From 18f03bd32eebc534aec234ceb91cf42cb5c41566 Mon Sep 17 00:00:00 2001
From: BerndBreier <33351391+BerndBreier@users.noreply.github.com>
Date: Wed, 7 Mar 2018 13:25:08 +0100
Subject: [PATCH] TSK-349 Mandatory read permission is not checked in
 WorkbasketQuery if another permission is used as condition

---
 .../pro/taskana/mappings/QueryMapper.java     | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/lib/taskana-core/src/main/java/pro/taskana/mappings/QueryMapper.java b/lib/taskana-core/src/main/java/pro/taskana/mappings/QueryMapper.java
index 93fcc1851..7485dc861 100644
--- a/lib/taskana-core/src/main/java/pro/taskana/mappings/QueryMapper.java
+++ b/lib/taskana-core/src/main/java/pro/taskana/mappings/QueryMapper.java
@@ -203,12 +203,14 @@ public interface QueryMapper {
     @Select("<script>"
         + "SELECT DISTINCT "
         + "w.ID, w.KEY, w.NAME, w.DOMAIN, W.TYPE, w.DESCRIPTION, w.OWNER, w.ORG_LEVEL_1, w.ORG_LEVEL_2, w.ORG_LEVEL_3, w.ORG_LEVEL_4 from WORKBASKET w "
+        + "<if test = 'joinWithAccessList'> "
         + "LEFT OUTER JOIN (select WORKBASKET_ID as WID, max(PERM_READ) as MAX_READ, max(PERM_OPEN) as MAX_OPEN,  "
         + "MAX(PERM_APPEND) as MAX_APPEND, MAX(PERM_TRANSFER) as MAX_TRANSFER, MAX(PERM_DISTRIBUTE) as MAX_DISTRIBUTE, MAX(PERM_CUSTOM_1) as MAX_CUSTOM_1, MAX(PERM_CUSTOM_2) as MAX_CUSTOM_2, "
         + "MAX(PERM_CUSTOM_3) as MAX_CUSTOM_3, MAX(PERM_CUSTOM_4) as MAX_CUSTOM_4, MAX(PERM_CUSTOM_5) as MAX_CUSTOM_5, MAX(PERM_CUSTOM_6) as MAX_CUSTOM_6, MAX(PERM_CUSTOM_7) as MAX_CUSTOM_7, "
         + "MAX(PERM_CUSTOM_8) as MAX_CUSTOM_8, MAX(PERM_CUSTOM_9) as MAX_CUSTOM_9, MAX(PERM_CUSTOM_10) as MAX_CUSTOM_10, MAX(PERM_CUSTOM_11) as MAX_CUSTOM_11, MAX(PERM_CUSTOM_12) as MAX_CUSTOM_12 "
         + "FROM WORKBASKET_ACCESS_LIST where ACCESS_ID IN (<if test='accessId != null'><foreach item='item' collection='accessId' separator=',' >#{item}</foreach></if>) group by WORKBASKET_ID ) a "
         + "on (w.ID = a.WID)"
+        + "</if> "
         + "<where>"
         + "<if test='ownerIn != null'>AND w.OWNER IN(<foreach item='item' collection='ownerIn' separator=',' >#{item}</foreach>)</if> "
         + "<if test='ownerLike != null'>AND (<foreach item='item' collection='ownerLike' separator=' OR ' >UPPER(w.OWNER) LIKE #{item}</foreach>)</if> "
@@ -239,8 +241,14 @@ public interface QueryMapper {
         + "<if test='orgLevel3Like != null'>AND (<foreach item='item' collection='orgLevel3Like' separator=' OR ' >UPPER(w.ORG_LEVEL_3) LIKE #{item}</foreach>)</if> "
         + "<if test='orgLevel4In != null'>AND UPPER(w.ORG_LEVEL_4) IN(<foreach item='item' collection='orgLevel4In' separator=',' >#{item}</foreach>)</if> "
         + "<if test='orgLevel4Like != null'>AND (<foreach item='item' collection='orgLevel4Like' separator=' OR ' >UPPER(w.ORG_LEVEL_4) LIKE #{item}</foreach>)</if> "
+        + "<if test = 'joinWithAccessList'> "
+        + "<if test = 'checkReadPermission'> "
         + "AND (a.MAX_READ = 1 "
+        + "</if> "
         + "<if test='permission != null'>AND "
+        + "<if test = '!checkReadPermission'> "
+        + "( "
+        + "</if> "
         + "<if test=\"permission.name().equals('READ')\">a.MAX_READ</if> "
         + "<if test=\"permission.name().equals('OPEN')\">a.MAX_OPEN</if> "
         + "<if test=\"permission.name().equals('APPEND')\">a.MAX_APPEND</if>"
@@ -259,6 +267,7 @@ public interface QueryMapper {
         + "<if test=\"permission.name().equals('CUSTOM_11')\">a.MAX_CUSTOM_11</if>"
         + "<if test=\"permission.name().equals('CUSTOM_12')\">a.MAX_CUSTOM_12</if> = 1 "
         + "</if>)"
+        + "</if>"
         + "</where>"
         + "<if test='!orderBy.isEmpty()'>ORDER BY <foreach item='orderItem' collection='orderBy' separator=',' >${orderItem}</foreach></if> "
         + "</script>")
@@ -429,12 +438,14 @@ public interface QueryMapper {
 
     @Select("<script>"
         + "SELECT COUNT(w.ID) from WORKBASKET w "
+        + "<if test = 'joinWithAccessList'> "
         + "LEFT OUTER JOIN (select WORKBASKET_ID as WID, max(PERM_READ) as MAX_READ, max(PERM_OPEN) as MAX_OPEN,  "
         + "MAX(PERM_APPEND) as MAX_APPEND, MAX(PERM_TRANSFER) as MAX_TRANSFER, MAX(PERM_DISTRIBUTE) as MAX_DISTRIBUTE, MAX(PERM_CUSTOM_1) as MAX_CUSTOM_1, MAX(PERM_CUSTOM_2) as MAX_CUSTOM_2, "
         + "MAX(PERM_CUSTOM_3) as MAX_CUSTOM_3, MAX(PERM_CUSTOM_4) as MAX_CUSTOM_4, MAX(PERM_CUSTOM_5) as MAX_CUSTOM_5, MAX(PERM_CUSTOM_6) as MAX_CUSTOM_6, MAX(PERM_CUSTOM_7) as MAX_CUSTOM_7, "
         + "MAX(PERM_CUSTOM_8) as MAX_CUSTOM_8, MAX(PERM_CUSTOM_9) as MAX_CUSTOM_9, MAX(PERM_CUSTOM_10) as MAX_CUSTOM_10, MAX(PERM_CUSTOM_11) as MAX_CUSTOM_11, MAX(PERM_CUSTOM_12) as MAX_CUSTOM_12 "
         + "FROM WORKBASKET_ACCESS_LIST where ACCESS_ID IN (<if test='accessId != null'><foreach item='item' collection='accessId' separator=',' >#{item}</foreach></if>) group by WORKBASKET_ID ) a "
         + "on (w.ID = a.WID)"
+        + "</if> "
         + "<where>"
         + "<if test='ownerIn != null'>AND w.OWNER IN(<foreach item='item' collection='ownerIn' separator=',' >#{item}</foreach>)</if> "
         + "<if test='ownerLike != null'>AND (<foreach item='item' collection='ownerLike' separator=' OR ' >UPPER(w.OWNER) LIKE #{item}</foreach>)</if> "
@@ -465,8 +476,14 @@ public interface QueryMapper {
         + "<if test='orgLevel3Like != null'>AND (<foreach item='item' collection='orgLevel3Like' separator=' OR ' >UPPER(w.ORG_LEVEL_3) LIKE #{item}</foreach>)</if> "
         + "<if test='orgLevel4In != null'>AND UPPER(w.ORG_LEVEL_4) IN(<foreach item='item' collection='orgLevel4In' separator=',' >#{item}</foreach>)</if> "
         + "<if test='orgLevel4Like != null'>AND (<foreach item='item' collection='orgLevel4Like' separator=' OR ' >UPPER(w.ORG_LEVEL_4) LIKE #{item}</foreach>)</if> "
+        + "<if test = 'joinWithAccessList'> "
+        + "<if test = 'checkReadPermission'> "
         + "AND (a.MAX_READ = 1 "
+        + "</if> "
         + "<if test='permission != null'>AND "
+        + "<if test = '!checkReadPermission'> "
+        + "( "
+        + "</if> "
         + "<if test=\"permission.name().equals('READ')\">a.MAX_READ</if> "
         + "<if test=\"permission.name().equals('OPEN')\">a.MAX_OPEN</if> "
         + "<if test=\"permission.name().equals('APPEND')\">a.MAX_APPEND</if>"
@@ -619,12 +636,14 @@ public interface QueryMapper {
 
     @Select("<script>SELECT DISTINCT ${columnName} "
         + "FROM WORKBASKET w "
+        + "<if test = 'joinWithAccessList'> "
         + "LEFT OUTER JOIN (select WORKBASKET_ID as WID, max(PERM_READ) as MAX_READ, max(PERM_OPEN) as MAX_OPEN,  "
         + "MAX(PERM_APPEND) as MAX_APPEND, MAX(PERM_TRANSFER) as MAX_TRANSFER, MAX(PERM_DISTRIBUTE) as MAX_DISTRIBUTE, MAX(PERM_CUSTOM_1) as MAX_CUSTOM_1, MAX(PERM_CUSTOM_2) as MAX_CUSTOM_2, "
         + "MAX(PERM_CUSTOM_3) as MAX_CUSTOM_3, MAX(PERM_CUSTOM_4) as MAX_CUSTOM_4, MAX(PERM_CUSTOM_5) as MAX_CUSTOM_5, MAX(PERM_CUSTOM_6) as MAX_CUSTOM_6, MAX(PERM_CUSTOM_7) as MAX_CUSTOM_7, "
         + "MAX(PERM_CUSTOM_8) as MAX_CUSTOM_8, MAX(PERM_CUSTOM_9) as MAX_CUSTOM_9, MAX(PERM_CUSTOM_10) as MAX_CUSTOM_10, MAX(PERM_CUSTOM_11) as MAX_CUSTOM_11, MAX(PERM_CUSTOM_12) as MAX_CUSTOM_12 "
         + "FROM WORKBASKET_ACCESS_LIST where ACCESS_ID IN (<if test='accessId != null'><foreach item='item' collection='accessId' separator=',' >#{item}</foreach></if>) group by WORKBASKET_ID ) a "
         + "on (w.ID = a.WID)"
+        + "</if> "
         + "<where>"
         + "<if test='ownerIn != null'>AND w.OWNER IN(<foreach item='item' collection='ownerIn' separator=',' >#{item}</foreach>)</if> "
         + "<if test='ownerLike != null'>AND (<foreach item='item' collection='ownerLike' separator=' OR ' >UPPER(w.OWNER) LIKE #{item}</foreach>)</if> "
@@ -655,8 +674,14 @@ public interface QueryMapper {
         + "<if test='orgLevel3Like != null'>AND (<foreach item='item' collection='orgLevel3Like' separator=' OR ' >UPPER(w.ORG_LEVEL_3) LIKE #{item}</foreach>)</if> "
         + "<if test='orgLevel4In != null'>AND UPPER(w.ORG_LEVEL_4) IN(<foreach item='item' collection='orgLevel4In' separator=',' >#{item}</foreach>)</if> "
         + "<if test='orgLevel4Like != null'>AND (<foreach item='item' collection='orgLevel4Like' separator=' OR ' >UPPER(w.ORG_LEVEL_4) LIKE #{item}</foreach>)</if> "
+        + "<if test = 'joinWithAccessList'> "
+        + "<if test = 'checkReadPermission'> "
         + "AND (a.MAX_READ = 1 "
+        + "</if> "
         + "<if test='permission != null'>AND "
+        + "<if test = '!checkReadPermission'> "
+        + "( "
+        + "</if> "
         + "<if test=\"permission.name().equals('READ')\">a.MAX_READ</if> "
         + "<if test=\"permission.name().equals('OPEN')\">a.MAX_OPEN</if> "
         + "<if test=\"permission.name().equals('APPEND')\">a.MAX_APPEND</if>"
@@ -675,6 +700,7 @@ public interface QueryMapper {
         + "<if test=\"permission.name().equals('CUSTOM_11')\">a.MAX_CUSTOM_11</if>"
         + "<if test=\"permission.name().equals('CUSTOM_12')\">a.MAX_CUSTOM_12</if> = 1 "
         + "</if>)"
+        + "</if>"
         + "</where>"
         + "<if test='!orderBy.isEmpty()'>ORDER BY <foreach item='orderItem' collection='orderBy' separator=',' >${orderItem}</foreach></if> "
         + "</script>")