protected void enforceConfigPermission ( final HttpServletRequest httpServletRequest , final IPortletWindow portletWindow ) { Validate . notNull ( httpServletRequest , "Servlet request must not be null to determine remote user." ) ; Validate . notNull ( portletWindow , "Portlet window must not be null to determine its mode." ) ; final PortletMode portletMode = portletWindow . getPortletMode ( ) ; if ( portletMode != null ) { if ( IPortletRenderer . CONFIG . equals ( portletMode ) ) { final IPerson person = this . personManager . getPerson ( httpServletRequest ) ; final EntityIdentifier ei = person . getEntityIdentifier ( ) ; final AuthorizationServiceFacade authorizationServiceFacade = AuthorizationServiceFacade . instance ( ) ; final IAuthorizationPrincipal ap = authorizationServiceFacade . newPrincipal ( ei . getKey ( ) , ei . getType ( ) ) ; final IPortletEntity portletEntity = portletWindow . getPortletEntity ( ) ; final IPortletDefinition portletDefinition = portletEntity . getPortletDefinition ( ) ; if ( ! ap . canConfigure ( portletDefinition . getPortletDefinitionId ( ) . getStringId ( ) ) ) { logger . error ( "User {} attempted to use portlet {} in {} but lacks permission to use that mode. " + "THIS MAY BE AN ATTEMPT TO EXPLOIT A HISTORICAL SECURITY FLAW. " + "You should probably figure out who this user is and why they are trying to access " + "unauthorized portlet modes." , person . getUserName ( ) , portletDefinition . getFName ( ) , portletMode ) ; throw new AuthorizationException ( person . getUserName ( ) + " does not have permission to render '" + portletDefinition . getFName ( ) + "' in " + portletMode + " PortletMode." ) ; } } } }
Enforces config mode access control . If requesting user does not have CONFIG permission and the PortletWindow specifies config mode throws AuthorizationException . Otherwise does nothing .