimaryBitstreamID();
+ }
+ bundle.removeBitstream(bitstream);
+ }
+ bundles.clear();
+
+ // Remove any orphaned request items referencing this bitstream
+ Iterator requestItems = requestItemService.findByBitstreamId(context, bitstream.getID());
+ while (requestItems.hasNext()) {
+ requestItemService.delete(context, requestItems.next());
+ }
+
+ // Remove any remaining authorization policies
+ authorizeService.removeAllPolicies(context, bitstream);
+
bitstreamDAO.delete(context, bitstream);
}
diff --git a/dspace-api/src/main/java/org/dspace/content/BundleServiceImpl.java b/dspace-api/src/main/java/org/dspace/content/BundleServiceImpl.java
index 3ba90c8cc2ae..8234846ed4f3 100644
--- a/dspace-api/src/main/java/org/dspace/content/BundleServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/BundleServiceImpl.java
@@ -583,4 +583,8 @@ public Bundle findByLegacyId(Context context, int id) throws SQLException {
public int countTotal(Context context) throws SQLException {
return bundleDAO.countRows(context);
}
+
+ public int countBitstreams(Context context, Bundle bundle) throws SQLException {
+ return bundleDAO.countBitstreams(context, bundle);
+ }
}
diff --git a/dspace-api/src/main/java/org/dspace/content/CollectionServiceImpl.java b/dspace-api/src/main/java/org/dspace/content/CollectionServiceImpl.java
index f5ef4f4b14a4..2f3fd827bfab 100644
--- a/dspace-api/src/main/java/org/dspace/content/CollectionServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/CollectionServiceImpl.java
@@ -13,18 +13,21 @@
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
+import java.util.HashSet;
import java.util.Iterator;
+import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import java.util.MissingResourceException;
import java.util.Objects;
+import java.util.Queue;
import java.util.Set;
import java.util.UUID;
+import java.util.stream.Collectors;
import org.apache.commons.collections4.CollectionUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.Logger;
-import org.apache.solr.client.solrj.util.ClientUtils;
import org.dspace.app.util.AuthorizeUtil;
import org.dspace.authorize.AuthorizeConfiguration;
import org.dspace.authorize.AuthorizeException;
@@ -838,6 +841,86 @@ public List findAuthorized(Context context, Community community, int
return myResults;
}
+ @Override
+ public List findAuthorized(Context context, Community community, List actions)
+ throws SQLException {
+
+ List myCollections = new ArrayList<>();
+ EPerson eperson = context.getCurrentUser();
+
+ //If eperson is Administrator return all colls or if a community is not null only the community's collections
+ if (authorizeService.isAdmin(context, eperson)) {
+ if (community != null) {
+ return community.getCollections();
+ }
+ myCollections = this.findAll(context);
+ return myCollections;
+ }
+
+ //Get the collections of the eperson where is is admin of a community
+ List directGroups = new ArrayList<>(eperson.getGroups()); // direct membership
+ Queue queue = new LinkedList<>(directGroups);
+ while (!queue.isEmpty()) {
+ Group current = queue.poll();
+ List parents = current.getParentGroups();
+
+ for (Group parent : parents) {
+ if (directGroups.add(parent)) {
+ queue.add(parent);
+ }
+ }
+ }
+
+ List resourcePolicies = resourcePolicyService
+ .find(context, eperson, directGroups, Constants.ADMIN, Constants.COMMUNITY);
+ List uuids = resourcePolicies.stream()
+ .map(policy -> policy.getdSpaceObject().getID())
+ .toList();
+
+ List communities = uuids.stream()
+ .map(uuid -> {
+ try {
+ return communityService.find(context, uuid);
+ } catch (SQLException e) {
+ return null; //ignore that uuid
+ }
+ })
+ .filter(Objects::nonNull)
+ .toList();
+
+ Set allCommunities = new HashSet<>(communities);
+ Set allCommAdminCollections = communities.stream()
+ .flatMap(cm -> cm.getCollections().stream())
+ .collect(Collectors.toSet());
+ Queue queueComm = new LinkedList<>(communities);
+
+ while (!queueComm.isEmpty()) {
+ Community com = queueComm.poll();
+ List childrenComms = com.getSubcommunities();
+ for (Community childComm : childrenComms) {
+ if (allCommunities.add(childComm)) {
+ queueComm.add(childComm);
+ allCommAdminCollections.addAll(childComm.getCollections());
+ }
+ }
+ }
+
+ //Now get the collection when the eperson can deposit or is admin or is in a group with those privileges
+ myCollections = collectionDAO.findAuthorizedByEPerson(context, eperson, actions);
+ Set allCollections = new HashSet<>(myCollections);
+ //Join EPerson Community Admin Collections with Collection Admins
+ allCollections.addAll(allCommAdminCollections);
+
+ List collsAllowed = new ArrayList<>(allCollections);
+
+ //A community is passed, only the community's collections will be used and existing in eperson Authorizations
+ if (community != null) {
+ collsAllowed.retainAll(community.getCollections());
+ }
+
+ return collsAllowed;
+ }
+
@Override
public Collection findByGroup(Context context, Group group) throws SQLException {
return collectionDAO.findByGroup(context, group);
@@ -949,7 +1032,7 @@ public String getDefaultReadGroupName(Collection collection, String typeOfGroupS
@Override
public List findCollectionsWithSubmit(String q, Context context, Community community,
- int offset, int limit) throws SQLException, SearchServiceException {
+ int offset, int limit) throws SearchServiceException {
List collections = new ArrayList<>();
DiscoverQuery discoverQuery = new DiscoverQuery();
@@ -966,8 +1049,8 @@ public List findCollectionsWithSubmit(String q, Context context, Com
}
@Override
- public int countCollectionsWithSubmit(String q, Context context, Community community)
- throws SQLException, SearchServiceException {
+ public int countCollectionsWithSubmit(Context context, String q, Community community)
+ throws SearchServiceException {
DiscoverQuery discoverQuery = new DiscoverQuery();
discoverQuery.setMaxResults(0);
@@ -989,29 +1072,12 @@ public int countCollectionsWithSubmit(String q, Context context, Community commu
* terms. The terms are used to make also a prefix query on SOLR
* so it can be used to implement an autosuggest feature over the collection name
* @return discovery search result objects
- * @throws SQLException if something goes wrong
* @throws SearchServiceException if search error
*/
private DiscoverResult retrieveCollectionsWithSubmit(Context context, DiscoverQuery discoverQuery,
String entityType, Community community, String q)
- throws SQLException, SearchServiceException {
-
- StringBuilder query = new StringBuilder();
- EPerson currentUser = context.getCurrentUser();
- if (!authorizeService.isAdmin(context)) {
- String userId = "";
- if (currentUser != null) {
- userId = currentUser.getID().toString();
- }
- query.append("submit:(e").append(userId);
+ throws SearchServiceException {
- Set groups = groupService.allMemberGroupsSet(context, currentUser);
- for (Group group : groups) {
- query.append(" OR g").append(group.getID());
- }
- query.append(")");
- discoverQuery.addFilterQueries(query.toString());
- }
if (Objects.nonNull(community)) {
discoverQuery.addFilterQueries("location.comm:" + community.getID().toString());
}
@@ -1019,12 +1085,10 @@ private DiscoverResult retrieveCollectionsWithSubmit(Context context, DiscoverQu
discoverQuery.addFilterQueries("search.entitytype:" + entityType);
}
if (StringUtils.isNotBlank(q)) {
- StringBuilder buildQuery = new StringBuilder();
- String escapedQuery = ClientUtils.escapeQueryChars(q);
- buildQuery.append("(").append(escapedQuery).append(" OR dc.title_sort:*")
- .append(escapedQuery).append("*").append(")");
- discoverQuery.setQuery(buildQuery.toString());
+ q = searchService.formatAutoCompleteQuery(q, "dc.title_sort");
+ discoverQuery.setQuery(q);
}
+ discoverQuery.addRequiredAuthorization(Constants.ADD);
DiscoverResult resp = searchService.search(context, discoverQuery);
return resp;
}
@@ -1064,8 +1128,8 @@ public Collection retrieveCollectionWithSubmitByCommunityAndEntityType(Context c
context.turnOffAuthorisationSystem();
List collections;
try {
- collections = findCollectionsWithSubmit(null, context, community, entityType, 0, 1);
- } catch (SQLException | SearchServiceException e) {
+ collections = findCollectionsWithSubmit(context, null, community, entityType, 0, 1);
+ } catch (SearchServiceException e) {
throw new RuntimeException(e);
}
context.restoreAuthSystemState();
@@ -1085,8 +1149,8 @@ public Collection retrieveCollectionWithSubmitByCommunityAndEntityType(Context c
}
@Override
- public List findCollectionsWithSubmit(String q, Context context, Community community, String entityType,
- int offset, int limit) throws SQLException, SearchServiceException {
+ public List findCollectionsWithSubmit(Context context, String q, Community community, String entityType,
+ int offset, int limit) throws SearchServiceException {
List collections = new ArrayList<>();
DiscoverQuery discoverQuery = new DiscoverQuery();
discoverQuery.setDSpaceObjectFilter(IndexableCollection.TYPE);
@@ -1103,8 +1167,8 @@ public List findCollectionsWithSubmit(String q, Context context, Com
}
@Override
- public int countCollectionsWithSubmit(String q, Context context, Community community, String entityType)
- throws SQLException, SearchServiceException {
+ public int countCollectionsWithSubmit(Context context, String q, Community community, String entityType)
+ throws SearchServiceException {
DiscoverQuery discoverQuery = new DiscoverQuery();
discoverQuery.setMaxResults(0);
discoverQuery.setDSpaceObjectFilter(IndexableCollection.TYPE);
diff --git a/dspace-api/src/main/java/org/dspace/content/EntityType.java b/dspace-api/src/main/java/org/dspace/content/EntityType.java
index 720e0c492ca7..70b054c94d18 100644
--- a/dspace-api/src/main/java/org/dspace/content/EntityType.java
+++ b/dspace-api/src/main/java/org/dspace/content/EntityType.java
@@ -9,6 +9,7 @@
import java.util.Objects;
+import jakarta.persistence.Cacheable;
import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.GeneratedValue;
@@ -19,6 +20,8 @@
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.builder.HashCodeBuilder;
import org.dspace.core.ReloadableEntity;
+import org.hibernate.annotations.Cache;
+import org.hibernate.annotations.CacheConcurrencyStrategy;
/**
* Class representing an EntityType
@@ -26,6 +29,8 @@
* This also has a label that will be used to identify what kind of EntityType this object is
*/
@Entity
+@Cacheable
+@Cache(usage = CacheConcurrencyStrategy.NONSTRICT_READ_WRITE)
@Table(name = "entity_type")
public class EntityType implements ReloadableEntity {
diff --git a/dspace-api/src/main/java/org/dspace/content/EntityTypeServiceImpl.java b/dspace-api/src/main/java/org/dspace/content/EntityTypeServiceImpl.java
index 7df892cd56f5..1442c676a0c9 100644
--- a/dspace-api/src/main/java/org/dspace/content/EntityTypeServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/EntityTypeServiceImpl.java
@@ -16,6 +16,7 @@
import java.util.Set;
import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
import org.apache.solr.client.solrj.SolrQuery;
import org.apache.solr.client.solrj.SolrServerException;
import org.apache.solr.client.solrj.response.FacetField;
@@ -28,6 +29,7 @@
import org.dspace.content.service.EntityTypeService;
import org.dspace.core.Constants;
import org.dspace.core.Context;
+import org.dspace.discovery.SearchService;
import org.dspace.discovery.SolrSearchCore;
import org.dspace.discovery.indexobject.IndexableCollection;
import org.dspace.eperson.EPerson;
@@ -49,6 +51,9 @@ public class EntityTypeServiceImpl implements EntityTypeService {
@Autowired
protected SolrSearchCore solrSearchCore;
+ @Autowired
+ protected SearchService searchService;
+
@Override
public EntityType findByEntityType(Context context, String entityType) throws SQLException {
return entityTypeDAO.findByEntityType(context, entityType);
@@ -126,26 +131,34 @@ public List getSubmitAuthorizedTypes(Context context)
throws SQLException, SolrServerException, IOException {
List types = new ArrayList<>();
StringBuilder query = null;
- EPerson currentUser = context.getCurrentUser();
if (!authorizeService.isAdmin(context)) {
- String userId = "";
+ EPerson currentUser = context.getCurrentUser();
+ StringBuilder epersonAndGroupClause = new StringBuilder();
if (currentUser != null) {
- userId = currentUser.getID().toString();
- query = new StringBuilder();
- query.append("submit:(e").append(userId);
+ epersonAndGroupClause.append("e").append(currentUser.getID());
}
-
+ //Retrieve all the groups the current user is a member of
Set groups = groupService.allMemberGroupsSet(context, currentUser);
for (Group group : groups) {
- if (query == null) {
- query = new StringBuilder();
- query.append("submit:(g");
+ if (!epersonAndGroupClause.isEmpty()) {
+ epersonAndGroupClause.append(" OR g").append(group.getID());
} else {
- query.append(" OR g");
+ epersonAndGroupClause.append("g").append(group.getID());
}
- query.append(group.getID());
}
- query.append(")");
+
+ if (epersonAndGroupClause.isEmpty()) {
+ // No user or groups, no authorized types
+ return new ArrayList<>();
+ }
+ query = new StringBuilder();
+ query.append("submit:(").append(epersonAndGroupClause).append(")");
+ query.append(" OR ").append("admin:(").append(epersonAndGroupClause).append(")");
+ String locations = searchService.createLocationQueryForAdministrableDSOs(epersonAndGroupClause.toString());
+ if (StringUtils.isNotBlank(locations)) {
+ query.append(" OR ");
+ query.append(locations);
+ }
}
SolrQuery sQuery = new SolrQuery("*:*");
diff --git a/dspace-api/src/main/java/org/dspace/content/ItemServiceImpl.java b/dspace-api/src/main/java/org/dspace/content/ItemServiceImpl.java
index 157b891486f0..f8ea21b3cccb 100644
--- a/dspace-api/src/main/java/org/dspace/content/ItemServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/ItemServiceImpl.java
@@ -22,7 +22,6 @@
import java.util.UUID;
import java.util.function.Supplier;
import java.util.stream.Collectors;
-import java.util.stream.Stream;
import org.apache.commons.collections4.CollectionUtils;
import org.apache.commons.lang3.StringUtils;
@@ -480,7 +479,7 @@ public void addBundle(Context context, Item item, Bundle bundle) throws SQLExcep
// now add authorization policies from owning item
// hmm, not very "multiple-inclusion" friendly
- authorizeService.inheritPolicies(context, item, bundle);
+ authorizeService.inheritPolicies(context, item, bundle, true);
// Add the bundle to in-memory list
item.addBundle(bundle);
@@ -1046,8 +1045,8 @@ public void adjustBundleBitstreamPolicies(Context context, Item item, Collection
// if come from InstallItem: remove all submission/workflow policies
authorizeService.removeAllPoliciesByDSOAndType(context, mybundle, ResourcePolicy.TYPE_SUBMISSION);
authorizeService.removeAllPoliciesByDSOAndType(context, mybundle, ResourcePolicy.TYPE_WORKFLOW);
- addCustomPoliciesNotInPlace(context, mybundle, defaultItemPolicies);
- addDefaultPoliciesNotInPlace(context, mybundle, defaultCollectionBundlePolicies);
+ authorizeService.addCustomPoliciesNotInPlace(context, mybundle, defaultItemPolicies);
+ authorizeService.addDefaultPoliciesNotInPlace(context, mybundle, defaultCollectionBundlePolicies);
for (Bitstream bitstream : mybundle.getBitstreams()) {
// If collection has default READ policies, remove the bundle's READ policies.
@@ -1093,8 +1092,8 @@ private void removeAllPoliciesAndAddDefault(Context context, Bitstream bitstream
throws SQLException, AuthorizeException {
authorizeService.removeAllPoliciesByDSOAndType(context, bitstream, ResourcePolicy.TYPE_SUBMISSION);
authorizeService.removeAllPoliciesByDSOAndType(context, bitstream, ResourcePolicy.TYPE_WORKFLOW);
- addCustomPoliciesNotInPlace(context, bitstream, defaultItemPolicies);
- addDefaultPoliciesNotInPlace(context, bitstream, defaultCollectionPolicies);
+ authorizeService.addCustomPoliciesNotInPlace(context, bitstream, defaultItemPolicies);
+ authorizeService.addDefaultPoliciesNotInPlace(context, bitstream, defaultCollectionPolicies);
}
@Override
@@ -1132,7 +1131,7 @@ public void adjustItemPolicies(Context context, Item item, Collection collection
authorizeService.removeAllPoliciesByDSOAndType(context, item, ResourcePolicy.TYPE_WORKFLOW);
// add default policies only if not already in place
- addDefaultPoliciesNotInPlace(context, item, defaultCollectionPolicies);
+ authorizeService.addDefaultPoliciesNotInPlace(context, item, defaultCollectionPolicies);
} finally {
context.restoreAuthSystemState();
}
@@ -1142,11 +1141,6 @@ public void adjustItemPolicies(Context context, Item item, Collection collection
public void move(Context context, Item item, Collection from, Collection to)
throws SQLException, AuthorizeException, IOException {
- // If the two collections are the same, do nothing.
- if (from.equals(to)) {
- return;
- }
-
// Use the normal move method, and default to not inherit permissions
this.move(context, item, from, to, false);
}
@@ -1161,6 +1155,11 @@ public void move(Context context, Item item, Collection from, Collection to, boo
authorizeService.authorizeAction(context, item, Constants.WRITE);
}
+ // If the two collections are the same, do nothing.
+ if (from.equals(to)) {
+ return;
+ }
+
// Move the Item from one Collection to the other
collectionService.addItem(context, to, item);
collectionService.removeItem(context, from, item);
@@ -1261,43 +1260,41 @@ public boolean canEdit(Context context, Item item) throws SQLException {
*
* @param context DSpace context
* @param discoverQuery
+ * @param q query string
* @return discovery search result objects
- * @throws SQLException if something goes wrong
* @throws SearchServiceException if search error
*/
- private DiscoverResult retrieveItemsWithEdit(Context context, DiscoverQuery discoverQuery)
- throws SQLException, SearchServiceException {
- EPerson currentUser = context.getCurrentUser();
- if (!authorizeService.isAdmin(context)) {
- String userId = currentUser != null ? "e" + currentUser.getID().toString() : "e";
- Stream groupIds = groupService.allMemberGroupsSet(context, currentUser).stream()
- .map(group -> "g" + group.getID());
- String query = Stream.concat(Stream.of(userId), groupIds)
- .collect(Collectors.joining(" OR ", "edit:(", ")"));
- discoverQuery.addFilterQueries(query);
- }
+ private DiscoverResult retrieveItemsWithEdit(Context context, DiscoverQuery discoverQuery, String q)
+ throws SearchServiceException {
+ if (StringUtils.isNotBlank(q)) {
+ // Although not all items will have a metadata dc.title, we use it for autocomplete because it is the
+ // most common. Ideally, we should use a field that all indexed items have
+ q = searchService.formatAutoCompleteQuery(q, "dc.title_sort");
+ discoverQuery.setQuery(q);
+ }
+ discoverQuery.addRequiredAuthorization(Constants.WRITE);
return searchService.search(context, discoverQuery);
}
@Override
- public List- findItemsWithEdit(Context context, int offset, int limit)
- throws SQLException, SearchServiceException {
+ public List
- findItemsWithEdit(Context context, String q, int offset, int limit)
+ throws SearchServiceException {
DiscoverQuery discoverQuery = new DiscoverQuery();
discoverQuery.setDSpaceObjectFilter(IndexableItem.TYPE);
discoverQuery.setStart(offset);
discoverQuery.setMaxResults(limit);
- DiscoverResult resp = retrieveItemsWithEdit(context, discoverQuery);
+ DiscoverResult resp = retrieveItemsWithEdit(context, discoverQuery, q);
return resp.getIndexableObjects().stream()
.map(solrItems -> ((IndexableItem) solrItems).getIndexedObject())
.collect(Collectors.toList());
}
@Override
- public int countItemsWithEdit(Context context) throws SQLException, SearchServiceException {
+ public int countItemsWithEdit(Context context, String q) throws SearchServiceException {
DiscoverQuery discoverQuery = new DiscoverQuery();
discoverQuery.setMaxResults(0);
discoverQuery.setDSpaceObjectFilter(IndexableItem.TYPE);
- DiscoverResult resp = retrieveItemsWithEdit(context, discoverQuery);
+ DiscoverResult resp = retrieveItemsWithEdit(context, discoverQuery, q);
return (int) resp.getTotalSearchResults();
}
@@ -1322,91 +1319,7 @@ public boolean isInProgressSubmission(Context context, Item item) throws SQLExce
*/
- /**
- * Add the default policies, which have not been already added to the given DSpace object
- *
- * @param context The relevant DSpace Context.
- * @param dso The DSpace Object to add policies to
- * @param defaultCollectionPolicies list of policies
- * @throws SQLException An exception that provides information on a database access error or other errors.
- * @throws AuthorizeException Exception indicating the current user of the context does not have permission
- * to perform a particular action.
- */
- protected void addDefaultPoliciesNotInPlace(Context context, DSpaceObject dso,
- List defaultCollectionPolicies) throws SQLException, AuthorizeException {
- boolean appendMode = configurationService
- .getBooleanProperty("core.authorization.installitem.inheritance-read.append-mode", false);
- for (ResourcePolicy defaultPolicy : defaultCollectionPolicies) {
- if (!authorizeService
- .isAnIdenticalPolicyAlreadyInPlace(context, dso, defaultPolicy.getGroup(), Constants.READ,
- defaultPolicy.getID()) &&
- (!appendMode && isNotAlreadyACustomRPOfThisTypeOnDSO(context, dso) ||
- appendMode && shouldBeAppended(context, dso, defaultPolicy))) {
- ResourcePolicy newPolicy = resourcePolicyService.clone(context, defaultPolicy);
- newPolicy.setdSpaceObject(dso);
- newPolicy.setAction(Constants.READ);
- newPolicy.setRpType(ResourcePolicy.TYPE_INHERITED);
- resourcePolicyService.update(context, newPolicy);
- }
- }
- }
-
- private void addCustomPoliciesNotInPlace(Context context, DSpaceObject dso, List customPolicies)
- throws SQLException, AuthorizeException {
- boolean customPoliciesAlreadyInPlace = authorizeService
- .findPoliciesByDSOAndType(context, dso, ResourcePolicy.TYPE_CUSTOM).size() > 0;
- if (!customPoliciesAlreadyInPlace) {
- authorizeService.addPolicies(context, customPolicies, dso);
- }
- }
-
- /**
- * Check whether or not there is already an RP on the given dso, which has actionId={@link Constants.READ} and
- * resourceTypeId={@link ResourcePolicy.TYPE_CUSTOM}
- *
- * @param context DSpace context
- * @param dso DSpace object to check for custom read RP
- * @return True if there is no RP on the item with custom read RP, otherwise false
- * @throws SQLException If something goes wrong retrieving the RP on the DSO
- */
- private boolean isNotAlreadyACustomRPOfThisTypeOnDSO(Context context, DSpaceObject dso) throws SQLException {
- List readRPs = resourcePolicyService.find(context, dso, Constants.READ);
- for (ResourcePolicy readRP : readRPs) {
- if (readRP.getRpType() != null && readRP.getRpType().equals(ResourcePolicy.TYPE_CUSTOM)) {
- return false;
- }
- }
- return true;
- }
- /**
- * Check if the provided default policy should be appended or not to the final
- * item. If an item has at least one custom READ policy any anonymous READ
- * policy with empty start/end date should be skipped
- *
- * @param context DSpace context
- * @param dso DSpace object to check for custom read RP
- * @param defaultPolicy The policy to check
- * @return
- * @throws SQLException If something goes wrong retrieving the RP on the DSO
- */
- private boolean shouldBeAppended(Context context, DSpaceObject dso, ResourcePolicy defaultPolicy)
- throws SQLException {
- boolean hasCustomPolicy = resourcePolicyService.find(context, dso, Constants.READ)
- .stream()
- .filter(rp -> (Objects.nonNull(rp.getRpType()) &&
- Objects.equals(rp.getRpType(), ResourcePolicy.TYPE_CUSTOM)))
- .findFirst()
- .isPresent();
-
- boolean isAnonimousGroup = Objects.nonNull(defaultPolicy.getGroup())
- && StringUtils.equals(defaultPolicy.getGroup().getName(), Group.ANONYMOUS);
-
- boolean datesAreNull = Objects.isNull(defaultPolicy.getStartDate())
- && Objects.isNull(defaultPolicy.getEndDate());
-
- return !(hasCustomPolicy && isAnonimousGroup && datesAreNull);
- }
/**
* Returns an iterator of Items possessing the passed metadata field, or only
diff --git a/dspace-api/src/main/java/org/dspace/content/RelationshipType.java b/dspace-api/src/main/java/org/dspace/content/RelationshipType.java
index ba5f0531e97e..f00b21421e30 100644
--- a/dspace-api/src/main/java/org/dspace/content/RelationshipType.java
+++ b/dspace-api/src/main/java/org/dspace/content/RelationshipType.java
@@ -7,6 +7,7 @@
*/
package org.dspace.content;
+import jakarta.persistence.Cacheable;
import jakarta.persistence.CascadeType;
import jakarta.persistence.Column;
import jakarta.persistence.Entity;
@@ -20,6 +21,8 @@
import jakarta.persistence.Table;
import org.dspace.core.Context;
import org.dspace.core.ReloadableEntity;
+import org.hibernate.annotations.Cache;
+import org.hibernate.annotations.CacheConcurrencyStrategy;
import org.hibernate.annotations.JdbcTypeCode;
import org.hibernate.type.SqlTypes;
@@ -32,6 +35,8 @@
* The cardinality properties describe how many of each relations this relationshipType can support
*/
@Entity
+@Cacheable
+@Cache(usage = CacheConcurrencyStrategy.NONSTRICT_READ_WRITE)
@Table(name = "relationship_type")
public class RelationshipType implements ReloadableEntity {
diff --git a/dspace-api/src/main/java/org/dspace/content/authority/DSpaceControlledVocabulary.java b/dspace-api/src/main/java/org/dspace/content/authority/DSpaceControlledVocabulary.java
index 444332df97d2..3aea294b2ba1 100644
--- a/dspace-api/src/main/java/org/dspace/content/authority/DSpaceControlledVocabulary.java
+++ b/dspace-api/src/main/java/org/dspace/content/authority/DSpaceControlledVocabulary.java
@@ -34,23 +34,25 @@
* from {@code ${dspace.dir}/config/controlled-vocabularies/*.xml} and turns
* them into autocompleting authorities.
*
- * Configuration: This MUST be configured as a self-named plugin, e.g.: {@code
- * plugin.selfnamed.org.dspace.content.authority.ChoiceAuthority = \
+ *
Configuration: This MUST be configured as a self-named plugin, e.g.: {@code
+ * plugin.selfnamed.org.dspace.content.authority.ChoiceAuthority =
* org.dspace.content.authority.DSpaceControlledVocabulary
* }
*
- * It AUTOMATICALLY configures a plugin instance for each XML file in the
+ *
It AUTOMATICALLY configures a plugin instance for each XML file in the
* controlled vocabularies directory. The name of the plugin is the basename of
* the file; e.g., {@code ${dspace.dir}/config/controlled-vocabularies/nsi.xml}
* would generate a plugin called "nsi".
*
- * Each configured plugin comes with three configuration options: {@code
- * vocabulary.plugin._plugin_.hierarchy.store =
- * # Store entire hierarchy along with selected value. Default: TRUE
- * vocabulary.plugin._plugin_.hierarchy.suggest =
- * # Display entire hierarchy in the suggestion list. Default: TRUE
- * vocabulary.plugin._plugin_.delimiter = ""
- * # Delimiter to use when building hierarchy strings. Default: "::"
+ * Each configured plugin comes with three configuration options:
+ *
+ * - {@code vocabulary.plugin._plugin_.hierarchy.store =
+ * # Store entire hierarchy along with selected value. Default: TRUE}
+ * - {@code vocabulary.plugin._plugin_.hierarchy.suggest =
+ * # Display entire hierarchy in the suggestion list. Default: TRUE}
+ * - {@code vocabulary.plugin._plugin_.delimiter = ""
+ * # Delimiter to use when building hierarchy strings. Default: "::"}
+ *
* }
*
* @author Michael B. Klein
@@ -58,11 +60,23 @@
public class DSpaceControlledVocabulary extends SelfNamedPlugin implements HierarchicalAuthority {
- private static Logger log = org.apache.logging.log4j.LogManager.getLogger(DSpaceControlledVocabulary.class);
- protected static String xpathTemplate = "//node[contains(translate(@label,'ABCDEFGHIJKLMNOPQRSTUVWXYZ'," +
- "'abcdefghijklmnopqrstuvwxyz'),'%s')]";
- protected static String idTemplate = "//node[@id = '%s']";
- protected static String labelTemplate = "//node[@label = '%s']";
+ private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
+ protected static final String xpathTemplate;
+ static {
+ StringBuilder upper = new StringBuilder();
+ StringBuilder lower = new StringBuilder();
+ for (int cp = 'A'; cp <= Character.MAX_CODE_POINT; cp++) {
+ if (Character.isLetter(cp) && Character.isUpperCase(cp)) {
+ int lcp = Character.toLowerCase(cp);
+ upper.appendCodePoint(cp);
+ lower.appendCodePoint(lcp);
+ }
+ }
+ xpathTemplate = "//node[contains(translate(@label,'" + upper + "','" + lower + "'),%s)]";
+ }
+ protected static String idTemplate = "//node[@id = %s]";
+ protected static String idTemplateQuoted = "//node[@id = '%s']";
+ protected static String labelTemplate = "//node[@label = %s]";
protected static String idParentTemplate = "//node[@id = '%s']/parent::isComposedBy/parent::node";
protected static String rootTemplate = "/node";
protected static String pluginNames[] = null;
@@ -106,7 +120,7 @@ public boolean accept(File dir, String name) {
File.separator + "config" +
File.separator + "controlled-vocabularies";
String[] xmlFiles = (new File(vocabulariesPath)).list(new xmlFilter());
- List names = new ArrayList();
+ List names = new ArrayList<>();
for (String filename : xmlFiles) {
names.add((new File(filename)).getName().replace(".xml", ""));
}
@@ -162,14 +176,23 @@ protected String buildString(Node node) {
public Choices getMatches(String text, int start, int limit, String locale) {
init();
log.debug("Getting matches for '" + text + "'");
- String xpathExpression = "";
String[] textHierarchy = text.split(hierarchyDelimiter, -1);
+ StringBuilder xpathExpressionBuilder = new StringBuilder();
for (int i = 0; i < textHierarchy.length; i++) {
- xpathExpression += String.format(xpathTemplate, textHierarchy[i].replaceAll("'", "'").toLowerCase());
+ xpathExpressionBuilder.append(String.format(xpathTemplate, "$var" + i));
}
+ String xpathExpression = xpathExpressionBuilder.toString();
XPath xpath = XPathFactory.newInstance().newXPath();
- int total = 0;
- List choices = new ArrayList();
+ xpath.setXPathVariableResolver(variableName -> {
+ String varName = variableName.getLocalPart();
+ if (varName.startsWith("var")) {
+ int index = Integer.parseInt(varName.substring(3));
+ return textHierarchy[index].toLowerCase();
+ }
+ throw new IllegalArgumentException("Unexpected variable: " + varName);
+ });
+ int total;
+ List choices;
try {
NodeList results = (NodeList) xpath.evaluate(xpathExpression, vocabulary, XPathConstants.NODESET);
total = results.getLength();
@@ -185,14 +208,23 @@ public Choices getMatches(String text, int start, int limit, String locale) {
@Override
public Choices getBestMatch(String text, String locale) {
init();
- log.debug("Getting best matches for '" + text + "'");
- String xpathExpression = "";
+ log.debug("Getting best matches for {}'", text);
String[] textHierarchy = text.split(hierarchyDelimiter, -1);
+ StringBuilder xpathExpressionBuilder = new StringBuilder();
for (int i = 0; i < textHierarchy.length; i++) {
- xpathExpression += String.format(labelTemplate, textHierarchy[i].replaceAll("'", "'"));
+ xpathExpressionBuilder.append(String.format(labelTemplate, "$var" + i));
}
+ String xpathExpression = xpathExpressionBuilder.toString();
XPath xpath = XPathFactory.newInstance().newXPath();
- List choices = new ArrayList();
+ xpath.setXPathVariableResolver(variableName -> {
+ String varName = variableName.getLocalPart();
+ if (varName.startsWith("var")) {
+ int index = Integer.parseInt(varName.substring(3));
+ return textHierarchy[index];
+ }
+ throw new IllegalArgumentException("Unexpected variable: " + varName);
+ });
+ List choices;
try {
NodeList results = (NodeList) xpath.evaluate(xpathExpression, vocabulary, XPathConstants.NODESET);
choices = getChoicesFromNodeList(results, 0, 1);
@@ -240,7 +272,7 @@ public Choices getTopChoices(String authorityName, int start, int limit, String
@Override
public Choices getChoicesByParent(String authorityName, String parentId, int start, int limit, String locale) {
init();
- String xpathExpression = String.format(idTemplate, parentId);
+ String xpathExpression = String.format(idTemplateQuoted, parentId);
return getChoicesByXpath(xpathExpression, start, limit);
}
@@ -264,15 +296,12 @@ public Integer getPreloadLevel() {
}
private boolean isRootElement(Node node) {
- if (node != null && node.getOwnerDocument().getDocumentElement().equals(node)) {
- return true;
- }
- return false;
+ return node != null && node.getOwnerDocument().getDocumentElement().equals(node);
}
private Node getNode(String key) throws XPathExpressionException {
init();
- String xpathExpression = String.format(idTemplate, key);
+ String xpathExpression = String.format(idTemplateQuoted, key);
Node node = getNodeFromXPath(xpathExpression);
return node;
}
@@ -284,7 +313,7 @@ private Node getNodeFromXPath(String xpathExpression) throws XPathExpressionExce
}
private List getChoicesFromNodeList(NodeList results, int start, int limit) {
- List choices = new ArrayList();
+ List choices = new ArrayList<>();
for (int i = 0; i < results.getLength(); i++) {
if (i < start) {
continue;
@@ -303,17 +332,17 @@ private List getChoicesFromNodeList(NodeList results, int start, int lim
private Map addOtherInformation(String parentCurr, String noteCurr,
List childrenCurr, String authorityCurr) {
- Map extras = new HashMap();
+ Map extras = new HashMap<>();
if (StringUtils.isNotBlank(parentCurr)) {
extras.put("parent", parentCurr);
}
if (StringUtils.isNotBlank(noteCurr)) {
extras.put("note", noteCurr);
}
- if (childrenCurr.size() > 0) {
- extras.put("hasChildren", "true");
- } else {
+ if (childrenCurr.isEmpty()) {
extras.put("hasChildren", "false");
+ } else {
+ extras.put("hasChildren", "true");
}
extras.put("id", authorityCurr);
return extras;
@@ -368,7 +397,7 @@ private String getNote(Node node) {
}
private List getChildren(Node node) {
- List children = new ArrayList();
+ List children = new ArrayList<>();
NodeList childNodes = node.getChildNodes();
for (int ci = 0; ci < childNodes.getLength(); ci++) {
Node firstChild = childNodes.item(ci);
@@ -391,7 +420,7 @@ private List getChildren(Node node) {
private boolean isSelectable(Node node) {
Node selectableAttr = node.getAttributes().getNamedItem("selectable");
if (null != selectableAttr) {
- return Boolean.valueOf(selectableAttr.getNodeValue());
+ return Boolean.parseBoolean(selectableAttr.getNodeValue());
} else { // Default is true
return true;
}
@@ -418,7 +447,7 @@ private String getAuthority(Node node) {
}
private Choices getChoicesByXpath(String xpathExpression, int start, int limit) {
- List choices = new ArrayList();
+ List choices = new ArrayList<>();
XPath xpath = XPathFactory.newInstance().newXPath();
try {
Node parentNode = (Node) xpath.evaluate(xpathExpression, vocabulary, XPathConstants.NODE);
diff --git a/dspace-api/src/main/java/org/dspace/content/crosswalk/CrosswalkMetadataValidator.java b/dspace-api/src/main/java/org/dspace/content/crosswalk/CrosswalkMetadataValidator.java
index b1be458a255e..1bcc1c9ba9fb 100644
--- a/dspace-api/src/main/java/org/dspace/content/crosswalk/CrosswalkMetadataValidator.java
+++ b/dspace-api/src/main/java/org/dspace/content/crosswalk/CrosswalkMetadataValidator.java
@@ -107,9 +107,12 @@ public MetadataField checkMetadata(Context context, String schema, String elemen
e.printStackTrace();
}
} else if (!fieldChoice.equals("ignore")) {
- throw new CrosswalkException(
- "The '" + element + "." + qualifier + "' element has not been defined in this DSpace " +
- "instance. ");
+ throw new CrosswalkException(String.format(
+ "The '%s.%s%s' element has not been defined in this DSpace instance.",
+ mdSchema.getName(),
+ element,
+ qualifier == null ? "" : ("." + qualifier)
+ ));
}
}
}
diff --git a/dspace-api/src/main/java/org/dspace/content/crosswalk/LicenseStreamDisseminationCrosswalk.java b/dspace-api/src/main/java/org/dspace/content/crosswalk/LicenseStreamDisseminationCrosswalk.java
index 46858747870d..b1854bfd85ae 100644
--- a/dspace-api/src/main/java/org/dspace/content/crosswalk/LicenseStreamDisseminationCrosswalk.java
+++ b/dspace-api/src/main/java/org/dspace/content/crosswalk/LicenseStreamDisseminationCrosswalk.java
@@ -8,6 +8,7 @@
package org.dspace.content.crosswalk;
import java.io.IOException;
+import java.io.InputStream;
import java.io.OutputStream;
import java.sql.SQLException;
@@ -56,7 +57,12 @@ public void disseminate(Context context, DSpaceObject dso, OutputStream out)
Bitstream licenseBs = PackageUtils.findDepositLicense(context, (Item) dso);
if (licenseBs != null) {
- Utils.copy(bitstreamService.retrieve(context, licenseBs), out);
+ try (final InputStream bitInputStream = bitstreamService.retrieve(context, licenseBs)) {
+ Utils.copy(bitInputStream, out);
+ } catch (Exception e) {
+ log.warn("Could not retrieve license file for Item with UUID={}. " +
+ "Leaving it out of generated package. Error{}", dso.getID(), e.getMessage());
+ }
}
}
}
diff --git a/dspace-api/src/main/java/org/dspace/content/crosswalk/OREIngestionCrosswalk.java b/dspace-api/src/main/java/org/dspace/content/crosswalk/OREIngestionCrosswalk.java
index f756aae22577..9e890a6046fa 100644
--- a/dspace-api/src/main/java/org/dspace/content/crosswalk/OREIngestionCrosswalk.java
+++ b/dspace-api/src/main/java/org/dspace/content/crosswalk/OREIngestionCrosswalk.java
@@ -11,6 +11,8 @@
import java.io.IOException;
import java.io.InputStream;
import java.net.ConnectException;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.net.URL;
import java.sql.SQLException;
import java.text.NumberFormat;
@@ -18,6 +20,8 @@
import java.util.Date;
import java.util.HashSet;
import java.util.List;
+import java.util.Locale;
+import java.util.Objects;
import java.util.Set;
import org.apache.logging.log4j.Logger;
@@ -34,6 +38,8 @@
import org.dspace.content.service.ItemService;
import org.dspace.core.Constants;
import org.dspace.core.Context;
+import org.dspace.services.ConfigurationService;
+import org.dspace.services.factory.DSpaceServicesFactory;
import org.jdom2.Attribute;
import org.jdom2.Document;
import org.jdom2.Element;
@@ -76,6 +82,7 @@ public class OREIngestionCrosswalk
.getBitstreamFormatService();
protected BundleService bundleService = ContentServiceFactory.getInstance().getBundleService();
protected ItemService itemService = ContentServiceFactory.getInstance().getItemService();
+ protected ConfigurationService configurationService = DSpaceServicesFactory.getInstance().getConfigurationService();
@Override
@@ -173,9 +180,13 @@ public void ingest(Context context, DSpaceObject dso, Element root, boolean crea
try {
// Make sure the url string escapes all the oddball characters
String processedURL = encodeForURL(href);
- // Generate a requeset for the aggregated resource
- ARurl = new URL(processedURL);
- in = ARurl.openStream();
+ if (validResourceUri(entryId, processedURL)) {
+ // Generate a request for the aggregated resource
+ ARurl = new URL(processedURL);
+ in = ARurl.openStream();
+ } else {
+ throw new FileNotFoundException("Failed to validate " + processedURL);
+ }
} catch (FileNotFoundException fe) {
log.error("The provided URI failed to return a resource: " + href);
} catch (ConnectException fe) {
@@ -219,17 +230,17 @@ public void ingest(Context context, DSpaceObject dso, Element root, boolean crea
* @param sourceString source unescaped string
*/
private String encodeForURL(String sourceString) {
- Character lowalpha[] = {'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i',
+ Character[] lowalpha = {'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i',
'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r',
's', 't', 'u', 'v', 'w', 'x', 'y', 'z'};
- Character upalpha[] = {'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I',
+ Character[] upalpha = {'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I',
'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R',
'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z'};
- Character digit[] = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9'};
- Character mark[] = {'-', '_', '.', '!', '~', '*', '\'', '(', ')'};
+ Character[] digit = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9'};
+ Character[] mark = {'-', '_', '.', '!', '~', '*', '\'', '(', ')'};
// reserved
- Character reserved[] = {';', '/', '?', ':', '@', '&', '=', '+', '$', ',', '%', '#'};
+ Character[] reserved = {';', '/', '?', ':', '@', '&', '=', '+', '$', ',', '%', '#'};
Set URLcharsSet = new HashSet();
URLcharsSet.addAll(Arrays.asList(lowalpha));
@@ -251,4 +262,61 @@ private String encodeForURL(String sourceString) {
return processedString.toString();
}
+ /**
+ * Validate a resource URI against the host and scheme of the remote OAI endpoint, or a configured
+ * list of allowed prefixes.
+ * This still implicitly "trusts" the remote OAI server, but will reject resource URIs with a totally
+ * different hostname to avoid downloading malicious resources from a compromised endpoint.
+ * Even if the URL prefix validation is disabled, schemes will still be enforced to http(s) so file:/// and
+ * other unwanted schemes cannot be used
+ * @param entryUrl the entryId of the parent ORE resource
+ * @param resourceUrl the resource URL of the aggregated ORE resource
+ * @return result of the validation
+ */
+ private boolean validResourceUri(String entryUrl, String resourceUrl) {
+ try {
+ Set allowedSchemes = Set.of("http", "https");
+ URI entryUri = new URI(entryUrl).normalize();
+ URI resourceUri = new URI(resourceUrl).normalize();
+ String scheme = resourceUri.getScheme();
+
+ if (scheme == null ||
+ !allowedSchemes.contains(scheme.toLowerCase(Locale.ROOT))) {
+ log.warn("Illegal scheme requested for ORE resource: {}", resourceUri);
+ return false;
+ }
+
+ if (configurationService.getBooleanProperty("oai.harvester.ore.file.validateUrlPrefix", false)) {
+ for (String allowedPrefix : configurationService
+ .getArrayProperty("oai.harvester.ore.file.allowedUrlPrefix")) {
+ URI allowedUri = new URI(allowedPrefix).normalize();
+ // Return true on the first allowed prefix match
+ if (Objects.equals(resourceUri.getScheme(), allowedUri.getScheme())
+ && Objects.equals(resourceUri.getHost().toLowerCase(Locale.ROOT),
+ allowedUri.getHost().toLowerCase(Locale.ROOT))) {
+ return true;
+ }
+ }
+
+ // If no allowed prefixes were matched, we require scheme + host to match the remote OAI server
+ if (!Objects.equals(entryUri.getScheme(), resourceUri.getScheme())) {
+ log.warn("Illegal scheme requested for ORE resource: {}", resourceUri);
+ return false;
+ }
+ if (!Objects.equals(
+ entryUri.getHost().toLowerCase(Locale.ROOT),
+ resourceUri.getHost().toLowerCase(Locale.ROOT))) {
+ log.warn("Illegal host requested for ORE resource: {}", resourceUri);
+ return false;
+ }
+ }
+
+ return true;
+
+ } catch (URISyntaxException e) {
+ log.warn("Could not validate ORE resource URI: {}", resourceUrl);
+ return false;
+ }
+ }
+
}
diff --git a/dspace-api/src/main/java/org/dspace/content/crosswalk/PREMISCrosswalk.java b/dspace-api/src/main/java/org/dspace/content/crosswalk/PREMISCrosswalk.java
index 39b6c8f29c80..6b6c0fd7c5a4 100644
--- a/dspace-api/src/main/java/org/dspace/content/crosswalk/PREMISCrosswalk.java
+++ b/dspace-api/src/main/java/org/dspace/content/crosswalk/PREMISCrosswalk.java
@@ -20,9 +20,7 @@
import org.dspace.authorize.AuthorizeException;
import org.dspace.content.Bitstream;
import org.dspace.content.BitstreamFormat;
-import org.dspace.content.Bundle;
import org.dspace.content.DSpaceObject;
-import org.dspace.content.Item;
import org.dspace.content.factory.ContentServiceFactory;
import org.dspace.content.service.BitstreamFormatService;
import org.dspace.content.service.BitstreamService;
@@ -224,29 +222,17 @@ public Element disseminateElement(Context context, DSpaceObject dso)
// c. made-up name based on sequence ID and extension.
String sid = String.valueOf(bitstream.getSequenceID());
String baseUrl = configurationService.getProperty("dspace.ui.url");
- String handle = null;
- // get handle of parent Item of this bitstream, if there is one:
- List bn = bitstream.getBundles();
- if (bn.size() > 0) {
- List- bi = bn.get(0).getItems();
- if (bi.size() > 0) {
- handle = bi.get(0).getHandle();
- }
- }
// get or make up name for bitstream:
String bsName = bitstream.getName();
if (bsName == null) {
List ext = bitstream.getFormat(context).getExtensions();
bsName = "bitstream_" + sid + (ext.size() > 0 ? ext.get(0) : "");
}
- if (handle != null && baseUrl != null) {
+ if (baseUrl != null) {
oiv.setText(baseUrl
- + "/bitstream/"
- + URLEncoder.encode(handle, "UTF-8")
- + "/"
- + sid
- + "/"
- + URLEncoder.encode(bsName, "UTF-8"));
+ + "/bitstreams/"
+ + bitstream.getID()
+ + "/download");
} else {
oiv.setText(URLEncoder.encode(bsName, "UTF-8"));
}
diff --git a/dspace-api/src/main/java/org/dspace/content/dao/BundleDAO.java b/dspace-api/src/main/java/org/dspace/content/dao/BundleDAO.java
index da7435d46643..99abd84eabc9 100644
--- a/dspace-api/src/main/java/org/dspace/content/dao/BundleDAO.java
+++ b/dspace-api/src/main/java/org/dspace/content/dao/BundleDAO.java
@@ -22,4 +22,6 @@
*/
public interface BundleDAO extends DSpaceObjectLegacySupportDAO {
int countRows(Context context) throws SQLException;
+
+ int countBitstreams(Context context, Bundle bundle) throws SQLException;
}
diff --git a/dspace-api/src/main/java/org/dspace/content/dao/CollectionDAO.java b/dspace-api/src/main/java/org/dspace/content/dao/CollectionDAO.java
index 6bb65bbb46d8..13bcf5f52c02 100644
--- a/dspace-api/src/main/java/org/dspace/content/dao/CollectionDAO.java
+++ b/dspace-api/src/main/java/org/dspace/content/dao/CollectionDAO.java
@@ -48,6 +48,18 @@ public List findAll(Context context, MetadataField order, Integer li
List findAuthorizedByGroup(Context context, EPerson ePerson, List actions) throws SQLException;
+ /**
+ * Get all authorized collections of the current EPerson
+ *
+ * @param context DSpace context object
+ * @param ePerson the current EPerson
+ * @param actions list of actionsID ADD, READ, etc.
+ * @return the collections the eperson is defined
+ * @throws SQLException if database error
+ */
+ List findAuthorizedByEPerson(Context context, EPerson ePerson, List actions)
+ throws SQLException;
+
List findCollectionsWithSubscribers(Context context) throws SQLException;
int countRows(Context context) throws SQLException;
diff --git a/dspace-api/src/main/java/org/dspace/content/dao/impl/BitstreamDAOImpl.java b/dspace-api/src/main/java/org/dspace/content/dao/impl/BitstreamDAOImpl.java
index 25f102f6def4..66a775e39d80 100644
--- a/dspace-api/src/main/java/org/dspace/content/dao/impl/BitstreamDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/dao/impl/BitstreamDAOImpl.java
@@ -178,7 +178,7 @@ public int countDeleted(Context context) throws SQLException {
@Override
public int countWithNoPolicy(Context context) throws SQLException {
Query query = createQuery(context,
- "SELECT count(bit.id) from Bitstream bit where bit.deleted<>true and bit.id not in" +
+ "SELECT count(bit.id) from Bitstream bit where bit.deleted<>true and bit not in" +
" (select res.dSpaceObject from ResourcePolicy res where res.resourceTypeId = " +
":typeId )");
query.setParameter("typeId", Constants.BITSTREAM);
diff --git a/dspace-api/src/main/java/org/dspace/content/dao/impl/BundleDAOImpl.java b/dspace-api/src/main/java/org/dspace/content/dao/impl/BundleDAOImpl.java
index 991636108495..ded13687aa7d 100644
--- a/dspace-api/src/main/java/org/dspace/content/dao/impl/BundleDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/dao/impl/BundleDAOImpl.java
@@ -9,6 +9,7 @@
import java.sql.SQLException;
+import jakarta.persistence.Query;
import org.dspace.content.Bundle;
import org.dspace.content.dao.BundleDAO;
import org.dspace.core.AbstractHibernateDSODAO;
@@ -31,4 +32,13 @@ protected BundleDAOImpl() {
public int countRows(Context context) throws SQLException {
return count(createQuery(context, "SELECT count(*) from Bundle"));
}
+
+ @Override
+ public int countBitstreams(Context context, Bundle bundle) throws SQLException {
+ Query query = createQuery(
+ context, "SELECT count(bi.id) from Bundle bu join bu.bitstreams bi where bu.id = :bundleID"
+ );
+ query.setParameter("bundleID", bundle.getID());
+ return count(query);
+ }
}
diff --git a/dspace-api/src/main/java/org/dspace/content/dao/impl/CollectionDAOImpl.java b/dspace-api/src/main/java/org/dspace/content/dao/impl/CollectionDAOImpl.java
index 841da319f0b2..e47b1ed4a02b 100644
--- a/dspace-api/src/main/java/org/dspace/content/dao/impl/CollectionDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/dao/impl/CollectionDAOImpl.java
@@ -10,8 +10,13 @@
import java.sql.SQLException;
import java.util.AbstractMap;
import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.LinkedList;
import java.util.List;
import java.util.Map;
+import java.util.Queue;
+import java.util.Set;
+import java.util.UUID;
import jakarta.persistence.Query;
import jakarta.persistence.criteria.CriteriaBuilder;
@@ -19,6 +24,7 @@
import jakarta.persistence.criteria.Join;
import jakarta.persistence.criteria.Predicate;
import jakarta.persistence.criteria.Root;
+import org.apache.logging.log4j.Logger;
import org.dspace.authorize.ResourcePolicy;
import org.dspace.authorize.ResourcePolicy_;
import org.dspace.content.Collection;
@@ -40,6 +46,11 @@
* @author kevinvandevelde at atmire.com
*/
public class CollectionDAOImpl extends AbstractHibernateDSODAO implements CollectionDAO {
+ /**
+ * log4j logger
+ */
+ private static Logger log = org.apache.logging.log4j.LogManager.getLogger(CollectionDAOImpl.class);
+
protected CollectionDAOImpl() {
super();
}
@@ -157,9 +168,103 @@ public List findAuthorizedByGroup(Context context, EPerson ePerson,
}
+ /**
+ * Get all authorized collections of the current EPerson
+ *
+ * @param context DSpace context object
+ * @param ePerson the current EPerson
+ * @param actions list of actionsID ADD, READ, etc.
+ * @return the collections the eperson is defined
+ * @throws SQLException if database error
+ */
+ @Override
+ public List findAuthorizedByEPerson(Context context, EPerson ePerson, List actions)
+ throws SQLException {
+
+ //NOTE steps 1) and 2) removes the need of WITH RECURSIVE and a NativeQuery
+
+ // 1) Get all groups a eperson belongs
+ /*ArrayList<>(ePerson.getGroups()) - This ensures you have a concrete copy and can modify it safely.
+ instead if List directGroups = ePerson.getGroups();
+ Also - Can be done using this query:
+ List directGroups = createQuery(context, """
+ SELECT g
+ FROM Group g
+ JOIN g.epeople e
+ WHERE e.id = :epersonId
+ """)
+ .setParameter("epersonId", ePerson.getID())
+ .getResultList();
+ */
+ List directGroups = new ArrayList<>(ePerson.getGroups()); // direct membership
+
+ // 2) Expand hierarquy of groups in memory (recursively)
+ Set allGroups = new HashSet<>(directGroups);
+ Queue queue = new LinkedList<>(directGroups);
+
+ /*
+ * Using the query avoids the change of the getParentGroups visibility in Group
+ * The List parents = current.getParentGroups() could be achieved using:
+ * List parents = createQuery(context,"""
+ SELECT g
+ FROM Group g
+ JOIN g.groups child
+ WHERE child = :child
+ """)
+ */
+ // //current.getMemberGroups()- Making public getParentGroups in Group Class (why it isn't already public?)
+ while (!queue.isEmpty()) {
+ Group current = queue.poll();
+ List parents = current.getParentGroups();
+
+ for (Group parent : parents) {
+ if (allGroups.add(parent)) {
+ queue.add(parent);
+ }
+ }
+ }
+
+ CriteriaBuilder cb = getCriteriaBuilder(context);
+ CriteriaQuery cq = getCriteriaQuery(cb, Collection.class);
+ Root collectionRoot = cq.from(Collection.class);
+
+ // Join to ResourcePolicy using metamodel
+ Join rpJoin = collectionRoot.join("resourcePolicies");
+ // Use metamodel for typesafe access
+ cq.select(collectionRoot).distinct(true);
+
+ List predicates = new ArrayList<>(actions.size());
+ // WHERE rp.resourceTypeId = :resourceType
+ predicates.add(cb.equal(rpJoin.get(ResourcePolicy_.resourceTypeId), Constants.COLLECTION));
+ // AND (:hasActions = false OR rp.actionId IN :actionIds)
+ if (actions != null && !actions.isEmpty()) {
+ predicates.add(rpJoin.get(ResourcePolicy_.actionId).in(actions));
+ }
+
+ // AND (rp.eperson.id = :epersonId OR (:hasGroups = true AND rp.epersonGroup.id IN :groupIds))
+ Predicate epersonPredicate = cb.equal(
+ rpJoin.get(ResourcePolicy_.eperson), ePerson
+ );
+ // Using only groups instead of groupsIDs
+ Predicate groupPredicate = cb.disjunction(); // false by default
+ if (allGroups != null && !allGroups.isEmpty()) {
+ groupPredicate = rpJoin.get(ResourcePolicy_.epersonGroup).in(allGroups);
+ }
+
+ // Combine access condition
+ Predicate accessPredicate = cb.or(epersonPredicate, groupPredicate);
+ predicates.add(accessPredicate);
+
+ // Apply WHERE clause
+ cq.where(cb.and(predicates.toArray(new Predicate[0])));
+
+ // Execute
+ return list(context, cq, true, Collection.class, -1, -1);
+ }
+
@Override
public List findCollectionsWithSubscribers(Context context) throws SQLException {
- return list(createQuery(context, "SELECT DISTINCT c FROM Collection c JOIN Subscription s ON c.id = " +
+ return list(createQuery(context, "SELECT DISTINCT c FROM Collection c JOIN Subscription s ON c = " +
"s.dSpaceObject"));
}
@@ -172,15 +277,26 @@ public int countRows(Context context) throws SQLException {
@SuppressWarnings("unchecked")
public List> getCollectionsWithBitstreamSizesTotal(Context context)
throws SQLException {
- String q = "select col as collection, sum(bit.sizeBytes) as totalBytes from Item i join i.collections col " +
- "join i.bundles bun join bun.bitstreams bit group by col";
+ String q = "select col.id, sum(bit.sizeBytes) as totalBytes from Item i join i.collections col " +
+ "join i.bundles bun join bun.bitstreams bit group by col.id";
Query query = createQuery(context, q);
+ CriteriaBuilder criteriaBuilder = getCriteriaBuilder(context);
+
List list = query.getResultList();
List> returnList = new ArrayList<>(list.size());
for (Object[] o : list) {
- returnList.add(new AbstractMap.SimpleEntry<>((Collection) o[0], (Long) o[1]));
+ CriteriaQuery criteriaQuery = criteriaBuilder.createQuery(Collection.class);
+ Root collectionRoot = criteriaQuery.from(Collection.class);
+ criteriaQuery.select(collectionRoot).where(criteriaBuilder.equal(collectionRoot.get("id"), (UUID) o[0]));
+ Query collectionQuery = createQuery(context, criteriaQuery);
+ Collection collection = (Collection) collectionQuery.getSingleResult();
+ if (collection != null) {
+ returnList.add(new AbstractMap.SimpleEntry<>(collection, (Long) o[1]));
+ } else {
+ log.warn("Unable to find Collection with UUID: {}", o[0]);
+ }
}
return returnList;
}
-}
\ No newline at end of file
+}
diff --git a/dspace-api/src/main/java/org/dspace/content/dao/impl/EntityTypeDAOImpl.java b/dspace-api/src/main/java/org/dspace/content/dao/impl/EntityTypeDAOImpl.java
index 32af7ed35c31..8bbbbf4996f5 100644
--- a/dspace-api/src/main/java/org/dspace/content/dao/impl/EntityTypeDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/dao/impl/EntityTypeDAOImpl.java
@@ -53,7 +53,7 @@ public List getEntityTypesByNames(Context context, List name
orderList.add(criteriaBuilder.desc(entityTypeRoot.get(EntityType_.label)));
criteriaQuery.select(entityTypeRoot).orderBy(orderList);
criteriaQuery.where(entityTypeRoot.get(EntityType_.LABEL).in(names));
- return list(context, criteriaQuery, false, EntityType.class, limit, offset);
+ return list(context, criteriaQuery, true, EntityType.class, limit, offset);
}
@Override
diff --git a/dspace-api/src/main/java/org/dspace/content/dao/impl/RelationshipTypeDAOImpl.java b/dspace-api/src/main/java/org/dspace/content/dao/impl/RelationshipTypeDAOImpl.java
index 7b0e33fd41d9..0deb5afb0a5e 100644
--- a/dspace-api/src/main/java/org/dspace/content/dao/impl/RelationshipTypeDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/content/dao/impl/RelationshipTypeDAOImpl.java
@@ -46,7 +46,7 @@ public RelationshipType findbyTypesAndTypeName(Context context, EntityType leftT
criteriaBuilder.equal(relationshipTypeRoot.get(RelationshipType_.rightType), rightType),
criteriaBuilder.equal(relationshipTypeRoot.get(RelationshipType_.leftwardType), leftwardType),
criteriaBuilder.equal(relationshipTypeRoot.get(RelationshipType_.rightwardType), rightwardType)));
- return uniqueResult(context, criteriaQuery, false, RelationshipType.class);
+ return uniqueResult(context, criteriaQuery, true, RelationshipType.class);
}
@Override
@@ -96,7 +96,7 @@ public List findByEntityType(Context context, EntityType entit
List orderList = new LinkedList<>();
orderList.add(criteriaBuilder.asc(relationshipTypeRoot.get(RelationshipType_.ID)));
criteriaQuery.orderBy(orderList);
- return list(context, criteriaQuery, false, RelationshipType.class, limit, offset);
+ return list(context, criteriaQuery, true, RelationshipType.class, limit, offset);
}
@Override
@@ -122,7 +122,7 @@ public List findByEntityType(Context context, EntityType entit
criteriaBuilder.equal(relationshipTypeRoot.get(RelationshipType_.rightType), entityType)
);
}
- return list(context, criteriaQuery, false, RelationshipType.class, limit, offset);
+ return list(context, criteriaQuery, true, RelationshipType.class, limit, offset);
}
@Override
diff --git a/dspace-api/src/main/java/org/dspace/content/logic/condition/ReadableByGroupCondition.java b/dspace-api/src/main/java/org/dspace/content/logic/condition/ReadableByGroupCondition.java
index 20138beb47ef..e7b0bb7e046c 100644
--- a/dspace-api/src/main/java/org/dspace/content/logic/condition/ReadableByGroupCondition.java
+++ b/dspace-api/src/main/java/org/dspace/content/logic/condition/ReadableByGroupCondition.java
@@ -49,7 +49,7 @@ public boolean getResult(Context context, Item item) throws LogicalStatementExce
List policies = authorizeService
.getPoliciesActionFilter(context, item, Constants.getActionID(action));
for (ResourcePolicy policy : policies) {
- if (policy.getGroup().getName().equals(group)) {
+ if (policy.getGroup() != null && policy.getGroup().getName().equals(group)) {
return true;
}
}
diff --git a/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSDisseminator.java b/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSDisseminator.java
index fd50ec8023e2..2161a222e1f2 100644
--- a/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSDisseminator.java
+++ b/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSDisseminator.java
@@ -456,17 +456,37 @@ protected void addBitstreamsToZip(Context context, DSpaceObject dso,
// contents are unchanged
ze.setTime(DEFAULT_MODIFIED_DATE);
}
- ze.setSize(auth ? bitstream.getSizeBytes() : 0);
- zip.putNextEntry(ze);
+
+ long bitstreamSize = 0;
+ // If user is authorized to read this bitstream, attempt to retrieve it.
if (auth) {
- InputStream input = bitstreamService.retrieve(context, bitstream);
- Utils.copy(input, zip);
- input.close();
+ try (final InputStream bitstreamInput = bitstreamService.retrieve(context, bitstream)) {
+ // Save bitstream size into Zip entry & put entry in Zip file.
+ bitstreamSize = bitstream.getSizeBytes();
+ ze.setSize(bitstreamSize);
+ zip.putNextEntry(ze);
+
+ // Copy bitstream contents to Zip file
+ Utils.copy(bitstreamInput, zip);
+ } catch (Exception e) {
+ log.warn("Adding zero-length file for Bitstream, uuid={}."
+ + " Bitstream is unable to be retrieved from assetstore."
+ + " Error={}", bitstream.getID(), e.getMessage());
+ }
} else {
- log.warn("Adding zero-length file for Bitstream, uuid="
- + String.valueOf(bitstream.getID())
- + ", not authorized for READ.");
+ log.warn("Adding zero-length file for Bitstream, uuid={}"
+ + ", not authorized for READ.", bitstream.getID());
+ }
+
+ // If bitstreamSize is still zero, that means either we didn't have READ privileges
+ // or the bitstream could not be retrieved from storage. Either way, write a zero-length
+ // file into our Zip entry in place of the bitstream.
+ if (bitstreamSize == 0) {
+ ze.setSize(0);
+ zip.putNextEntry(ze);
}
+
+ // Close our zip entry
zip.closeEntry();
} else if (unauth != null && unauth.equalsIgnoreCase("skip")) {
log.warn("Skipping Bitstream, uuid=" + String
@@ -629,6 +649,13 @@ protected MdSec makeMdSec(Context context, DSpaceObject dso, Class mdSecClass,
ByteArrayOutputStream disseminateOutput = new ByteArrayOutputStream();
sxwalk.disseminate(context, dso, disseminateOutput);
disseminateOutput.close();
+
+ // If our disseminated output has zero size, exit immediately (i.e. return a null mdSec).
+ // Likely, the outputstream failed to be created, so we cannot include it in this package.
+ if (disseminateOutput.size() == 0) {
+ return null;
+ }
+
// Convert output to an inputstream, so we can write to manifest or Zip file
ByteArrayInputStream crosswalkedStream = new ByteArrayInputStream(
disseminateOutput.toByteArray());
diff --git a/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSIngester.java b/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSIngester.java
index 77236be9d525..122f13992087 100644
--- a/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSIngester.java
+++ b/dspace-api/src/main/java/org/dspace/content/packager/AbstractMETSIngester.java
@@ -19,12 +19,16 @@
import java.util.zip.ZipFile;
import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.io.input.NullInputStream;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.logging.log4j.Logger;
import org.dspace.app.client.DSpaceHttpClientFactory;
import org.dspace.authorize.AuthorizeException;
+import org.dspace.authorize.ResourcePolicy;
+import org.dspace.authorize.factory.AuthorizeServiceFactory;
+import org.dspace.authorize.service.AuthorizeService;
import org.dspace.content.Bitstream;
import org.dspace.content.BitstreamFormat;
import org.dspace.content.Bundle;
@@ -127,6 +131,10 @@ public abstract class AbstractMETSIngester extends AbstractPackageIngester {
protected final ConfigurationService configurationService
= DSpaceServicesFactory.getInstance().getConfigurationService();
+
+ protected final AuthorizeService authorizeService = AuthorizeServiceFactory.getInstance().getAuthorizeService();
+
+
/**
*
* An instance of ZipMdrefManager holds the state needed to retrieve the
@@ -498,8 +506,11 @@ protected DSpaceObject ingestObject(Context context, DSpaceObject parent,
// Finish creating the item. This actually assigns the handle,
// and will either install item immediately or start a workflow, based on params
PackageUtils.finishCreateItem(context, wsi, handle, params);
+ } else {
+ // We should have a workspace item during ingest, so this code is only here for safety.
+ // Update the object to make sure all changes are committed
+ PackageUtils.updateDSpaceObject(context, dso);
}
-
} else if (type == Constants.COLLECTION || type == Constants.COMMUNITY) {
// Add logo if one is referenced from manifest
addContainerLogo(context, dso, manifest, pkgFile, params);
@@ -513,6 +524,9 @@ protected DSpaceObject ingestObject(Context context, DSpaceObject parent,
// (this allows subclasses to do some final validation / changes as
// necessary)
finishObject(context, dso, params);
+
+ // Update the object to make sure all changes are committed
+ PackageUtils.updateDSpaceObject(context, dso);
} else if (type == Constants.SITE) {
// Do nothing by default -- Crosswalks will handle anything necessary to ingest at Site-level
@@ -520,18 +534,15 @@ protected DSpaceObject ingestObject(Context context, DSpaceObject parent,
// (this allows subclasses to do some final validation / changes as
// necessary)
finishObject(context, dso, params);
+
+ // Update the object to make sure all changes are committed
+ PackageUtils.updateDSpaceObject(context, dso);
} else {
throw new PackageValidationException(
"Unknown DSpace Object type in package, type="
+ String.valueOf(type));
}
- // -- Step 6 --
- // Finish things up!
-
- // Update the object to make sure all changes are committed
- PackageUtils.updateDSpaceObject(context, dso);
-
return dso;
}
@@ -738,6 +749,14 @@ protected void addBitstreams(Context context, Item item,
// externally, if it is an externally referenced file)
InputStream fileStream = getFileInputStream(pkgFile, params, path);
+ // Before proceeding we must ensure we have a non-empty input stream
+ // NOTE: If getFileInputStream encounters a zero-sized file, then it returns NullInputStream
+ if (fileStream == null || fileStream instanceof NullInputStream) {
+ log.warn("Empty InputStream encountered for Bitstream with ID={} in zip file={}. " +
+ "Skipping adding this empty bitstream to Item={}", mfileID, pkgFile, item.getID());
+ continue;
+ }
+
// retrieve bundle name from manifest
String bundleName = METSManifest.getBundleName(mfile);
@@ -760,11 +779,24 @@ protected void addBitstreams(Context context, Item item,
bitstream.setSequenceID(Integer.parseInt(seqID));
}
+ // Get TYPE_SUBMISSION policies before removing them in the `manifest.crosswalkBitstream` method.
+ List bitstreamPolicies =
+ authorizeService.findPoliciesByDSOAndType(context, bitstream, ResourcePolicy.TYPE_SUBMISSION);
+
// crosswalk this bitstream's administrative metadata located in
// METS manifest (or referenced externally)
manifest.crosswalkBitstream(context, params, bitstream, mfileID,
mdRefCallback);
+ // Only add the saved TYPE_SUBMISSION policies if the crosswalk actually removed them to prevent duplicates.
+ if (!bitstreamPolicies.isEmpty()) {
+ List remainingSubmissionPolicies =
+ authorizeService.findPoliciesByDSOAndType(context, bitstream, ResourcePolicy.TYPE_SUBMISSION);
+ if (remainingSubmissionPolicies.isEmpty()) {
+ authorizeService.addPolicies(context, bitstreamPolicies, bitstream);
+ }
+ }
+
// is this the primary bitstream?
if (primaryID != null && mfileID.equals(primaryID)) {
bundle.setPrimaryBitstreamID(bitstream);
@@ -1301,7 +1333,7 @@ public String getObjectHandle(METSManifest manifest)
* zip)
* @param params Parameters passed to METSIngester
* @param path the File path (either path in Zip package or a URL)
- * @return the InputStream for the file
+ * @return the InputStream for the file, or NullInputStream if a zero-sized entry is encountered
* @throws MetadataValidationException if validation error
* @throws IOException if IO error
*/
@@ -1334,12 +1366,13 @@ protected static InputStream getFileInputStream(File pkgFile,
// Retrieve the manifest file entry by name
ZipEntry manifestEntry = zipPackage.getEntry(path);
- // Get inputStream associated with this file
- if (manifestEntry != null) {
+ if (manifestEntry.getSize() > 0) {
+ // Get inputStream associated with this file
return zipPackage.getInputStream(manifestEntry);
} else {
- throw new MetadataValidationException("Manifest file references file '"
- + path + "' not included in the zip.");
+ log.warn("Zero-sized file entry={} found in zip file={}. Returning empty InputStream.",
+ path, pkgFile);
+ return new NullInputStream();
}
}
}
diff --git a/dspace-api/src/main/java/org/dspace/content/packager/RoleDisseminator.java b/dspace-api/src/main/java/org/dspace/content/packager/RoleDisseminator.java
index 15e9f1b14494..48901b5ce5c4 100644
--- a/dspace-api/src/main/java/org/dspace/content/packager/RoleDisseminator.java
+++ b/dspace-api/src/main/java/org/dspace/content/packager/RoleDisseminator.java
@@ -310,8 +310,8 @@ protected void writeGroup(Context context, DSpaceObject relatedObject, Group gro
for (EPerson member : group.getMembers()) {
writer.writeEmptyElement(MEMBER);
writer.writeAttribute(ID, String.valueOf(member.getID()));
- if (null != member.getName()) {
- writer.writeAttribute(NAME, member.getName());
+ if (null != member.getEmail()) {
+ writer.writeAttribute(NAME, member.getEmail());
}
}
writer.writeEndElement();
diff --git a/dspace-api/src/main/java/org/dspace/content/service/BundleService.java b/dspace-api/src/main/java/org/dspace/content/service/BundleService.java
index 10d6613b2a22..31e0d79f4907 100644
--- a/dspace-api/src/main/java/org/dspace/content/service/BundleService.java
+++ b/dspace-api/src/main/java/org/dspace/content/service/BundleService.java
@@ -146,4 +146,12 @@ public void moveBitstreamToBundle(Context context, Bundle targetBundle, Bitstre
public void setOrder(Context context, Bundle bundle, UUID bitstreamIds[]) throws AuthorizeException, SQLException;
int countTotal(Context context) throws SQLException;
+
+ /**
+ * Returns the count of bitstreams for the given bundle, performance optimized.
+ *
+ * @param context DSpace Context
+ * @param bundle the bitstream bundle
+ */
+ int countBitstreams(Context context, Bundle bundle) throws SQLException;
}
diff --git a/dspace-api/src/main/java/org/dspace/content/service/CollectionService.java b/dspace-api/src/main/java/org/dspace/content/service/CollectionService.java
index 3a865d9d63fd..5e81488bf1ce 100644
--- a/dspace-api/src/main/java/org/dspace/content/service/CollectionService.java
+++ b/dspace-api/src/main/java/org/dspace/content/service/CollectionService.java
@@ -327,6 +327,18 @@ public void canEdit(Context context, Collection collection, boolean useInheritan
public List findAuthorized(Context context, Community community, int actionID)
throws java.sql.SQLException;
+ /**
+ * return an array of collections that user has a given permission on
+ *
+ * @param context DSpace Context
+ * @param community (optional) restrict search to a community, else null
+ * @param actions Listo of the of the action ADD, READ, ADMIN, etc.
+ * @return Collection [] of collections with matching permissions
+ * @throws SQLException if database error
+ */
+ public List findAuthorized(Context context, Community community, List actions)
+ throws java.sql.SQLException;
+
/**
*
* @param context DSpace Context
@@ -379,11 +391,11 @@ Group createDefaultReadGroup(Context context, Collection collection, String type
* NOTE: for better performance, this method retrieves its results from an
* index (cache) and does not query the database directly.
* This means that results may be stale or outdated until https://github.com/DSpace/DSpace/issues/2853 is resolved"
- *
+ *
+ * @param context DSpace Context
* @param q limit the returned collection to those with metadata values matching the query terms.
* The terms are used to make also a prefix query on SOLR so it can be used to implement
* an autosuggest feature over the collection name
- * @param context DSpace Context
* @param community parent community
* @param entityType limit the returned collection to those related to given entity type
* @param offset the position of the first result to return
@@ -392,7 +404,7 @@ Group createDefaultReadGroup(Context context, Collection collection, String type
* @throws SQLException if something goes wrong
* @throws SearchServiceException if search error
*/
- public List findCollectionsWithSubmit(String q, Context context, Community community,
+ public List findCollectionsWithSubmit(Context context, String q, Community community,
String entityType, int offset, int limit) throws SQLException, SearchServiceException;
/**
@@ -410,11 +422,10 @@ public List findCollectionsWithSubmit(String q, Context context, Com
* @param offset the position of the first result to return
* @param limit paging limit
* @return discovery search result objects
- * @throws SQLException if something goes wrong
* @throws SearchServiceException if search error
*/
public List findCollectionsWithSubmit(String q, Context context, Community community,
- int offset, int limit) throws SQLException, SearchServiceException;
+ int offset, int limit) throws SearchServiceException;
/**
* Retrieve the first collection in the community or its descending that support
@@ -450,17 +461,17 @@ public Collection retrieveCollectionWithSubmitByEntityType(Context context, Item
* and does not query the database directly.
* This means that results may be stale or outdated until
* https://github.com/DSpace/DSpace/issues/2853 is resolved."
- *
+ *
+ * @param context DSpace Context
* @param q limit the returned collection to those with metadata values matching the query terms.
* The terms are used to make also a prefix query on SOLR so it can be used to implement
* an autosuggest feature over the collection name
- * @param context DSpace Context
* @param community parent community
* @return total collections found
* @throws SQLException if something goes wrong
* @throws SearchServiceException if search error
*/
- public int countCollectionsWithSubmit(String q, Context context, Community community)
+ public int countCollectionsWithSubmit(Context context, String q, Community community)
throws SQLException, SearchServiceException;
/**
@@ -469,18 +480,18 @@ public int countCollectionsWithSubmit(String q, Context context, Community commu
* and does not query the database directly.
* This means that results may be stale or outdated until
* https://github.com/DSpace/DSpace/issues/2853 is resolved."
- *
+ *
+ * @param context DSpace Context
* @param q limit the returned collection to those with metadata values matching the query terms.
* The terms are used to make also a prefix query on SOLR so it can be used to implement
* an autosuggest feature over the collection name
- * @param context DSpace Context
* @param community parent community
* @param entityType limit the returned collection to those related to given entity type
* @return total collections found
* @throws SQLException if something goes wrong
* @throws SearchServiceException if search error
*/
- public int countCollectionsWithSubmit(String q, Context context, Community community, String entityType)
+ public int countCollectionsWithSubmit(Context context, String q, Community community, String entityType)
throws SQLException, SearchServiceException;
/**
diff --git a/dspace-api/src/main/java/org/dspace/content/service/ItemService.java b/dspace-api/src/main/java/org/dspace/content/service/ItemService.java
index 3fea75665bcb..7c202a4837f3 100644
--- a/dspace-api/src/main/java/org/dspace/content/service/ItemService.java
+++ b/dspace-api/src/main/java/org/dspace/content/service/ItemService.java
@@ -915,23 +915,23 @@ Iterator- findByLastModifiedSince(Context context, Date last)
/**
* finds all items for which the current user has editing rights
* @param context DSpace context object
+ * @param q search query
* @param offset page offset
* @param limit page size limit
* @return list of items for which the current user has editing rights
- * @throws SQLException
* @throws SearchServiceException
*/
- List
- findItemsWithEdit(Context context, int offset, int limit)
- throws SQLException, SearchServiceException;
+ List
- findItemsWithEdit(Context context, String q, int offset, int limit)
+ throws SearchServiceException;
/**
* counts all items for which the current user has editing rights
* @param context DSpace context object
+ * @param q search query
* @return list of items for which the current user has editing rights
- * @throws SQLException
* @throws SearchServiceException
*/
- int countItemsWithEdit(Context context) throws SQLException, SearchServiceException;
+ int countItemsWithEdit(Context context, String q) throws SearchServiceException;
/**
* Check if the supplied item is an inprogress submission
diff --git a/dspace-api/src/main/java/org/dspace/core/AbstractHibernateDAO.java b/dspace-api/src/main/java/org/dspace/core/AbstractHibernateDAO.java
index 3658a3c92305..e5e5c5c44a7a 100644
--- a/dspace-api/src/main/java/org/dspace/core/AbstractHibernateDAO.java
+++ b/dspace-api/src/main/java/org/dspace/core/AbstractHibernateDAO.java
@@ -468,6 +468,9 @@ public List findByX(Context context, Class clazz, Map equals,
for (Map.Entry entry : equals.entrySet()) {
criteria.where(criteriaBuilder.equal(root.get(entry.getKey()), entry.getValue()));
}
+
+ criteria.orderBy(criteriaBuilder.asc(root.get("id")));
+
return executeCriteriaQuery(context, criteria, cacheable, maxResults, offset);
}
diff --git a/dspace-api/src/main/java/org/dspace/core/Email.java b/dspace-api/src/main/java/org/dspace/core/Email.java
index 74a48b3d82c9..f25c5b2a795a 100644
--- a/dspace-api/src/main/java/org/dspace/core/Email.java
+++ b/dspace-api/src/main/java/org/dspace/core/Email.java
@@ -22,7 +22,6 @@
import java.util.Date;
import java.util.Enumeration;
import java.util.List;
-import java.util.Properties;
import jakarta.activation.DataHandler;
import jakarta.activation.DataSource;
@@ -44,18 +43,16 @@
import org.apache.logging.log4j.Logger;
import org.apache.velocity.Template;
import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.Velocity;
import org.apache.velocity.app.VelocityEngine;
import org.apache.velocity.exception.MethodInvocationException;
import org.apache.velocity.exception.ParseErrorException;
import org.apache.velocity.exception.ResourceNotFoundException;
-import org.apache.velocity.runtime.resource.loader.StringResourceLoader;
import org.apache.velocity.runtime.resource.util.StringResourceRepository;
import org.dspace.services.ConfigurationService;
import org.dspace.services.factory.DSpaceServicesFactory;
/**
- * Builder representing an e-mail message. The {@link send} method causes the
+ * Builder representing an e-mail message. The {@link #send} method causes the
* assembled message to be formatted and sent.
*
* Typical use:
@@ -72,7 +69,7 @@
* Apache Velocity. They may contain VTL directives and property
* placeholders.
*
- * {@link addArgument(string)} adds a property to the {@code params} array
+ * {@link #addArgument(Object)} adds a property to the {@code params} array
* in the Velocity context, which can be used to replace placeholder tokens
* in the message. These arguments are indexed by number in the order they were
* added to the message.
@@ -80,9 +77,9 @@
* The DSpace configuration properties are also available to templates as the
* array {@code config}, indexed by name. Example: {@code ${config.get('dspace.name')}}
*
- * Recipients and attachments may be added as needed. See {@link addRecipient},
- * {@link addAttachment(File, String)}, and
- * {@link addAttachment(InputStream, String, String)}.
+ * Recipients and attachments may be added as needed. See {@link #addRecipient},
+ * {@link #addAttachment(File, String)}, and
+ * {@link #addAttachment(InputStream, String, String)}.
*
* Headers such as Subject may be supplied by the template, by defining them
* using the VTL directive {@code #set()}. Only headers named in the DSpace
@@ -125,8 +122,8 @@
*
*
* There are two ways to load a message body. One can create an instance of
- * {@link Email} and call {@link setContent} on it, passing the body as a String. Or
- * one can use the static factory method {@link getEmail} to load a file by its
+ * {@link Email} and call {@link #setContent} on it, passing the body as a String. Or
+ * one can use the static factory method {@link #getEmail} to load a file by its
* complete filesystem path. In either case the text will be loaded into a
* Velocity template.
*
@@ -175,18 +172,6 @@ public class Email {
/** Velocity template settings. */
private static final String RESOURCE_REPOSITORY_NAME = "Email";
- private static final Properties VELOCITY_PROPERTIES = new Properties();
- static {
- VELOCITY_PROPERTIES.put(Velocity.RESOURCE_LOADERS, "string");
- VELOCITY_PROPERTIES.put("resource.loader.string.description",
- "Velocity StringResource loader");
- VELOCITY_PROPERTIES.put("resource.loader.string.class",
- StringResourceLoader.class.getName());
- VELOCITY_PROPERTIES.put("resource.loader.string.repository.name",
- RESOURCE_REPOSITORY_NAME);
- VELOCITY_PROPERTIES.put("resource.loader.string.repository.static",
- "false");
- }
/** Velocity template for a message body */
private Template template;
@@ -208,6 +193,13 @@ public Email() {
charset = null;
}
+ /**
+ * Get configuration service
+ */
+ private static ConfigurationService getConfigurationService() {
+ return DSpaceServicesFactory.getInstance().getConfigurationService();
+ }
+
/**
* Add a recipient.
*
@@ -230,7 +222,7 @@ public void setContent(String name, String content) {
arguments.clear();
VelocityEngine templateEngine = new VelocityEngine();
- templateEngine.init(VELOCITY_PROPERTIES);
+ templateEngine.init(Utils.getSecureVelocityProperties(RESOURCE_REPOSITORY_NAME));
StringResourceRepository repo = (StringResourceRepository)
templateEngine.getApplicationAttribute(RESOURCE_REPOSITORY_NAME);
@@ -347,10 +339,7 @@ public void reset() {
*/
public void send() throws MessagingException, IOException {
build();
-
- ConfigurationService config
- = DSpaceServicesFactory.getInstance().getConfigurationService();
- boolean disabled = config.getBooleanProperty("mail.server.disabled", false);
+ boolean disabled = getConfigurationService().getBooleanProperty("mail.server.disabled", false);
if (disabled) {
LOG.info(format(message, body));
} else {
@@ -364,7 +353,7 @@ public void send() throws MessagingException, IOException {
* {@code mail.message.headers} then that name and its value will be added
* to the message's headers.
*
- *
"subject" is treated specially: if {@link setSubject()} has not been
+ *
"subject" is treated specially: if {@link #setSubject} has not been
* called, the value of any "subject" property will be used as if setSubject
* had been called with that value. Thus a template may define its subject,
* but the caller may override it.
@@ -379,15 +368,12 @@ void build()
throw new MessagingException("Email has no body");
}
- ConfigurationService config
- = DSpaceServicesFactory.getInstance().getConfigurationService();
-
// Get the mail configuration properties
- String from = config.getProperty("mail.from.address");
+ String from = getConfigurationService().getProperty("mail.from.address");
// If no character set specified, attempt to retrieve a default
if (charset == null) {
- charset = config.getProperty("mail.charset");
+ charset = getConfigurationService().getProperty("mail.charset");
}
// Get session
@@ -402,11 +388,13 @@ void build()
new InternetAddress(recipient));
}
// Get headers defined by the template.
- String[] templateHeaders = config.getArrayProperty("mail.message.headers");
+ String[] templateHeaders = getConfigurationService().getArrayProperty("mail.message.headers");
// Format the mail message body
VelocityContext vctx = new VelocityContext();
- vctx.put("config", new UnmodifiableConfigurationService(config));
+ // Pass a restricted (via configuration) list of resolved Configuration keys and values, for
+ // template lookup
+ vctx.put("config", Utils.getAllowedTemplateConfig());
vctx.put("params", Collections.unmodifiableList(arguments));
StringWriter writer = new StringWriter();
@@ -584,12 +572,10 @@ public static Email getEmail(String emailFile)
* message is sent.
*/
public static void main(String[] args) {
- ConfigurationService config
- = DSpaceServicesFactory.getInstance().getConfigurationService();
- String to = config.getProperty("mail.admin");
+ String to = getConfigurationService().getProperty("mail.admin");
String subject = "DSpace test email";
- String server = config.getProperty("mail.server");
- String url = config.getProperty("dspace.ui.url");
+ String server = getConfigurationService().getProperty("mail.server");
+ String url = getConfigurationService().getProperty("dspace.ui.url");
Email message;
try {
if (args.length <= 0) {
@@ -607,7 +593,7 @@ public static void main(String[] args) {
System.out.println(" - To: " + to);
System.out.println(" - Subject: " + subject);
System.out.println(" - Server: " + server);
- boolean disabled = config.getBooleanProperty("mail.server.disabled", false);
+ boolean disabled = getConfigurationService().getBooleanProperty("mail.server.disabled", false);
if (disabled) {
System.err.println("\nError sending email:");
System.err.println(" - Error: cannot test email because mail.server.disabled is set to true");
@@ -709,31 +695,4 @@ public OutputStream getOutputStream() throws IOException {
throw new IOException("Cannot write to this read-only resource");
}
}
-
- /**
- * Wrap ConfigurationService to prevent templates from modifying
- * the configuration.
- */
- public static class UnmodifiableConfigurationService {
- private final ConfigurationService configurationService;
-
- /**
- * Swallow an instance of ConfigurationService.
- *
- * @param cs the real instance, to be wrapped.
- */
- public UnmodifiableConfigurationService(ConfigurationService cs) {
- configurationService = cs;
- }
-
- /**
- * Look up a key in the actual ConfigurationService.
- *
- * @param key to be looked up in the DSpace configuration.
- * @return whatever value ConfigurationService associates with {@code key}.
- */
- public String get(String key) {
- return configurationService.getProperty(key);
- }
- }
}
diff --git a/dspace-api/src/main/java/org/dspace/core/LDN.java b/dspace-api/src/main/java/org/dspace/core/LDN.java
index 8ae5cddf5b4a..19be26c586c9 100644
--- a/dspace-api/src/main/java/org/dspace/core/LDN.java
+++ b/dspace-api/src/main/java/org/dspace/core/LDN.java
@@ -10,15 +10,15 @@
import static org.apache.commons.lang3.StringUtils.EMPTY;
import java.io.BufferedReader;
-import java.io.FileInputStream;
+import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.StringWriter;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.Collections;
import java.util.List;
-import java.util.Properties;
import jakarta.mail.MessagingException;
import org.apache.commons.lang3.StringUtils;
@@ -26,15 +26,14 @@
import org.apache.logging.log4j.Logger;
import org.apache.velocity.Template;
import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.Velocity;
import org.apache.velocity.app.VelocityEngine;
import org.apache.velocity.exception.MethodInvocationException;
import org.apache.velocity.exception.ParseErrorException;
import org.apache.velocity.exception.ResourceNotFoundException;
-import org.apache.velocity.runtime.resource.loader.StringResourceLoader;
import org.apache.velocity.runtime.resource.util.StringResourceRepository;
import org.dspace.services.ConfigurationService;
import org.dspace.services.factory.DSpaceServicesFactory;
+import org.dspace.storage.secure.SecureFileAccess;
/**
* Class representing an LDN message json
@@ -57,22 +56,17 @@ public class LDN {
/** Velocity template settings. */
private static final String RESOURCE_REPOSITORY_NAME = "LDN";
- private static final Properties VELOCITY_PROPERTIES = new Properties();
- static {
- VELOCITY_PROPERTIES.put(Velocity.RESOURCE_LOADERS, "string");
- VELOCITY_PROPERTIES.put("resource.loader.string.description",
- "Velocity StringResource loader");
- VELOCITY_PROPERTIES.put("resource.loader.string.class",
- StringResourceLoader.class.getName());
- VELOCITY_PROPERTIES.put("resource.loader.string.repository.name",
- RESOURCE_REPOSITORY_NAME);
- VELOCITY_PROPERTIES.put("resource.loader.string.repository.static",
- "false");
- }
/** Velocity template for the message*/
private Template template;
+ /** Allowed base directory for LDN messages / templates **/
+ private static final ConfigurationService configurationService =
+ DSpaceServicesFactory.getInstance().getConfigurationService();
+ private static final String dspaceDir = configurationService.getProperty("dspace.dir", "/dspace");
+ private static final String[] DEFAULT_TEMPLATE_PATHS = new String[]{
+ dspaceDir + File.separatorChar + "config" + File.separatorChar + "ldn"};
+
/**
* Create a new ldn message.
*/
@@ -112,14 +106,13 @@ public void addArgument(Object arg) {
* @throws IOException if IO error
*/
public String generateLDNMessage() {
- ConfigurationService config
- = DSpaceServicesFactory.getInstance().getConfigurationService();
-
VelocityEngine templateEngine = new VelocityEngine();
- templateEngine.init(VELOCITY_PROPERTIES);
+ templateEngine.init(Utils.getSecureVelocityProperties(RESOURCE_REPOSITORY_NAME));
VelocityContext vctx = new VelocityContext();
- vctx.put("config", new LDN.UnmodifiableConfigurationService(config));
+ // Pass a restricted (via configuration) list of resolved Configuration keys and values, for
+ // template lookup
+ vctx.put("config", Utils.getAllowedTemplateConfig());
vctx.put("params", Collections.unmodifiableList(arguments));
if (null == template) {
@@ -162,8 +155,16 @@ public String generateLDNMessage() {
public static LDN getLDNMessage(String ldnMessageFile)
throws IOException {
StringBuilder contentBuffer = new StringBuilder();
+ List allowedBasePaths = List.of(
+ Arrays.stream(configurationService
+ .getArrayProperty("ldn.template.path", DEFAULT_TEMPLATE_PATHS))
+ .findFirst()
+ .orElseThrow(() -> new IOException("No LDN template path configured"))
+ );
+ String ldnFilePath = SecureFileAccess.calculateAbsolutePathUsingBaseDir(ldnMessageFile,
+ allowedBasePaths.get(0));
try (
- InputStream is = new FileInputStream(ldnMessageFile);
+ InputStream is = SecureFileAccess.getInputStream(ldnFilePath, allowedBasePaths, "ldn");
InputStreamReader ir = new InputStreamReader(is, "UTF-8");
BufferedReader reader = new BufferedReader(ir);
) {
@@ -182,31 +183,4 @@ public static LDN getLDNMessage(String ldnMessageFile)
ldn.setContent(ldnMessageFile, contentBuffer.toString());
return ldn;
}
-
- /**
- * Wrap ConfigurationService to prevent templates from modifying
- * the configuration.
- */
- public static class UnmodifiableConfigurationService {
- private final ConfigurationService configurationService;
-
- /**
- * Swallow an instance of ConfigurationService.
- *
- * @param cs the real instance, to be wrapped.
- */
- public UnmodifiableConfigurationService(ConfigurationService cs) {
- configurationService = cs;
- }
-
- /**
- * Look up a key in the actual ConfigurationService.
- *
- * @param key to be looked up in the DSpace configuration.
- * @return whatever value ConfigurationService associates with {@code key}.
- */
- public String get(String key) {
- return configurationService.getProperty(key);
- }
- }
}
diff --git a/dspace-api/src/main/java/org/dspace/core/LegacyPluginServiceImpl.java b/dspace-api/src/main/java/org/dspace/core/LegacyPluginServiceImpl.java
index e92ea137f31f..e7c092e75c93 100644
--- a/dspace-api/src/main/java/org/dspace/core/LegacyPluginServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/core/LegacyPluginServiceImpl.java
@@ -17,6 +17,7 @@
import java.util.Iterator;
import java.util.List;
import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
@@ -219,10 +220,10 @@ private Object getAnonymousPlugin(String classname)
// Map of named plugin classes, [intfc,name] -> class
// Also contains intfc -> "marker" to mark when interface has been loaded.
- private final Map namedPluginClasses = new HashMap<>();
+ private final Map namedPluginClasses = new ConcurrentHashMap<>();
// load and cache configuration data for the given interface.
- private void configureNamedPlugin(String iname)
+ private synchronized void configureNamedPlugin(String iname)
throws ClassNotFoundException {
int found = 0;
@@ -307,11 +308,10 @@ private int installNamedConfigs(String iname, String classname, String names[])
int found = 0;
for (int i = 0; i < names.length; ++i) {
String key = iname + SEP + names[i];
- if (namedPluginClasses.containsKey(key)) {
+ String existing = namedPluginClasses.putIfAbsent(key, classname);
+ if (existing != null) {
log.error("Name collision in named plugin, implementation class=\"" + classname +
"\", name=\"" + names[i] + "\"");
- } else {
- namedPluginClasses.put(key, classname);
}
log.debug("Got Named Plugin, intfc=" + iname + ", name=" + names[i] + ", class=" + classname);
++found;
diff --git a/dspace-api/src/main/java/org/dspace/core/Utils.java b/dspace-api/src/main/java/org/dspace/core/Utils.java
index a1294c3317ce..63369528a6e3 100644
--- a/dspace-api/src/main/java/org/dspace/core/Utils.java
+++ b/dspace-api/src/main/java/org/dspace/core/Utils.java
@@ -29,16 +29,23 @@
import java.util.Collections;
import java.util.Date;
import java.util.GregorianCalendar;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Properties;
import java.util.Random;
import java.util.StringTokenizer;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
+import java.util.stream.Collectors;
import com.coverity.security.Escape;
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.text.StringSubstitutor;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
+import org.apache.velocity.app.Velocity;
+import org.apache.velocity.runtime.resource.loader.StringResourceLoader;
import org.dspace.services.ConfigurationService;
import org.dspace.services.factory.DSpaceServicesFactory;
@@ -101,6 +108,11 @@ public final class Utils {
private static final Calendar outCal = GregorianCalendar.getInstance();
+ // Allowed configuration properties to pass to Velocity templates (Email, LDN)
+ private static final String[] DEFAULT_ALLOWED_TEMPLATE_CONFIGS = {
+ "dspace.name", "dspace.shortname", "dspace.ui.url",
+ "mail.helpdesk", "mail.message.helpdesk.telephone", "mail.admin", "mail.admin.name"};
+
/**
* Private constructor
*/
@@ -507,4 +519,63 @@ public static String interpolateConfigsInString(String string) {
return StringSubstitutor.replace(string, config.getProperties());
}
+ /**
+ * Get a list of allowed DSpace configuration property keys that will be exposed to Velocity templates
+ * (used in Email and LDN messages) as a simple Map of strings.
+ * @return Map of strings representing resolved configuration properties
+ */
+ public static Map getAllowedTemplateConfig() {
+ // Pass a restricted (via configuration) list of resolved Configuration keys and values, for
+ // template lookup
+ ConfigurationService configurationService =
+ DSpaceServicesFactory.getInstance().getConfigurationService();
+ List allowedConfigurationKeys = List.of(configurationService.getArrayProperty(
+ "message.templates.allowed-config", DEFAULT_ALLOWED_TEMPLATE_CONFIGS));
+ return allowedConfigurationKeys.stream()
+ .map(key -> {
+ String value = configurationService.getProperty(key);
+ return value != null ? Map.entry(key, value) : null;
+ })
+ .filter(Objects::nonNull)
+ .collect(Collectors.toMap(
+ Map.Entry::getKey,
+ Map.Entry::getValue
+ ));
+ }
+
+ /**
+ * Create and return a set of default, secure Velocity configuration properties.
+ * @see {@link LDN}, {@link Email}
+ *
+ * @param resourceRepositoryName the templating context e.g. "LDN", "Email"
+ * @returns secure Velocity configuration for use with templating
+ */
+ public static Properties getSecureVelocityProperties(String resourceRepositoryName) {
+ Properties secureVelocityProperties = new Properties();
+ // Basic Velocity configuration
+ secureVelocityProperties.setProperty(Velocity.RESOURCE_LOADERS, "string");
+ secureVelocityProperties.setProperty("resource.loader.string.description",
+ "Velocity StringResource loader");
+ secureVelocityProperties.setProperty("resource.loader.string.class",
+ StringResourceLoader.class.getName());
+ secureVelocityProperties.setProperty("resource.loader.string.repository.name",
+ resourceRepositoryName);
+ secureVelocityProperties.setProperty("resource.loader.string.repository.static",
+ "false");
+ // Set secure default introspection and class restriction handling in Velocity
+ secureVelocityProperties.setProperty("introspector.uberspect.class",
+ "org.apache.velocity.util.introspection.SecureUberspector");
+ secureVelocityProperties.setProperty("introspector.restrict.classes",
+ "java.lang.Class,java.lang.Runtime,java.lang.System");
+ secureVelocityProperties.setProperty( "introspector.restrict.packages",
+ "java.lang.reflect,java.io,java.nio");
+ // Set strict mode if configured (default: false, as we've always treated null values as blanks)
+ if (DSpaceServicesFactory.getInstance().getConfigurationService()
+ .getBooleanProperty("message.templates.strict_mode", false)) {
+ secureVelocityProperties.setProperty("runtime.strict_mode.enable", "true");
+ }
+
+ return secureVelocityProperties;
+ }
+
}
diff --git a/dspace-api/src/main/java/org/dspace/ctask/general/BasicLinkChecker.java b/dspace-api/src/main/java/org/dspace/ctask/general/BasicLinkChecker.java
index 020331842703..3c116df13bd2 100644
--- a/dspace-api/src/main/java/org/dspace/ctask/general/BasicLinkChecker.java
+++ b/dspace-api/src/main/java/org/dspace/ctask/general/BasicLinkChecker.java
@@ -9,12 +9,15 @@
import java.io.IOException;
import java.net.HttpURLConnection;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.List;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.utils.URIBuilder;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.logging.log4j.Logger;
import org.dspace.app.client.DSpaceHttpClientFactory;
@@ -141,7 +144,8 @@ protected boolean checkURL(String url, StringBuilder results) {
protected int getResponseStatus(String url, int redirects) {
RequestConfig config = RequestConfig.custom().setRedirectsEnabled(true).build();
try (CloseableHttpClient httpClient = DSpaceHttpClientFactory.getInstance().buildWithRequestConfig(config)) {
- CloseableHttpResponse httpResponse = httpClient.execute(new HttpGet(url));
+ URI uri = new URIBuilder(url).build();
+ CloseableHttpResponse httpResponse = httpClient.execute(new HttpGet(uri));
int statusCode = httpResponse.getStatusLine().getStatusCode();
int maxRedirect = configurationService.getIntProperty("curate.checklinks.max-redirect", 0);
if ((statusCode == HttpURLConnection.HTTP_MOVED_TEMP || statusCode == HttpURLConnection.HTTP_MOVED_PERM ||
@@ -153,6 +157,9 @@ protected int getResponseStatus(String url, int redirects) {
}
}
return statusCode;
+ } catch (URISyntaxException e) {
+ log.error("Invalid URL: ", url, e);
+ return 0;
} catch (IOException ioe) {
// Must be a bad URL
log.debug("Bad link: " + ioe.getMessage());
diff --git a/dspace-api/src/main/java/org/dspace/curate/AbstractCurationTask.java b/dspace-api/src/main/java/org/dspace/curate/AbstractCurationTask.java
index fa16d2736953..4d59d46a8042 100644
--- a/dspace-api/src/main/java/org/dspace/curate/AbstractCurationTask.java
+++ b/dspace-api/src/main/java/org/dspace/curate/AbstractCurationTask.java
@@ -13,6 +13,10 @@
import java.util.List;
import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.dspace.app.util.factory.UtilServiceFactory;
+import org.dspace.app.util.service.DSpaceObjectUtils;
import org.dspace.content.Collection;
import org.dspace.content.Community;
import org.dspace.content.DSpaceObject;
@@ -42,6 +46,8 @@ public abstract class AbstractCurationTask implements CurationTask {
protected ItemService itemService;
protected HandleService handleService;
protected ConfigurationService configurationService;
+ protected DSpaceObjectUtils dspaceObjectUtils;
+ private static final Logger log = LogManager.getLogger();
@Override
public void init(Curator curator, String taskId) throws IOException {
@@ -51,6 +57,7 @@ public void init(Curator curator, String taskId) throws IOException {
itemService = ContentServiceFactory.getInstance().getItemService();
handleService = HandleServiceFactory.getInstance().getHandleService();
configurationService = DSpaceServicesFactory.getInstance().getConfigurationService();
+ dspaceObjectUtils = UtilServiceFactory.getInstance().getDSpaceObjectUtils();
}
@Override
@@ -153,25 +160,13 @@ protected void performItem(Item item) throws SQLException, IOException {
@Override
public int perform(Context ctx, String id) throws IOException {
- DSpaceObject dso = dereference(ctx, id);
- return (dso != null) ? perform(dso) : Curator.CURATE_FAIL;
- }
-
- /**
- * Returns a DSpaceObject for passed identifier, if it exists
- *
- * @param ctx DSpace context
- * @param id canonical id of object
- * @return dso
- * DSpace object, or null if no object with id exists
- * @throws IOException if IO error
- */
- protected DSpaceObject dereference(Context ctx, String id) throws IOException {
+ DSpaceObject dso = null;
try {
- return handleService.resolveToObject(ctx, id);
+ dso = dspaceObjectUtils.findDSpaceObject(ctx, id);
} catch (SQLException sqlE) {
throw new IOException(sqlE.getMessage(), sqlE);
}
+ return (dso != null) ? perform(dso) : Curator.CURATE_FAIL;
}
/**
diff --git a/dspace-api/src/main/java/org/dspace/curate/Curation.java b/dspace-api/src/main/java/org/dspace/curate/Curation.java
index b894dcd85f03..35f6fbee6916 100644
--- a/dspace-api/src/main/java/org/dspace/curate/Curation.java
+++ b/dspace-api/src/main/java/org/dspace/curate/Curation.java
@@ -10,15 +10,18 @@
import java.io.BufferedReader;
import java.io.File;
import java.io.FileNotFoundException;
-import java.io.FileReader;
import java.io.IOException;
import java.io.OutputStream;
import java.io.OutputStreamWriter;
import java.io.PrintStream;
import java.io.Writer;
+import java.nio.charset.StandardCharsets;
import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Arrays;
import java.util.HashMap;
import java.util.Iterator;
+import java.util.List;
import java.util.Map;
import java.util.UUID;
@@ -38,6 +41,7 @@
import org.dspace.handle.service.HandleService;
import org.dspace.scripts.DSpaceRunnable;
import org.dspace.services.factory.DSpaceServicesFactory;
+import org.dspace.storage.secure.SecureFileAccess;
import org.dspace.utils.DSpace;
/**
@@ -112,8 +116,16 @@ private void handleCurationTask(Curator curator) throws IOException, SQLExceptio
} else if (commandLine.hasOption('T')) {
// load taskFile
BufferedReader reader = null;
+ // in this case, Curation CLI expects to calculate the -T parameter from the user's current working dir
+ String taskFilePath = SecureFileAccess.calculateAbsolutePathUsingCwd(this.taskFile);
try {
- reader = new BufferedReader(new FileReader(this.taskFile));
+ String dspaceDir = DSpaceServicesFactory.getInstance()
+ .getConfigurationService().getProperty("dspace.dir");
+ List allowedTaskFileBasePath = new ArrayList<>(
+ Arrays.asList(DSpaceServicesFactory.getInstance().getConfigurationService()
+ .getArrayProperty("curate.taskfile.base", new String[]{dspaceDir})));
+ reader = SecureFileAccess.getBufferedReader(taskFilePath, allowedTaskFileBasePath,
+ "curation-taskfile", StandardCharsets.UTF_8);
while ((taskName = reader.readLine()) != null) {
if (verbose) {
super.handler.logInfo("Adding task: " + taskName);
@@ -189,12 +201,25 @@ private void endScript(long timeRun) throws SQLException {
private Curator initCurator() throws FileNotFoundException {
Curator curator = new Curator(handler);
OutputStream reporterStream;
+ String dspaceDir = DSpaceServicesFactory.getInstance()
+ .getConfigurationService().getProperty("dspace.dir");
+ List allowedReporterBasePaths = new ArrayList<>(Arrays.asList(DSpaceServicesFactory.getInstance()
+ .getConfigurationService().getArrayProperty("curate.reporter.base",
+ new String[]{dspaceDir + File.separatorChar + "log"})));
if (null == this.reporter) {
- reporterStream = NullOutputStream.NULL_OUTPUT_STREAM;
+ reporterStream = NullOutputStream.INSTANCE;
} else if ("-".equals(this.reporter)) {
reporterStream = System.out;
} else {
- reporterStream = new PrintStream(this.reporter);
+ // Reporter param comes from CLI execution. Calculate abs path from user's current working dir
+ String reporterFilePath = SecureFileAccess.calculateAbsolutePathUsingCwd(this.reporter);
+ try {
+ reporterStream = new PrintStream(
+ SecureFileAccess.getOutputStream(
+ reporterFilePath, allowedReporterBasePaths, "curation-reporter"));
+ } catch (IOException e) {
+ throw new FileNotFoundException(e.getLocalizedMessage());
+ }
}
Writer reportWriter = new OutputStreamWriter(reporterStream);
curator.setReporter(reportWriter);
diff --git a/dspace-api/src/main/java/org/dspace/curate/CurationCliScriptConfiguration.java b/dspace-api/src/main/java/org/dspace/curate/CurationCliScriptConfiguration.java
index eaa04f477829..925bd4f2d232 100644
--- a/dspace-api/src/main/java/org/dspace/curate/CurationCliScriptConfiguration.java
+++ b/dspace-api/src/main/java/org/dspace/curate/CurationCliScriptConfiguration.java
@@ -20,6 +20,10 @@ public Options getOptions() {
options = super.getOptions();
options.addOption("e", "eperson", true, "email address of curating eperson");
options.getOption("e").setRequired(true);
+ options.addOption("r", "reporter", true,
+ "relative or absolute path to the desired report file. Use '-' to report to console. If absent, no " +
+ "reporting");
+ options.addOption("T", "taskfile", true, "file containing curation task names");
return options;
}
}
diff --git a/dspace-api/src/main/java/org/dspace/curate/CurationClientOptions.java b/dspace-api/src/main/java/org/dspace/curate/CurationClientOptions.java
index 8ec0f14697c0..03ad2f34b230 100644
--- a/dspace-api/src/main/java/org/dspace/curate/CurationClientOptions.java
+++ b/dspace-api/src/main/java/org/dspace/curate/CurationClientOptions.java
@@ -31,7 +31,8 @@ public enum CurationClientOptions {
/**
* This method resolves the CommandLine parameters to figure out which action the curation script should perform
*
- * @param commandLine The relevant CommandLine for the curation script
+ * @param commandLine The relevant CommandLine for the curation script. Note that -T is passed only
+ * from CurationCliScriptConfig and is not accessible from UI processes
* @return The curation option to be ran, parsed from the CommandLine
*/
protected static CurationClientOptions getClientOption(CommandLine commandLine) {
@@ -54,14 +55,10 @@ protected static Options constructOptions() {
Options options = new Options();
options.addOption("t", "task", true, "curation task name; options: " + getTaskOptions());
- options.addOption("T", "taskfile", true, "file containing curation task names");
options.addOption("i", "id", true,
"Id (handle) of object to perform task on, or 'all' to perform on whole repository");
options.addOption("p", "parameter", true, "a task parameter 'NAME=VALUE'");
options.addOption("q", "queue", true, "name of task queue to process");
- options.addOption("r", "reporter", true,
- "relative or absolute path to the desired report file. Use '-' to report to console. If absent, no " +
- "reporting");
options.addOption("s", "scope", true,
"transaction scope to impose: use 'object', 'curation', or 'open'. If absent, 'open' applies");
options.addOption("v", "verbose", false, "report activity to stdout");
diff --git a/dspace-api/src/main/java/org/dspace/curate/Curator.java b/dspace-api/src/main/java/org/dspace/curate/Curator.java
index 4076fab51989..91f984b72e5b 100644
--- a/dspace-api/src/main/java/org/dspace/curate/Curator.java
+++ b/dspace-api/src/main/java/org/dspace/curate/Curator.java
@@ -18,6 +18,8 @@
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
+import org.dspace.app.util.factory.UtilServiceFactory;
+import org.dspace.app.util.service.DSpaceObjectUtils;
import org.dspace.content.Collection;
import org.dspace.content.Community;
import org.dspace.content.DSpaceObject;
@@ -90,6 +92,7 @@ public static enum TxScope {
protected TaskResolver resolver = new TaskResolver();
protected TxScope txScope = TxScope.OPEN;
protected CommunityService communityService;
+ protected DSpaceObjectUtils dspaceObjectUtils;
protected ItemService itemService;
protected HandleService handleService;
protected DSpaceRunnableHandler handler;
@@ -109,6 +112,7 @@ public Curator(DSpaceRunnableHandler handler) {
*/
public Curator() {
communityService = ContentServiceFactory.getInstance().getCommunityService();
+ dspaceObjectUtils = UtilServiceFactory.getInstance().getDSpaceObjectUtils();
itemService = ContentServiceFactory.getInstance().getItemService();
handleService = HandleServiceFactory.getInstance().getHandleService();
resolver = new TaskResolver();
@@ -248,7 +252,7 @@ public void curate(Context c, String id) throws IOException {
//Save the context on current execution thread
curationCtx.set(c);
- DSpaceObject dso = handleService.resolveToObject(c, id);
+ DSpaceObject dso = dspaceObjectUtils.findDSpaceObject(c,id);
if (dso != null) {
curate(dso);
} else {
diff --git a/dspace-api/src/main/java/org/dspace/discovery/DiscoverQuery.java b/dspace-api/src/main/java/org/dspace/discovery/DiscoverQuery.java
index e133ad0ed170..185c768a057b 100644
--- a/dspace-api/src/main/java/org/dspace/discovery/DiscoverQuery.java
+++ b/dspace-api/src/main/java/org/dspace/discovery/DiscoverQuery.java
@@ -72,6 +72,14 @@ public enum SORT_ORDER {
private String discoveryConfigurationName;
+ /**
+ * The required authorizations user should have for the objects returned by the query.
+ * The READ authorization (Constants.READ) is always required and does not need to be added here.
+ */
+ private List requiredAuthorization;
+
+ private boolean inheritAuthorizations = true;
+
public DiscoverQuery() {
//Initialize all our lists
this.filterQueries = new ArrayList<>();
@@ -83,6 +91,7 @@ public DiscoverQuery() {
this.hitHighlighting = new HashMap<>();
//Use a linked hashmap since sometimes insertion order might matter
this.properties = new LinkedHashMap<>();
+ this.requiredAuthorization = new ArrayList<>();
}
@@ -411,4 +420,54 @@ public String getDiscoveryConfigurationName() {
public void setDiscoveryConfigurationName(String discoveryConfigurationName) {
this.discoveryConfigurationName = discoveryConfigurationName;
}
+
+ /**
+ * Return the required authorization user should have for the objects returned by this query
+ *
+ * @return the required authorizations
+ */
+ public List getRequiredAuthorizations() {
+ return requiredAuthorization;
+ }
+
+ /**
+ * Add a required authorization user should have for the objects returned by this query.
+ * The READ authorization (Constants.READ) is always required and does not need to be added here.
+ *
+ * @param action
+ * the required action
+ */
+ public void addRequiredAuthorization(int action) {
+ this.requiredAuthorization.add(action);
+ }
+
+ /**
+ * Remove a required authorization user should have for the objects returned by this query
+ *
+ * @param authorizationAction
+ * the required action
+ */
+ public void removeRequiredAuthorization(int authorizationAction) {
+ this.requiredAuthorization.removeIf(action -> action == authorizationAction);
+ }
+
+ /**
+ * Return whether authorizations should be inherited from parent objects
+ *
+ * @return true if authorizations should be inherited, false otherwise
+ */
+ public boolean isInheritAuthorizationsEnabled() {
+ return inheritAuthorizations;
+ }
+
+ /**
+ * Set whether authorizations should be inherited from parent objects
+ *
+ * @param inheritAuthorizations
+ * true if authorizations should be inherited, false otherwise
+ */
+ public void setInheritAuthorizations(boolean inheritAuthorizations) {
+ this.inheritAuthorizations = inheritAuthorizations;
+ }
+
}
diff --git a/dspace-api/src/main/java/org/dspace/discovery/SearchService.java b/dspace-api/src/main/java/org/dspace/discovery/SearchService.java
index cb945648e7cd..986b2d23de2a 100644
--- a/dspace-api/src/main/java/org/dspace/discovery/SearchService.java
+++ b/dspace-api/src/main/java/org/dspace/discovery/SearchService.java
@@ -90,6 +90,8 @@ DiscoverFilterQuery toFilterQuery(Context context, String field, String operator
List- getRelatedItems(Context context, Item item,
DiscoveryMoreLikeThisConfiguration moreLikeThisConfiguration);
+ String createLocationQueryForAdministrableDSOs(String epersonAndGroupClause);
+
/**
* Method to create a Query that includes all
* communities and collections a user may administrate.
@@ -124,6 +126,15 @@ List
- getRelatedItems(Context context, Item item,
*/
String escapeQueryChars(String query);
+ /**
+ * Utility method to format an autocomplete query over a specific field.
+ *
+ * @param query to search for
+ * @param autocompleteField the field to use to autocomplete search, if null or empty no field is used
+ * @return the constructed solr query
+ */
+ String formatAutoCompleteQuery(String query, String autocompleteField);
+
FacetYearRange getFacetYearRange(Context context, IndexableObject scope, DiscoverySearchFilterFacet facet,
List filterQueries, DiscoverQuery parentQuery)
throws SearchServiceException;
diff --git a/dspace-api/src/main/java/org/dspace/discovery/SolrServiceImpl.java b/dspace-api/src/main/java/org/dspace/discovery/SolrServiceImpl.java
index a5fa04b3dc04..88437ca7b8dc 100644
--- a/dspace-api/src/main/java/org/dspace/discovery/SolrServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/discovery/SolrServiceImpl.java
@@ -18,6 +18,7 @@
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.Calendar;
import java.util.Collections;
import java.util.Date;
@@ -596,6 +597,58 @@ protected boolean requiresIndexing(String uniqueId, Date lastModified)
return reindexItem || !inIndex;
}
+ /**
+ * Retrieves from Solr the list of administrable communities and collections for the
+ * current user based on a clause containing the e-person and group IDs.
+ * Builds and returns the "location" query part for these DSO's.
+ *
+ * @param epersonAndGroupClause A Solr filter clause containing one or more IDs combined with OR,
+ * e.g. {@code "eUUIDe1 OR gUUIDg2 OR gUUIDg3 OR ..."}.
+ *
+ * @return An empty string if no administrable DSO exists, or a string in the form
+ * {@code "location:(mUUID1 OR lUUID2 ... )"} when there are administrable DSO's.
+ */
+ @Override
+ public String createLocationQueryForAdministrableDSOs(String epersonAndGroupClause) {
+ StringBuilder locationQuery = new StringBuilder();
+ try {
+
+ SolrQuery solrQuery = new SolrQuery();
+
+ String query = "*:*";
+ solrQuery.setQuery(query);
+ solrQuery.addField(SearchUtils.RESOURCE_ID_FIELD);
+ solrQuery.addField(SearchUtils.RESOURCE_TYPE_FIELD);
+ solrQuery.addFilterQuery("(" + SearchUtils.RESOURCE_TYPE_FIELD + ":" + IndexableCommunity.TYPE + " OR "
+ + SearchUtils.RESOURCE_TYPE_FIELD + ":" + IndexableCollection.TYPE + ")");
+ solrQuery.addFilterQuery("admin:(" + epersonAndGroupClause + ")");
+ solrQuery.setRows(Integer.MAX_VALUE);
+
+ QueryResponse solrQueryResponse = solrSearchCore.getSolr().query(solrQuery,
+ solrSearchCore.REQUEST_METHOD);
+ if (solrQueryResponse != null) {
+ List containerUUIDs = new ArrayList<>();
+ for (SolrDocument doc : solrQueryResponse.getResults()) {
+ String type = (String) doc.getFieldValue(SearchUtils.RESOURCE_TYPE_FIELD);
+ String uniqueID = (String) doc.getFieldValue(SearchUtils.RESOURCE_ID_FIELD);
+ if (IndexableCommunity.TYPE.equals(type)) {
+ containerUUIDs.add("m" + uniqueID);
+ } else if (IndexableCollection.TYPE.equals(type)) {
+ containerUUIDs.add("l" + uniqueID);
+ }
+ }
+ if (!containerUUIDs.isEmpty()) {
+ locationQuery.append("location:(");
+ locationQuery.append(String.join(" OR ", containerUUIDs));
+ return locationQuery.append(")").toString();
+ }
+ }
+ } catch (Exception e) {
+ log.error("Failed to retrieve administrable communities and collections from Solr:", e);
+ }
+ return "";
+ }
+
@Override
public String createLocationQueryForAdministrableItems(Context context)
throws SQLException {
@@ -969,8 +1022,20 @@ protected SolrQuery resolveToSolrQuery(Context context, DiscoverQuery discoveryQ
if (0 < discoveryQuery.getHitHighlightingFields().size()) {
solrQuery.setHighlight(true);
solrQuery.add(HighlightParams.USE_PHRASE_HIGHLIGHTER, Boolean.TRUE.toString());
+ boolean escapeHTML = configurationService.getBooleanProperty("discovery.highlights.escape-html", true);
+ String[] renderHTMLForFields =
+ configurationService.getArrayProperty("discovery.highlights.html-allowed-fields");
for (DiscoverHitHighlightingField highlightingField : discoveryQuery.getHitHighlightingFields()) {
solrQuery.addHighlightField(highlightingField.getField() + "_hl");
+ boolean allowHTMLInField = Arrays.stream(renderHTMLForFields)
+ .anyMatch(field -> highlightingField.getField().matches(field));
+ if (!escapeHTML || allowHTMLInField) {
+ solrQuery.add("f." + highlightingField.getField() + "_hl." + HighlightParams.METHOD, "original");
+ } else {
+ solrQuery.add("f." + highlightingField.getField() + "_hl." + HighlightParams.METHOD, "unified");
+ solrQuery.add("f." + highlightingField.getField() + "_hl." + HighlightParams.ENCODER, "html");
+ }
+
solrQuery.add("f." + highlightingField.getField() + "_hl." + HighlightParams.FRAGSIZE,
String.valueOf(highlightingField.getMaxChars()));
solrQuery.add("f." + highlightingField.getField() + "_hl." + HighlightParams.SNIPPETS,
@@ -1611,6 +1676,27 @@ public String escapeQueryChars(String query) {
return ClientUtils.escapeQueryChars(query);
}
+ /**
+ * Utility method to format an autocomplete query over a specific field. Combines the escaped query with a
+ * wildcard search over the specified {@code autocompleteField}. This field is typically non-tokenized and
+ * allows recovering searches containing spaces as a single value.
+ *
+ * @param query the user input to search for
+ * @param autocompleteField non-tokenized field used for wildcard autocomplete
+ * @return the constructed Solr query, or the original query if blank
+ */
+ @Override
+ public String formatAutoCompleteQuery(String query, String autocompleteField) {
+ if (StringUtils.isNotBlank(query)) {
+ StringBuilder buildQuery = new StringBuilder();
+ String escapedQuery = escapeQueryChars(query);
+ buildQuery.append("(").append(escapedQuery).append(" OR ").append(autocompleteField).append(":*")
+ .append(escapedQuery).append("*").append(")");
+ return buildQuery.toString();
+ }
+ return query;
+ }
+
@Override
public FacetYearRange getFacetYearRange(Context context, IndexableObject scope,
DiscoverySearchFilterFacet facet, List filterQueries,
diff --git a/dspace-api/src/main/java/org/dspace/discovery/SolrServicePrivateItemPlugin.java b/dspace-api/src/main/java/org/dspace/discovery/SolrServicePrivateItemPlugin.java
index db543141e13d..aab1176d5af5 100644
--- a/dspace-api/src/main/java/org/dspace/discovery/SolrServicePrivateItemPlugin.java
+++ b/dspace-api/src/main/java/org/dspace/discovery/SolrServicePrivateItemPlugin.java
@@ -45,9 +45,8 @@ public void additionalSearchParameters(Context context, DiscoverQuery discoveryQ
solrQuery.addFilterQuery("NOT(discoverable:false)");
return;
}
- if (!authorizeService.isCommunityAdmin(context) && !authorizeService.isCollectionAdmin(context)) {
+ if (!authorizeService.isComColAdmin(context)) {
solrQuery.addFilterQuery("NOT(discoverable:false)");
-
}
} catch (SQLException ex) {
log.error(LogHelper.getHeader(context, "Error looking up authorization rights of current user",
diff --git a/dspace-api/src/main/java/org/dspace/discovery/SolrServiceResourceRestrictionPlugin.java b/dspace-api/src/main/java/org/dspace/discovery/SolrServiceResourceRestrictionPlugin.java
index d19616a85e10..c16317771a64 100644
--- a/dspace-api/src/main/java/org/dspace/discovery/SolrServiceResourceRestrictionPlugin.java
+++ b/dspace-api/src/main/java/org/dspace/discovery/SolrServiceResourceRestrictionPlugin.java
@@ -18,12 +18,8 @@
import org.dspace.authorize.ResourcePolicy;
import org.dspace.authorize.service.AuthorizeService;
import org.dspace.authorize.service.ResourcePolicyService;
-import org.dspace.content.Collection;
-import org.dspace.content.Community;
import org.dspace.content.DSpaceObject;
import org.dspace.content.InProgressSubmission;
-import org.dspace.content.Item;
-import org.dspace.content.factory.ContentServiceFactory;
import org.dspace.content.service.CollectionService;
import org.dspace.content.service.CommunityService;
import org.dspace.core.Constants;
@@ -36,14 +32,14 @@
import org.dspace.eperson.EPerson;
import org.dspace.eperson.Group;
import org.dspace.eperson.service.GroupService;
-import org.dspace.services.factory.DSpaceServicesFactory;
import org.dspace.xmlworkflow.storedcomponents.ClaimedTask;
import org.dspace.xmlworkflow.storedcomponents.PoolTask;
import org.springframework.beans.factory.annotation.Autowired;
/**
* Restriction plugin that ensures that indexes all the resource policies.
- * When a search is performed extra filter queries are added to retrieve only results to which the user has READ access
+ * When a search is performed extra filter queries are added to retrieve only results to which the user has the
+ * required authorization.
*
* @author Kevin Van de Velde (kevin at atmire dot com)
* @author Mark Diggory (markd at atmire dot com)
@@ -64,6 +60,8 @@ public class SolrServiceResourceRestrictionPlugin implements SolrServiceIndexPlu
protected GroupService groupService;
@Autowired(required = true)
protected ResourcePolicyService resourcePolicyService;
+ @Autowired
+ protected SearchService searchService;
@Override
public void additionalIndex(Context context, IndexableObject idxObj, SolrInputDocument document) {
@@ -83,50 +81,32 @@ public void additionalIndex(Context context, IndexableObject idxObj, SolrInputDo
}
if (dso != null) {
try {
- List policies = authorizeService.getPoliciesActionFilter(context, dso, Constants.READ);
- for (ResourcePolicy resourcePolicy : policies) {
- if (resourcePolicyService.isDateValid(resourcePolicy)) {
- String fieldValue;
- if (resourcePolicy.getGroup() != null) {
- //We have a group add it to the value
- fieldValue = "g" + resourcePolicy.getGroup().getID();
- } else {
- //We have an eperson add it to the value
- fieldValue = "e" + resourcePolicy.getEPerson().getID();
-
- }
-
- document.addField("read", fieldValue);
- }
-
- //remove the policy from the cache to save memory
- context.uncacheEntity(resourcePolicy);
- }
- // also index ADMIN policies as ADMIN permissions provides READ access
- // going up through the hierarchy for communities, collections and items
- while (dso != null) {
- if (dso instanceof Community || dso instanceof Collection || dso instanceof Item) {
- List policiesAdmin = authorizeService
- .getPoliciesActionFilter(context, dso, Constants.ADMIN);
- for (ResourcePolicy resourcePolicy : policiesAdmin) {
- if (resourcePolicyService.isDateValid(resourcePolicy)) {
- String fieldValue;
- if (resourcePolicy.getGroup() != null) {
- // We have a group add it to the value
- fieldValue = "g" + resourcePolicy.getGroup().getID();
- } else {
- // We have an eperson add it to the value
- fieldValue = "e" + resourcePolicy.getEPerson().getID();
- }
- document.addField("read", fieldValue);
- document.addField("admin", fieldValue);
+ // Index read, submit, edit and admin permissions
+ int[] actionsToIndex = new int[] { Constants.READ, Constants.WRITE, Constants.ADD, Constants.ADMIN };
+
+ for (int action : actionsToIndex) {
+ String indexedActionName = getIndexedActionName(action);
+ List policies = authorizeService.getPoliciesActionFilter(context, dso, action);
+ for (ResourcePolicy resourcePolicy : policies) {
+ if (resourcePolicyService.isDateValid(resourcePolicy)) {
+ String fieldValue;
+ // Avoid NPE in cases where the policy does not have group or eperson
+ if (resourcePolicy.getGroup() == null && resourcePolicy.getEPerson() == null) {
+ continue;
}
-
- // remove the policy from the cache to save memory
- context.uncacheEntity(resourcePolicy);
+ if (resourcePolicy.getGroup() != null) {
+ //We have a group add it to the value
+ fieldValue = "g" + resourcePolicy.getGroup().getID();
+ } else {
+ //We have an eperson add it to the value
+ fieldValue = "e" + resourcePolicy.getEPerson().getID();
+ }
+ document.addField(indexedActionName, fieldValue);
}
+
+ //remove the policy from the cache to save memory
+ context.uncacheEntity(resourcePolicy);
}
- dso = ContentServiceFactory.getInstance().getDSpaceObjectService(dso).getParentObject(context, dso);
}
} catch (SQLException e) {
log.error(LogHelper.getHeader(context, "Error while indexing resource policies",
@@ -140,36 +120,66 @@ public void additionalIndex(Context context, IndexableObject idxObj, SolrInputDo
public void additionalSearchParameters(Context context, DiscoverQuery discoveryQuery, SolrQuery solrQuery) {
try {
if (!authorizeService.isAdmin(context)) {
- StringBuilder resourceQuery = new StringBuilder();
- //Always add the anonymous group id to the query
- Group anonymousGroup = groupService.findByName(context, Group.ANONYMOUS);
- String anonGroupId = "";
- if (anonymousGroup != null) {
- anonGroupId = anonymousGroup.getID().toString();
- }
- resourceQuery.append("read:(g" + anonGroupId);
+
EPerson currentUser = context.getCurrentUser();
+ StringBuilder epersonAndGroupClause = new StringBuilder();
if (currentUser != null) {
- resourceQuery.append(" OR e").append(currentUser.getID());
+ epersonAndGroupClause.append("e").append(currentUser.getID());
}
-
//Retrieve all the groups the current user is a member of !
Set groups = groupService.allMemberGroupsSet(context, currentUser);
for (Group group : groups) {
- resourceQuery.append(" OR g").append(group.getID());
+ if (!epersonAndGroupClause.isEmpty()) {
+ epersonAndGroupClause.append(" OR g").append(group.getID());
+ } else {
+ epersonAndGroupClause.append("g").append(group.getID());
+ }
}
- resourceQuery.append(")");
+ StringBuilder resourceQuery = new StringBuilder();
- String locations = DSpaceServicesFactory.getInstance()
- .getServiceManager()
- .getServiceByName(SearchService.class.getName(),
- SearchService.class)
- .createLocationQueryForAdministrableItems(context);
+ List actions = discoveryQuery.getRequiredAuthorizations();
+ /*
+ * The `actions` list specifies the permissions required beyond the default "read" permission.
+ * It should not include "read" because checking for "read" is always implicit.
+ *
+ * The query is constructed as follows:
+ * - If no actions are provided, it checks only for "read" or "admin" permissions.
+ * - If "admin" is in the `actions` list, it checks only for admin permissions.
+ * - Otherwise, it checks for both "read" and the other specified actions.
+ *
+ * The resulting query follows this structure: (read AND action) OR admin.
+ */
+ if (actions.isEmpty()) {
+ // If no actions are included, we only check for read permissions
+ resourceQuery.append("(read:(").append(epersonAndGroupClause).append("))").append( " OR ")
+ .append("admin:(").append(epersonAndGroupClause).append(")");
+ } else if (actions.contains(Constants.ADMIN)) {
+ // If the actions array contains the admin action, we only check for admin permissions
+ resourceQuery.append("admin:(").append(epersonAndGroupClause).append(")");
+ } else {
+ // If the actions array contains other actions, we check for read permissions and the actions passed
+ resourceQuery.append("(read:(").append(epersonAndGroupClause).append(")");
+ for (int action : actions) {
+ String actionName = getIndexedActionName(action);
+ resourceQuery.append(" AND ").append(actionName).append(":(").append(epersonAndGroupClause)
+ .append(")");
+ }
+ resourceQuery.append(")");
+ resourceQuery.append(" OR ").append("admin:(")
+ .append(epersonAndGroupClause).append(")");
+ }
- if (StringUtils.isNotBlank(locations)) {
- resourceQuery.append(" OR ");
- resourceQuery.append(locations);
+ // Add to the query the locations the user has administrative rights on to cover the cases of
+ // inherited permissions only if the inherit authorizations flag is enabled
+ if (discoveryQuery.isInheritAuthorizationsEnabled()) {
+ String locations = searchService
+ .createLocationQueryForAdministrableDSOs(epersonAndGroupClause.toString());
+
+ if (StringUtils.isNotBlank(locations)) {
+ resourceQuery.append(" OR ");
+ resourceQuery.append(locations);
+ }
}
solrQuery.addFilterQuery(resourceQuery.toString());
@@ -178,4 +188,26 @@ public void additionalSearchParameters(Context context, DiscoverQuery discoveryQ
log.error(LogHelper.getHeader(context, "Error while adding resource policy information to query", ""), e);
}
}
+
+ /**
+ * Get the action name used for solr indexing for the given action id
+ *
+ * @param action action id
+ * @return solr action name used for indexing
+ */
+ private String getIndexedActionName(int action) {
+
+ switch (action) {
+ case Constants.READ:
+ return "read";
+ case Constants.WRITE:
+ return "edit";
+ case Constants.ADD:
+ return "submit";
+ case Constants.ADMIN:
+ return "admin";
+ default:
+ return Constants.actionText[action].toLowerCase();
+ }
+ }
}
diff --git a/dspace-api/src/main/java/org/dspace/discovery/indexobject/CommunityIndexFactoryImpl.java b/dspace-api/src/main/java/org/dspace/discovery/indexobject/CommunityIndexFactoryImpl.java
index e92819601839..9f4b558cce76 100644
--- a/dspace-api/src/main/java/org/dspace/discovery/indexobject/CommunityIndexFactoryImpl.java
+++ b/dspace-api/src/main/java/org/dspace/discovery/indexobject/CommunityIndexFactoryImpl.java
@@ -126,7 +126,7 @@ public List getLocations(Context context, IndexableCommunity indexableDS
final Community target = indexableDSpaceObject.getIndexedObject();
List locations = new ArrayList<>();
// build list of community ids
- List communities = target.getParentCommunities();
+ List communities = communityService.getAllParents(context, target);
// now put those into strings
for (Community community : communities) {
diff --git a/dspace-api/src/main/java/org/dspace/disseminate/CitationDocumentServiceImpl.java b/dspace-api/src/main/java/org/dspace/disseminate/CitationDocumentServiceImpl.java
index 1aa31d4db9e5..bf9f7b9d6a01 100644
--- a/dspace-api/src/main/java/org/dspace/disseminate/CitationDocumentServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/disseminate/CitationDocumentServiceImpl.java
@@ -142,8 +142,8 @@ public void afterPropertiesSet() throws Exception {
//Load enabled collections
String[] citationEnabledCollections = configurationService
- .getArrayProperty("citation-page.enabled_collections");
- citationEnabledCollectionsList = Arrays.asList(citationEnabledCollections);
+ .getArrayProperty("citation-page.enabled_collections");
+ citationEnabledCollectionsList = new ArrayList(Arrays.asList(citationEnabledCollections));
//Load enabled communities, and add to collection-list
String[] citationEnabledCommunities = configurationService
diff --git a/dspace-api/src/main/java/org/dspace/embargo/DefaultEmbargoSetter.java b/dspace-api/src/main/java/org/dspace/embargo/DefaultEmbargoSetter.java
index 7857a45eb8d5..265ec213da60 100644
--- a/dspace-api/src/main/java/org/dspace/embargo/DefaultEmbargoSetter.java
+++ b/dspace-api/src/main/java/org/dspace/embargo/DefaultEmbargoSetter.java
@@ -94,7 +94,6 @@ public void setEmbargo(Context context, Item item)
if (!(bnn.equals(Constants.LICENSE_BUNDLE_NAME) || bnn.equals(Constants.METADATA_BUNDLE_NAME) || bnn
.equals(CreativeCommonsServiceImpl.CC_BUNDLE_NAME))) {
//AuthorizeManager.removePoliciesActionFilter(context, bn, Constants.READ);
- generatePolicies(context, liftDate.toDate(), null, bn, item.getOwningCollection());
for (Bitstream bs : bn.getBitstreams()) {
//AuthorizeManager.removePoliciesActionFilter(context, bs, Constants.READ);
generatePolicies(context, liftDate.toDate(), null, bs, item.getOwningCollection());
diff --git a/dspace-api/src/main/java/org/dspace/eperson/EPerson.java b/dspace-api/src/main/java/org/dspace/eperson/EPerson.java
index 996fc96e3aa8..6f8e1043f9ec 100644
--- a/dspace-api/src/main/java/org/dspace/eperson/EPerson.java
+++ b/dspace-api/src/main/java/org/dspace/eperson/EPerson.java
@@ -369,7 +369,7 @@ public int getType() {
@Override
public String getName() {
- return getEmail();
+ return this.getFullName();
}
String getDigestAlgorithm() {
diff --git a/dspace-api/src/main/java/org/dspace/eperson/EPersonCLITool.java b/dspace-api/src/main/java/org/dspace/eperson/EPersonCLITool.java
index 343ddcccfa39..53451e07a9ec 100644
--- a/dspace-api/src/main/java/org/dspace/eperson/EPersonCLITool.java
+++ b/dspace-api/src/main/java/org/dspace/eperson/EPersonCLITool.java
@@ -50,7 +50,7 @@ public class EPersonCLITool {
private static final Option OPT_PHONE = new Option("t", "telephone", true, "telephone number, empty for none");
private static final Option OPT_LANGUAGE = new Option("l", "language", true, "the person's preferred language");
private static final Option OPT_REQUIRE_CERTIFICATE = new Option("c", "requireCertificate", true,
- "if 'true', an X.509 certificate will be " +
+ "if 'true', a certificate will be " +
"required for login");
private static final Option OPT_CAN_LOGIN = new Option("C", "canLogIn", true, "'true' if the user can log in");
diff --git a/dspace-api/src/main/java/org/dspace/eperson/Group.java b/dspace-api/src/main/java/org/dspace/eperson/Group.java
index 24b44b8149a4..8146bf702d0a 100644
--- a/dspace-api/src/main/java/org/dspace/eperson/Group.java
+++ b/dspace-api/src/main/java/org/dspace/eperson/Group.java
@@ -138,7 +138,7 @@ boolean contains(EPerson e) {
return getMembers().contains(e);
}
- List getParentGroups() {
+ public List getParentGroups() {
return parentGroups;
}
diff --git a/dspace-api/src/main/java/org/dspace/eperson/GroupServiceImpl.java b/dspace-api/src/main/java/org/dspace/eperson/GroupServiceImpl.java
index 4cec4c9c0d93..44727d3e5fb9 100644
--- a/dspace-api/src/main/java/org/dspace/eperson/GroupServiceImpl.java
+++ b/dspace-api/src/main/java/org/dspace/eperson/GroupServiceImpl.java
@@ -142,6 +142,8 @@ public void addMember(Context context, Group group, EPerson e) {
context.addEvent(
new Event(Event.ADD, Constants.GROUP, group.getID(), Constants.EPERSON, e.getID(), e.getEmail(),
getIdentifiers(context, group)));
+ log.info(LogHelper.getHeader(context, "add_group_eperson",
+ "group_id=" + group.getID() + ", eperson_id=" + e.getID()));
}
@Override
@@ -157,6 +159,8 @@ public void addMember(Context context, Group groupParent, Group groupChild) thro
context.addEvent(new Event(Event.ADD, Constants.GROUP, groupParent.getID(), Constants.GROUP, groupChild.getID(),
groupChild.getName(), getIdentifiers(context, groupParent)));
+ log.info(LogHelper.getHeader(context, "add_group_subgroup",
+ "group_id=" + groupParent.getID() + ", subgroup_id=" + groupChild.getID()));
}
/**
@@ -214,6 +218,8 @@ public void removeMember(Context context, Group group, EPerson ePerson) throws S
if (group.remove(ePerson)) {
context.addEvent(new Event(Event.REMOVE, Constants.GROUP, group.getID(), Constants.EPERSON, ePerson.getID(),
ePerson.getEmail(), getIdentifiers(context, group)));
+ log.info(LogHelper.getHeader(context, "remove_group_eperson",
+ "group_id=" + group.getID() + ", eperson_id=" + ePerson.getID()));
}
}
@@ -242,6 +248,8 @@ public void removeMember(Context context, Group groupParent, Group childGroup) t
context.addEvent(
new Event(Event.REMOVE, Constants.GROUP, groupParent.getID(), Constants.GROUP, childGroup.getID(),
childGroup.getName(), getIdentifiers(context, groupParent)));
+ log.info(LogHelper.getHeader(context, "remove_group_subgroup",
+ "group_id=" + groupParent.getID() + ", subgroup_id=" + childGroup.getID()));
}
}
diff --git a/dspace-api/src/main/java/org/dspace/eperson/dao/impl/GroupDAOImpl.java b/dspace-api/src/main/java/org/dspace/eperson/dao/impl/GroupDAOImpl.java
index abd9fc830fa4..5c64af1c5097 100644
--- a/dspace-api/src/main/java/org/dspace/eperson/dao/impl/GroupDAOImpl.java
+++ b/dspace-api/src/main/java/org/dspace/eperson/dao/impl/GroupDAOImpl.java
@@ -92,7 +92,7 @@ public List findAll(Context context, int pageSize, int offset) throws SQL
@Override
public List findByEPerson(Context context, EPerson ePerson) throws SQLException {
Query query = createQuery(context,
- "from Group where (from EPerson e where e.id = :eperson_id) in elements(epeople)");
+ "select distinct g from Group g join g.epeople ep where ep.id = :eperson_id");
query.setParameter("eperson_id", ePerson.getID());
query.setHint("org.hibernate.cacheable", Boolean.TRUE);
diff --git a/dspace-api/src/main/java/org/dspace/external/OpenaireRestConnector.java b/dspace-api/src/main/java/org/dspace/external/OpenaireRestConnector.java
index 87af01401ac0..f430959621fc 100644
--- a/dspace-api/src/main/java/org/dspace/external/OpenaireRestConnector.java
+++ b/dspace-api/src/main/java/org/dspace/external/OpenaireRestConnector.java
@@ -206,8 +206,11 @@ public InputStream get(String file, String accessToken) {
break;
}
- // do not close this httpClient
- result = getResponse.getEntity().getContent();
+ // the client will be closed, we need to copy the response stream to a new one that we can return
+ try (InputStream is = getResponse.getEntity().getContent()) {
+ byte[] bytes = is.readAllBytes();
+ result = new java.io.ByteArrayInputStream(bytes);
+ }
}
} catch (MalformedURLException e1) {
getGotError(e1, url + '/' + file);
diff --git a/dspace-api/src/main/java/org/dspace/external/OrcidConnectionException.java b/dspace-api/src/main/java/org/dspace/external/OrcidConnectionException.java
new file mode 100644
index 000000000000..3574045aab2b
--- /dev/null
+++ b/dspace-api/src/main/java/org/dspace/external/OrcidConnectionException.java
@@ -0,0 +1,33 @@
+/**
+ * The contents of this file are subject to the license and copyright
+ * detailed in the LICENSE and NOTICE files at the root of the source
+ * tree and available online at
+ *
+ * http://www.dspace.org/license/
+ */
+package org.dspace.external;
+
+/**
+ * Exception thrown when there are issues with ORCID service connections.
+ *
+ * @author Boychuk Mykhaylo (mykhaylo.boychuk@4science.com)
+ */
+public class OrcidConnectionException extends Exception {
+
+ private final int statusCode;
+
+ public OrcidConnectionException(String message, int statusCode) {
+ super(message);
+ this.statusCode = statusCode;
+ }
+
+ public OrcidConnectionException(String message, int statusCode, Throwable cause) {
+ super(message, cause);
+ this.statusCode = statusCode;
+ }
+
+ public int getStatusCode() {
+ return statusCode;
+ }
+
+}
diff --git a/dspace-api/src/main/java/org/dspace/external/OrcidRestConnector.java b/dspace-api/src/main/java/org/dspace/external/OrcidRestConnector.java
index aa16af7a524d..3d61462cc354 100644
--- a/dspace-api/src/main/java/org/dspace/external/OrcidRestConnector.java
+++ b/dspace-api/src/main/java/org/dspace/external/OrcidRestConnector.java
@@ -9,10 +9,9 @@
import java.io.ByteArrayInputStream;
import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import java.util.Scanner;
import org.apache.commons.lang3.StringUtils;
+import org.apache.http.HttpResponse;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
@@ -28,9 +27,6 @@
*/
public class OrcidRestConnector {
- /**
- * log4j logger
- */
private static final Logger log = LogManager.getLogger(OrcidRestConnector.class);
private final String url;
@@ -39,33 +35,33 @@ public OrcidRestConnector(String url) {
this.url = url;
}
- public InputStream get(String path, String accessToken) {
- CloseableHttpResponse getResponse = null;
- InputStream result = null;
- path = trimSlashes(path);
-
- String fullPath = url + '/' + path;
+ public InputStream get(String path, String accessToken) throws OrcidConnectionException {
+ String fullPath = url + '/' + trimSlashes(path);
HttpGet httpGet = new HttpGet(fullPath);
if (StringUtils.isNotBlank(accessToken)) {
httpGet.addHeader("Content-Type", "application/vnd.orcid+xml");
httpGet.addHeader("Authorization","Bearer " + accessToken);
}
try (CloseableHttpClient httpClient = DSpaceHttpClientFactory.getInstance().build()) {
- getResponse = httpClient.execute(httpGet);
- try (InputStream responseStream = getResponse.getEntity().getContent()) {
- // Read all the content of the response stream into a byte array to prevent TruncatedChunkException
- byte[] content = responseStream.readAllBytes();
- result = new ByteArrayInputStream(content);
+ try (CloseableHttpResponse httpResponse = httpClient.execute(httpGet)) {
+ if (!isSuccessful(httpResponse)) {
+ var statusCode = getStatusCode(httpResponse);
+ var reason = httpResponse.getStatusLine().getReasonPhrase();
+ var error = String.format("The request failed with:%d code, reason:%s ", statusCode, reason);
+ throw new OrcidConnectionException(error, statusCode);
+ }
+ try (InputStream responseStream = httpResponse.getEntity().getContent()) {
+ // Read all the content of the response stream into a byte array to prevent TruncatedChunkException
+ byte[] content = responseStream.readAllBytes();
+ return new ByteArrayInputStream(content);
+ }
}
+ } catch (OrcidConnectionException e) {
+ throw e;
} catch (Exception e) {
- getGotError(e, fullPath);
+ log.error("Error in rest connector for path: " + fullPath, e);
+ throw new OrcidConnectionException("Failed to execute ORCID request: " + fullPath, 0, e);
}
-
- return result;
- }
-
- protected void getGotError(Exception e, String fullPath) {
- log.error("Error in rest connector for path: " + fullPath, e);
}
public static String trimSlashes(String path) {
@@ -78,8 +74,13 @@ public static String trimSlashes(String path) {
return path;
}
- public static String convertStreamToString(InputStream is) {
- Scanner s = new Scanner(is, StandardCharsets.UTF_8).useDelimiter("\\A");
- return s.hasNext() ? s.next() : "";
+ private boolean isSuccessful(HttpResponse response) {
+ int statusCode = getStatusCode(response);
+ return statusCode >= 200 || statusCode <= 299;
}
-}
+
+ private int getStatusCode(HttpResponse response) {
+ return response.getStatusLine().getStatusCode();
+ }
+
+}
\ No newline at end of file
diff --git a/dspace-api/src/main/java/org/dspace/external/provider/impl/OpenaireFundingDataProvider.java b/dspace-api/src/main/java/org/dspace/external/provider/impl/OpenaireFundingDataProvider.java
index 62cef508c556..ae0f6c89a107 100644
--- a/dspace-api/src/main/java/org/dspace/external/provider/impl/OpenaireFundingDataProvider.java
+++ b/dspace-api/src/main/java/org/dspace/external/provider/impl/OpenaireFundingDataProvider.java
@@ -169,7 +169,19 @@ public int getNumberOfResults(String query) {
String encodedQuery = encodeValue(query);
Response projectResponse = connector.searchProjectByKeywords(0, 0, encodedQuery);
- return Integer.parseInt(projectResponse.getHeader().getTotal());
+ if (projectResponse == null || projectResponse.getHeader() == null) {
+ return 0;
+ }
+ String total = projectResponse.getHeader().getTotal();
+ if (StringUtils.isBlank(total)) {
+ return 0;
+ }
+ try {
+ return Integer.parseInt(total);
+ } catch (NumberFormatException e) {
+ log.error("Failed to parse search result count from OpenAIRE: {}", e.getMessage());
+ return 0;
+ }
}
/**
diff --git a/dspace-api/src/main/java/org/dspace/external/provider/impl/OrcidV3AuthorDataProvider.java b/dspace-api/src/main/java/org/dspace/external/provider/impl/OrcidV3AuthorDataProvider.java
index a9e10f92948d..fe2fdfa95381 100644
--- a/dspace-api/src/main/java/org/dspace/external/provider/impl/OrcidV3AuthorDataProvider.java
+++ b/dspace-api/src/main/java/org/dspace/external/provider/impl/OrcidV3AuthorDataProvider.java
@@ -21,6 +21,7 @@
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.dspace.content.dto.MetadataValueDTO;
+import org.dspace.external.OrcidConnectionException;
import org.dspace.external.OrcidRestConnector;
import org.dspace.external.model.ExternalDataObject;
import org.dspace.external.provider.AbstractExternalDataProvider;
@@ -89,6 +90,9 @@ public void init() throws IOException {
public void initializeAccessToken() {
// If we have reaches max retries or the access token is already set, return immediately
if (maxClientRetries <= 0 || StringUtils.isNotBlank(accessToken)) {
+ if (maxClientRetries <= 0) {
+ log.warn("Maximum retry attempts reached for ORCID token retrieval");
+ }
return;
}
try {
@@ -168,8 +172,14 @@ public Person getBio(String id) {
return null;
}
initializeAccessToken();
- InputStream bioDocument = orcidRestConnector.get(id + ((id.endsWith("/person")) ? "" : "/person"), accessToken);
- return converter.convertSinglePerson(bioDocument);
+ try {
+ InputStream bioDocument = orcidRestConnector.get(id + ((id.endsWith("/person")) ? "" : "/person"),
+ accessToken);
+ return converter.convertSinglePerson(bioDocument);
+ } catch (OrcidConnectionException e) {
+ log.error("Error retrieving ORCID bio for ID=" + id, e);
+ return null;
+ }
}
/**
@@ -200,21 +210,26 @@ public List searchExternalDataObjects(String query, int star
+ "&start=" + start
+ "&rows=" + limit;
log.debug("queryBio searchPath=" + searchPath + " accessToken=" + accessToken);
- InputStream bioDocument = orcidRestConnector.get(searchPath, accessToken);
- List results = converter.convert(bioDocument);
- List bios = new LinkedList<>();
- for (Result result : results) {
- OrcidIdentifier orcidIdentifier = result.getOrcidIdentifier();
- if (orcidIdentifier != null) {
- log.debug("Found OrcidId=" + orcidIdentifier.getPath());
- String orcid = orcidIdentifier.getPath();
- Person bio = getBio(orcid);
- if (bio != null) {
- bios.add(bio);
+ try {
+ InputStream bioDocument = orcidRestConnector.get(searchPath, accessToken);
+ List results = converter.convert(bioDocument);
+ List