protected boolean canAlterPermissions ( ModeledAuthenticatedUser user , ModeledPermissions < ? extends EntityModel > targetEntity , Collection < ObjectPermission > permissions ) throws GuacamoleException { // A system adminstrator can do anything if ( user . getUser ( ) . isAdministrator ( ) ) return true ; // Verify user has update permission on the target entity ObjectPermissionSet permissionSet = getRelevantPermissionSet ( user . getUser ( ) , targetEntity ) ; if ( ! permissionSet . hasPermission ( ObjectPermission . Type . UPDATE , targetEntity . getIdentifier ( ) ) ) return false ; // Produce collection of affected identifiers Collection < String > affectedIdentifiers = new HashSet < String > ( permissions . size ( ) ) ; for ( ObjectPermission permission : permissions ) affectedIdentifiers . ( permission . getObjectIdentifier ( ) ) ; // Determine subset of affected identifiers that we have admin access to ObjectPermissionSet affectedPermissionSet = getPermissionSet ( user , user . getUser ( ) , user . getEffectiveUserGroups ( ) ) ; Collection < String > allowedSubset = affectedPermissionSet . getAccessibleObjects ( Collections . singleton ( ObjectPermission . Type . ADMINISTER ) , affectedIdentifiers ) ; // The permissions can be altered if and only if the set of objects we // are allowed to administer is equal to the set of objects we will be // affecting. return affectedIdentifiers . size ( ) == allowedSubset . size ( ) ; }
Determines whether the current user has permission to update the given target entity adding or removing the given permissions . Such permission depends on whether the current user is a system administrator whether they have explicit UPDATE permission on the target entity and whether they have explicit ADMINISTER permission on all affected objects . Permission inheritance via user groups is taken into account .