From 78fd2fb2e2935fb8779967a2700ec51922197a5d Mon Sep 17 00:00:00 2001 From: brausjonas Date: Tue, 9 May 2023 19:01:35 +0200 Subject: [PATCH] =?UTF-8?q?M=C3=B6glichkeit=20Die=20Rechte=20von=20Usern?= =?UTF-8?q?=20zu=20erh=C3=B6hen?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/database.mv.db | Bin 40960 -> 40960 bytes backend/database.trace.db | 24 ++++++ .../backend/anwprj/DataBaseHandler.java | 27 ++++-- .../anwprj/controller/UserController.java | 80 ++++++++++-------- 4 files changed, 91 insertions(+), 40 deletions(-) diff --git a/backend/database.mv.db b/backend/database.mv.db index e02110209b915bed38bff7be707d2331bbd3b594..8e5008d4f7395060e286075addb5c6dc80869f8a 100644 GIT binary patch literal 40960 zcmeHQO>88`b?zDdOpDsJ49gaDuz}|6FO~72s{g8b3`I#)vIt=K667T0mLNy~!!T^ffMcC>5G*7)B!B@Q1o#JVE=GVHl3UJs{X5N> z;c~dku}o|cyHnNO)zz9w$bu*U{)_Cs-SxYOT{3x>O55WFJ}8k|^x;|p_1k$+MHQUg*0 zQUg*0QUg*0QUg*0QUg*0QUg*0QUjm62G%A1|J>U^3LrHgH6S%0H6S%0H6S%0H6S%0 zH6S%0H6S%GYYikuejJ7=3qY^!iv0$z?Xmj}tUHjt4{QJf)%L~v1Kk?j z`-27v10V_@-M6q=8|>_fhGY7UDTbtgsNz9CXb2N)XY?0Q3a*rPlya%0D1Z5hqS&uO zswky@d$oE=wH#(MM6jYP-mkn}DpwU1TObn`Ld7AmxLJXH+@eU;5e|%iGsyUiV>fAO1U{0vIAO^Pt z>V73)-s+xo&-SFX1U<;kt0y5O*3gTw=Q5)$$gZJxiB?KYC<4zQHpv!A4fZp}!%1B}8Y}@_!vTl}@TC8M)pzL_EkoyDl6Z^Q{_ zN#Z9-kR*I@pY4fy??RmH_WkHtc`@7AWcTy@wg|rx@9*Ci``rV!e+Z8p(DV+IQwPl7 z6?JqmE|P3uTs&kHH>~0YDQ-9~B{hh>`x|{91o%R{{a~N>H~M$$_~@ptMMoR?(Ue%2 z4iF6-ilYTG=3${gtbj%@zPHBcy`0v28xTmhoDHoI%;^}Q2hkl+5@*K}|qOvCjtiHn+qiJm& zCyAaURwdr)8%fGpn)+!P{9`GbMEmI^+Ds?WyE_lXW;}sLwJ85)JbBJ0*Cd`?Tfnr9 z=hjv_x7O3SwTS1|$O?Hrx29$oI<*J;4-N%)2g9er&q=s&r}2E-3|Xxo1P|`B{oqjp z>Hm<+7^E_iSVoxcXEK_!D5RAlfJ8{$^ie9FlTH1jnLo1qz!{3iu;EV-PZY!pV)3vb zdO<#FApC<|LY_+KjA*ea9y%hP4LVGK3C^T5WAR{aZfC%RGE77&9pDt$WMqP{ydW%3 zbjibltO$RYODa-H*{LLrTiYKMm`)NnmoNub<#na>%P&K!DCM6e zX}lqSCTJiVI)?cBValhEpmWZrcR0aJ4~#Ry(0MgW$@L?Wf93^H#Q%OgM1>jrH`7j= z!hee5P8-30J$uRmC$xh65sK=K;6Hbq{F2X_iSd8=g9QISew^TcNMIdc1pm+fP~v}y z|K*y+H2CGL%1Hb#7t21Eg~Azhywl?U#eXf}f0p8ZKgRYF|3}LKC*XfrZGSTUhXNA+ zkFIKD(71@kpIiLT0RQ`dJN{+q?p3LXnY|cpaHC- zokF3JK#{~IM+Jcq23(y&pafT^8wsvXl>??cz}1^jehHU|^&W_j|aCNpp@QJwk zOB1l9+;#pmFpj@7{2yWG9RC|3@xi7{o)tWgo}c1>9A?Xc$=Wre8m3Ws(iatUOt`uU)uep-CuGZMj-4App~@gOCrt5 zM57sWywhR&#osFnhAiE0JZU;+ViiaWriVy0>d%(*b5Oky8}jIUEl zLlvfaOb{AWY=V3vV2~O*(QVZxfx~GiRNLXE6$A`2A|TWI+LRUQm{`tG7E|S6kio+^*Ma-fC~OG$0RD zwd%$1mXf{Nt&X>?wb!(*n_bPj-R^WdTGefBR<(}1(bcYD9N2cq93~jNqXK+QTX#F_ z+BL*|-J*`*rfG+Pi3|fSi&`za8Y^e(*2YFH5n`>q-RW+*n_g90U3a(L)h;Wd zfmYID8}2lvHr@8dq zUC`~*sUy;H+6JAjyWQ2^ZgG>=jq;RleiAHTr%F4X$LC|Bxy5FXv3wI>!;NCbTU1q##cb&zdAwV zE%(mM6u#pCFWFY}PC@7C;chz`bYUPLZKCJ^jBca5+goclC%ufoacX60 zr3TITe)>wE;*~SqT^`qpqwg4)_g7!}<@~QpC8eY+FVBA&W&&%v?smkUKL1}Y!9OVR z#aDj5@SC(m6}GRx^52WUEmgAF6P&kPtu9}>ynOl6@|7#gSFbK#yS5y82Yls~%FsK& zPT2to|6j5LreFu)kUp6m00ksFK(Yg#;2mHCJAlBm`1sYoQH$OIB=-bx@*K-^{xk6e zew6bBNNUx#Mws_SlY7Q%H)7%~cz9;S_KbGVW3PaScAryjZ39;5hW2bAwohc?7o7x1 zVw>YWDHycFu*hw9QfV`X;3u&f5+?zY+2AuT;oOrUw!vc*@}bNk@Wa!|?8GwLz=|$7 zHW))PK1&5QrY7TqSP5w$<2C03Cx&7Sb>GX64HQiRN(XAEfPBn z#BKqwxa~v^1M$Yp90ndo&fAJodL16kZvm0}v9j=K8PZRbg@1pnDDcQG{Nk_RUHiJS z@T(6X1?TRMlQiBq&p#Ree`tR%TF`U*KP3c%VPIDLfAG9ZpB_7XdiG-f|K!1*;9iqF zAS3QI;H@$gK6gclmR`>C5A6T*|GDsEMft*z-gUwNo)6^(=Px;^LzD+Os6Ri0`pGVU z5agmb7oks00vcr}Mr5Gj$S@=Z72o9OJh=eQ`UMGZwAyFVab*V9J!$`!_WvivwwXbf zllK4Fg%FxSb4mOEISuh7?f=P)LE8V%k^Miz|3myeoG6PS|DQ$v|K`l_|F}y~g8xtN z`IAXs^zu1N^si}&|Nq|}jsN!;X3V4h|G%IAW=V24C3h2|UOjc}IXQQeb2k|dbM~P? z<=pLQ=WZ81DogIBrZ){2Tyi%hck`_L3Z`Q10Ufzw?%jrLJ;@e|y#{~U)%Afm z9IQi#)`RURS2!M5bFCfi#qFp7?!@`gBCwWGefgu4c&IOb|0oaj<^P$AhkE$MzpE6v zZ<8Y9ikvVJJ`+u17}GV2j5|F!D~gMo#B|MBSx*j#8^y+%7MR(i`eETQ=lVlip52=E+0kB;WKHx9Xo9diI}k_TzC;lAuuw zA&0WSBhMHosTdr&*!cO!NQ%q@XEZ);8ir?9aeRR0R{CF{xz#>V=Jg9P-ECeZbhr6E zSjYsr+x)u`-3`*e_~0ph)8sp3=;a{!|Meu;{WSf6@M)L6vA<&i^+dP|pnG|BZ*- zEZYB1A6#>I4|(LwGa~^+{Qs{leyAuHhy4E&Kx_(UL8H$toXz4op3L|^O|-`xAx?w5 zPXT8$FO-v|m2futw&oEyJ58M5BSimb8KdyE&u5DBi}IzGA_J%(A4Ri<+kl&EpN+@B zk)N^rBmRV^wEs){zl_}!$AFTtn_#MV=CQh@{eL`C)p6^hM?!H)`@gjRPZum{f5&>_{obRcFys?#ffj?8N~npe_z{e`v3p{ literal 40960 zcmeHQ&2J=0R?jNi?QD;G8i}tttTg57uQAk?G9oi0GV9b;u5!D;cF(%1d%7=_A~Pd< zOxv!OT|G<>90mkpg*eP%wE}@aEYb=P5-Y)BkvJ^kw&JoYgkbo(fIwUje*wJwh|H+0 zs&=*8-tL_atGgmHGcxkUFCrt}d-2}Otp=`n2SfjH!%WiN{wKVF48y4TA3i;L+(102 z`Ny1%c+fx&4IS(noZ(tHJU(P2xcei1e6l}0iVKDZeB^(~j~gz78nET9XzEWPpb$_9 zCy)5Kssx1QY@afme>emXiNpc^@bO6aoqXg@8gpA)pXY2q**;0tx|z zfI>haaM1{eO@24E0>HHc4tx2vL-wSBkO%3<4TQlO;D~=bYFM==>=8c!ox$;NIBHO4 z!8X5vN$8T=X#bEmT$7pxHYK9~w>BF3jUYgkbNU05g3E8|U(uFUwNiOuap}^setG4s zRc)G+ciEQq;mKWGAG|e$x z+ps+D83wn*z~S7b0kV~{8`W$jAqVWr*KY~BNko4rc6-P!GT`wuI< z&R6brb~oh8dJlX3&dxww8Mqx}I0Q8ZmTNcz%jq-+%}tXIEZS*q+D6l8w@EbyXZPOr zb}b=dv%A;p?>2Wj)yl?JbFaD42Wsv&_a1h4@4ROk>uIs=<~*f#n%(Vb_1IZG?>BqB z5ANB8<~M==Ga>{mKX3{#FH5 z_Bzrbt+YDZcX#jf2K~E(xKD3DXaChHo!#r~KqZ~Mi|TJ{({}Mj+ZedmKm)7UY7bm$ zLC>RBbHi+!Xp`WH{*GJqL8tSxyZ3flK$~cN+RvTc_UwzN50kj|hn?oMddE($tlxaW z?wqf+b9E=4=+0Zvo&P4r){J*I!sWu=U1Zu#w@sRZ7H-2E+i8)3L)zA$gF727+H{fK zq?3J_4lrpVNxN}MAFiyw_kxJeN7ES*UkAkh@f5_{&4(8T_(rE=ZX!wscFSl1;I=bp zQkXXFHX&}?c1?E!CaGv8ktRzZsJk0sTYPPzb5bv?tpC&tVm%)@b7AdFjP9QXtpDPa z$qJU4y>92i;6|Ia10xv^nj0;ctDH8BZ=>Z5XuGpPTEytM&FOIGYh*gKqa`$1WZSKW z66WdUem9zQVInVfQFH-jx8mvU?&jTTixC(}uCJ`upc_9L^KYlGw}fNzY8ufTgLIrv9Il z1mh^oM`_GB0{giC5#Ir((TH>J$Lyk!vXgGYP7=>Z`AC}bk&YAbk!HwUOYo6|BA?fu z9z8t)!&6`@F$%5pusOP)*_={|)x_xhQ9yw2|MziHE8&U8Lf88ngN~Bi+)R$>2 zGU#wIX3&F_MpMuj1B+eP&S`Xk2b_YWBhd(jfoX^CkZH7YAZbctPyo^atRhg8Zl47t zFB0iTy^pwsoUHd<9E#qb)!j6eEDV`Q>kl#@os>wkNTf`oIo8?4DF`~EuOoA2__NF$ z$5|s%#u3^BINCUrNpwnRl_rA+d4_AjK@5O_ecxP7Whyub7+gvE4}=alNQr=AI6E+H z%g7I03u{{Gwx-oSj|Io_@as`p`uBHY*$m#PP;@=KQ-oqnr;G$yd^6(~SpHZG(4S=> zTPet_0J4nn`0G!EFe%ko%q+i6qWSMI0;yicuC?XNpR_i9rF5MHBJtOUYm{BTjF4cJ<0NWJpA$a z{O}1s>L0VC6XuV=BjO~vb;P^_UN^49MUn%Acf#Qoc?$LJXs(HpfQNs)+n~^W?X&Rw%TLjTi^Qk;3*z%+R(r5q+q z8YaZ0eKxx?M{0vvY(MC}CR$};k8s;GuJVa?GccztnXWYDO)`EHh6sk(pXnUMBJHXX`pk*8``(g;Gl<(jMcUkP9O*Q4qW7n$BYW z#d1*2BZGo?DukW{A&XZHL`-=VcWgsqJiHfRJko9#5EdB^CfF}&88eL#r~MptyTyQq zn?zKm*-IG@S@lK)CNa$-QeKYzm`Lsg za<}^tLz=AR5!(q2X;S+%hBWC=6SUtELz;+fAiYHlX>tIH<%l6o4=e{5QtdV{q<c1pKB)ALYB zb=!AL#to#~flGbHEZycP2)Gqx5`hac9(Eij)QN2{P91-lP{T8Q2C0cDCOVd4xtWrOq~Ws;39@}8k*E2feRTA_-h(vLWf1q5|a2b!^{dSW7#ud z--;Q_J|>_cw3j)>A*F^cgy&@*5YI+|E(G!$!{bNw4{`nQqm$9_nAb*@!of zkJ+*9xTqufF^A;NU(xc*M|lv-GfXQvCOxx5h7{JKH-gQVvIKwY{Nch{SZ>kqOI&+A#0;;S1?INQUcN8*J% zuLqr1J-9$HOdp_??ZM0fJD#BIyxs!!BPc2PF+cM8^?9euFV9o$4s6`UHAb57rGF{s znsCsm#TxM-)^aONc%&FVRTJ)=rV00yCcLQM7fNDTFa5@9!hO($2ky^w zr9Uq%X{E>&Qd{f({P2jKbiHHt^yESO8=tuS=#cFn)cxV%7Q&{rc75w`|1s}+Y@Z)L zh_dxKTPRk!afco3|4g`lGTMLq0J8NYTP${SYs61RTVShyycgw)*Kc*Bv#1*tK)pC$ zECQBf|9bT=%i7y>%g?zbS(XdlESdUSnYq?1n=;v0OPFDw*{L^o#)x_RNpq+`;`^r> zn3<;=m_^2UxeI}Hjs|8jb<+jxKpB{Ui+AGMeXa&(xpzy^&RiHjf+e}s?ZWu+toG;6 zADWp>x@-i8pKk=0NV=(4Mk@A#SB9UNx}9bOC%iIh-_gp$zm4?~x_6#xLj?fftX0MNdv{~yTzi?RIw znu`CLw)CrSFPF8enQR|$A+rae$Z?eA@*oCgcFxLj_Df0mev5kfPK z{c+5U5f(16V89vuSsX$1fg}Q!WijIBzC$(#^Uf*0L((Q0P!c&Un<14Y67x?pO2aYV zq2~u#NGQeNT3+zQqOqG3aV$F{)du5Nl9MXOT#y~dP%hU8VN5ERvdS(*VQ8RS#zQH! zB9@qt@c^nRGF}oC0%{l!F=nT7sFOrl;EqJ~3`AuQYm_)T5ji*j3Vv50%4dbG7}Guo zFYvR*t&lO4iJKaz!lK#8D8wE{}F%9{QvVn zCB~Gv5b@Yg-SCo75UB=YEG|SEJ%z_^cp{Wa?1m=}VmG`o4a9d74a9HXe{C%z6k!Sh zg@8gpA)pXY2q**;0tx|zfI>hapb+@tARzYt^Zj>u2R+;Wr!K_*10V8p-b=4!@&AhP zo)Y{2)KusN;yUHj=O#AiOLXG@|4ZZk{}2bD^sV1|x0*TogUb287yqGDepl0x?YUOK zxehTD9oyvuGRy_{e!h&TMNr@^BiG@?M$3>7AatD$(b9br0&qgcV*xU_jxj?9^NEfv z<`9EGCLk6#^+RD!%>cp$=r{~QM8N^ygii+q%yM+$Ca0TGVcS8v$r1M%R0zTGc<2TM zGJ(q-Omz#nhUYs>w@gOB{om0o@b<^12bX-pF(n)_4hfjy>lP;tHeE-z4KoOFVCc4K z!Q*YL+m>l@3(D9wgXjj_)rh8F%n*N^n-c&;sRXm!R9pmn}+~Z z=7(#*%+p^NFsK%nk});U;~~<^w@aUu%hfMPq!$(7B@Q_=Z92Vxk){H?TwKha3+OHt z;N>-pyQG4*B=N9bGp__@ zp8Hb9cz>K3WC^>RVtDLnCQqqaD*7r%V)G=NmQML3&zu3=^RIJA);VELs?gQ(LTvQs zkop21G`W}Ej6msf828M{Mm8LzIjQ19JtC}!FvWWgsX3~dvrlYEHuL*DbD}!+b3IhW z@fVTu6FbMrPpMA&vdIHrs+(o(%O*mw!#A~rliIljbpKR}x&zTyA^HwzU*X($w1uDh z4T!|^skZRdGNf?)8I+~4)_?6+pxkY3;rG4hapb$_9C addUser(@RequestBody User user) - { + public ResponseEntity addUser(@RequestBody User user) { User checkUser = db.getUser(user.getMail()); - if(checkUser != null) - { + if (checkUser != null) { return new ResponseEntity<>("mail", HttpStatus.FORBIDDEN); } //if user was successfully added to database User u = db.addUser(user); - if (u != null) - { + if (u != null) { //generate a session id return new ResponseEntity(UserSessionIDHandler.addUser(user.getMail(), user.getPassword()), HttpStatus.OK); } @@ -46,8 +42,7 @@ public class UserController //a user wants to login @CrossOrigin @GetMapping("/users") - public ResponseEntity login(@RequestParam(name = "mail") String mail, @RequestParam(name = "password") String password) - { + public ResponseEntity login(@RequestParam(name = "mail") String mail, @RequestParam(name = "password") String password) { //generate a session id for the user trying to login String sessionID = UserSessionIDHandler.addUser(mail, password); @@ -56,28 +51,23 @@ public class UserController @CrossOrigin @GetMapping("/users/logout") - public ResponseEntity logout(@RequestParam(name = "sessionid") String sessionID) - { + public ResponseEntity logout(@RequestParam(name = "sessionid") String sessionID) { boolean success = UserSessionIDHandler.removeUser(sessionID); return new ResponseEntity<>(success, HttpStatus.OK); } @CrossOrigin @PutMapping("/users") - public ResponseEntity updateUser(@RequestParam(name="sessionid") String sessionID, @RequestBody User u, @RequestParam(name="mail") String mail) - { + public ResponseEntity updateUser(@RequestParam(name = "sessionid") String sessionID, @RequestBody User u, @RequestParam(name = "mail") String mail) { User sessionUser = UserSessionIDHandler.getUserBySessionID(sessionID); - if(sessionUser != null) - { - if (sessionUser.getMail().equals(mail) || sessionUser.getPermissions() == UserPermissions.admin.getValue()) - { + if (sessionUser != null) { + if (sessionUser.getMail().equals(mail) || sessionUser.getPermissions() == UserPermissions.admin.getValue()) { System.out.println(sessionUser.getId()); - User resultingUser = db.updateUser(u, sessionUser.getId()); + User resultingUser = db.updateUser(u, sessionUser.getId(), false); - if (resultingUser != null) - { + if (resultingUser != null) { UserSessionIDHandler.removeUser(sessionID); return new ResponseEntity<>(true, HttpStatus.OK); } @@ -90,19 +80,45 @@ public class UserController } @CrossOrigin - @GetMapping("/users/data") - public ResponseEntity getUserData( - @RequestParam(name="sessionid") String sessionID, - @RequestParam(name="mail") String mail) + @PutMapping("/users/elevate") + public ResponseEntity elevateUser( + @RequestParam(name = "sessionid") String sessionID, + @RequestParam(name = "mail") String mail, + @RequestParam(name = "permission") int permission) { User sessionUser = UserSessionIDHandler.getUserBySessionID(sessionID); - if(sessionUser != null) + if(sessionUser != null && sessionUser.getPermissions() == UserPermissions.admin.getValue()) { + System.out.println("test"); + User userToUpdateTemplate = db.getUser(mail); + User userToUpdate = new User(userToUpdateTemplate.getId(), userToUpdateTemplate.getFirstName(), userToUpdateTemplate.getLastName(), + userToUpdateTemplate.getMail(), userToUpdateTemplate.getPassword(), permission); + + User resultingUser = db.updateUser(userToUpdate, userToUpdate.getId(), true); + + if(resultingUser == null) + { + return new ResponseEntity<>(false, HttpStatus.NOT_FOUND); + } + + return new ResponseEntity<>(true, HttpStatus.OK); + } + + return new ResponseEntity<>(false, HttpStatus.FORBIDDEN); + } + + @CrossOrigin + @GetMapping("/users/data") + public ResponseEntity getUserData( + @RequestParam(name = "sessionid") String sessionID, + @RequestParam(name = "mail") String mail) { + User sessionUser = UserSessionIDHandler.getUserBySessionID(sessionID); + + if (sessionUser != null) { System.out.println(sessionUser.getMail() + " " + mail); - if (sessionUser.getMail().equals(mail) || sessionUser.getPermissions() == UserPermissions.admin.getValue()) - { + if (sessionUser.getMail().equals(mail) || sessionUser.getPermissions() == UserPermissions.admin.getValue()) { User searchedUser = db.getUser(mail); return new ResponseEntity<>(searchedUser, HttpStatus.OK); } @@ -113,13 +129,11 @@ public class UserController @CrossOrigin @DeleteMapping("/users") - public ResponseEntity deleteUser(@RequestParam(name="sessionid") String sessionID, @RequestParam(name="mail") String mail) - { + public ResponseEntity deleteUser(@RequestParam(name = "sessionid") String sessionID, @RequestParam(name = "mail") String mail) { User sessionUser = UserSessionIDHandler.getUserBySessionID(sessionID); - if(sessionUser != null && sessionUser.getPermissions() == UserPermissions.admin.getValue()) - { - return new ResponseEntity<>(db.deleteUser(mail), HttpStatus.OK); + if (sessionUser != null && sessionUser.getPermissions() == UserPermissions.admin.getValue()) { + return new ResponseEntity<>(db.deleteUser(mail), HttpStatus.OK); } return new ResponseEntity<>(HttpStatus.FORBIDDEN);