<commit_before>package gov.nih.nci.security.ri.struts.actions;

import gov.nih.nci.security.ri.dao.EmployeeDAO;
import gov.nih.nci.security.ri.struts.Constants;
import gov.nih.nci.security.ri.valueObject.Employee;

import java.util.LinkedList;
import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.action.ActionMessage;
import org.apache.struts.action.ActionMessages;

/**
 *  Performs authorization and securely updates the employee record.
 * 
 * @author <NAME>
 *  
 */
public class UpdateEmployeeAction extends BaseAction {

	static final Logger log = Logger.getLogger(UpdateEmployeeAction.class
			.getName());

	/*
	 * Updates the employee.  The employee object is secured based
	 * on the authorization policy defined in the authorization database.
	 * 
	 * @see org.apache.struts.action.Action#execute(org.apache.struts.action.ActionMapping,
	 *      org.apache.struts.action.ActionForm,
	 *      javax.servlet.http.HttpServletRequest,
	 *      javax.servlet.http.HttpServletResponse)
	 */
	public ActionForward executeWorkflow(ActionMapping mapping,
			ActionForm form, HttpServletRequest request,
			HttpServletResponse response) throws Exception {
		// TODO Auto-generated method stub
		ActionMessages messages = new ActionMessages();

		Employee originalObject = (Employee) request.getSession().getAttribute(
				ORIGINAL_EMPLOYEE_OBJECT);

		log.debug( "The original salary is: " + originalObject.getSalary() );
		Employee mutatedObject = (Employee) form;

		//secure the object by setting attributes to null where
		//the UPDATE_DENIED access is specified
		Employee securedObject = (Employee) getAuthorizationManager()
				.secureUpdate(getUser(request).getUserName(), originalObject,
						mutatedObject);

		Employee savedObject = EmployeeDAO.updateEmployee(securedObject);

		List l = new LinkedList();
		l.add(savedObject);

		request.getSession().setAttribute(EMPLOYEE_LIST, l);
		request.getSession().setAttribute(EMPLOYEE_ID,
				savedObject.getEmployeeId().toString());
		messages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(Constants.MESSAGE_ID, "Updated Employee Successfully"));
		saveMessages( request, messages );

		return mapping.findForward(ACTION_SUCCESS);

	}
}<commit_msg>added additional security for managers being the only ones able to update employee projects<commit_after>package gov.nih.nci.security.ri.struts.actions;

import gov.nih.nci.security.ri.dao.EmployeeDAO;
import gov.nih.nci.security.ri.struts.Constants;
import gov.nih.nci.security.ri.util.SecurityUtils;
import gov.nih.nci.security.ri.valueObject.Employee;

import java.util.LinkedList;
import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;
import org.apache.struts.action.ActionErrors;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.action.ActionMessage;
import org.apache.struts.action.ActionMessages;

/**
 * Performs authorization and securely updates the employee record.
 * 
 * @author <NAME>
 *  
 */
public class UpdateEmployeeAction extends BaseAction {

	static final Logger log = Logger.getLogger(UpdateEmployeeAction.class
			.getName());

	/*
	 * Updates the employee. The employee object is secured based on the
	 * authorization policy defined in the authorization database.
	 * 
	 * @see org.apache.struts.action.Action#execute(org.apache.struts.action.ActionMapping,
	 *      org.apache.struts.action.ActionForm,
	 *      javax.servlet.http.HttpServletRequest,
	 *      javax.servlet.http.HttpServletResponse)
	 */
	public ActionForward executeWorkflow(ActionMapping mapping,
			ActionForm form, HttpServletRequest request,
			HttpServletResponse response) throws Exception {
		// TODO Auto-generated method stub
		ActionMessages messages = new ActionMessages();

		Employee originalObject = (Employee) request.getSession().getAttribute(
				ORIGINAL_EMPLOYEE_OBJECT);

		log.debug("The original salary is: " + originalObject.getSalary());
		Employee mutatedObject = (Employee) form;

		//secure the object by setting attributes to null where
		//the UPDATE_DENIED access is specified
		Employee securedObject = (Employee) getAuthorizationManager()
				.secureUpdate(getUser(request).getUserName(), originalObject,
						mutatedObject);

		EmployeeDAO.updateEmployee(securedObject);

		if (isAuthorized(request)) {
			EmployeeDAO.updateEmployeeProjects(securedObject);
			messages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(
					Constants.MESSAGE_ID, "Updated Employee Successfully"));
		} else {
			
			messages.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(
					"access.modify.employee_project.denied", new String[] {
							getUser(request).getUserName(),
							", " + SecurityUtils.getObjectIdForEmployeeProjecAccess() }));

			
		}
		
		saveMessages(request, messages);

		List l = new LinkedList();
		l.add(securedObject);

		request.getSession().setAttribute(EMPLOYEE_LIST, l);
		request.getSession().setAttribute(EMPLOYEE_ID,
				securedObject.getEmployeeId().toString());

		return mapping.findForward(ACTION_SUCCESS);

	}

	private boolean isAuthorized(HttpServletRequest request) throws Exception {

		String user = getUser(request).getUserName();

		return getAuthorizationManager().checkPermission(user,
				SecurityUtils.getObjectIdForEmployeeProjecAccess(), EXECUTE);
	}

}
{'fraction_non_alphanumeric': 0.10089332632685234, 'fraction_numerical': 0.0003503240497460151, 'mean_word_length': 4.985324947589098, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6616163', 'n_tokens_mistral': 1784, 'n_tokens_neox': 1590, 'n_words': 341}