0 Replies Latest reply on Jun 20, 2008 5:21 PM by basman

    Entity security with EL using a property from the entity.

    basman

      Hi all,


      Am using Jboss 4.2.2.1, Seam 2.0.2.SP1 and Drools 4.0.7.


      My problem is as follows:


      I have an entity called Template. One of the properties that a Template has is a BusinessDivision. Also worth knowing is that every user of our system has access to one or more businessDivisions.


      A user should only be able to view[read] the template entity if the template's businessDivision is in the the set of businessDivisions that a user can view. I store the user's set of businessDivisions in the user component.



      
      @Entity
      
      @Name("template")
      
      @Restrict("#{s:hasPermission('template', 'management', template.businessDivision, user )}")
      
      public class Template implements Serializable
      
      {
      
      
      ...
      
      
      private BusinessDivision businessDivision;
      
      
      ...
      
      
      public BusinessDivision getBusinessDivision()
      
      {
      
               return businessDivision;
      
      }
      
      
      public void setBusinessDivision(BusinessDivision businessDivision)
      
      {
      
           this.businessDivision = businessDivision;
      
      }
      
      
      ...
      
      
      }
      
      



      How do I get a handle on the specific template's businessDivision using EL? When I try the code shown above I get the exception shown below.


      
      15:51:09,593 ERROR [SeamPhaseListener] uncaught exception
      
      javax.el.ELException: 
      
      javax.ejb.EJBTransactionRolledbackException: Function 's:hasPermission' specifies 3 params, but 4 were declared
      
      at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:333)
      
           at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:342)
      
           at org.jboss.el.parser.AstPropertySuffix.invoke(AstPropertySuffix.java:58)
      
           at org.jboss.el.parser.AstValue.invoke(AstValue.java:96)
      
           at org.jboss.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:276)
      
           at org.jboss.seam.core.Expressions$2.invoke(Expressions.java:173)
      
           at org.jboss.seam.navigation.Page.preRender(Page.java:264)
      
           at org.jboss.seam.navigation.Pages.preRender(Pages.java:316)
      
           at org.jboss.seam.jsf.SeamPhaseListener.preRenderPage(SeamPhaseListener.java:560)
      
           at org.jboss.seam.jsf.SeamPhaseListener.beforeRenderResponse(SeamPhaseListener.java:471)
      
           at org.jboss.seam.jsf.SeamPhaseListener.beforeServletPhase(SeamPhaseListener.java:144)
      
           at org.jboss.seam.jsf.SeamPhaseListener.beforePhase(SeamPhaseListener.java:114)
      
           at com.sun.faces.lifecycle.LifecycleImpl.phase(LifecycleImpl.java:222)
      
           at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:144)
      
           at javax.faces.webapp.FacesServlet.service(FacesServlet.java:245)
      
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
      
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      
           at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:154)
      
           at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:260)
      
           at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:366)
      
           at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:493)
      
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
      
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
      
           at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:58)
      
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      
           at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:85)
      
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      
           at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
      
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      
           at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45)
      
           at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
      
           at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
      
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
      
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      
           at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
      
           at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
      
           at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
      
           at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
      
           at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
      
           at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:179)
      
           at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:524)
      
           at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
      
           at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
      
           at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
      
           at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
      
           at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
      
           at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
      
           at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
      
           at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
      
           at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
      
           at java.lang.Thread.run(Thread.java:595)
      
      ....
      
      



      Yet the same[almost] EL works when called from a facelets xhtml page.


      
      #{identity.hasPermission('template', 'management', templateManager.selectedBusinessDivision, user )}
      
      
      




      So is this a bug? Or am I doing something wrong?


      Your[any] help with this would be most appreciated.