1   /**
2    * Copyright (c) 2000-2009 Liferay, Inc. All rights reserved.
3    *
4    * Permission is hereby granted, free of charge, to any person obtaining a copy
5    * of this software and associated documentation files (the "Software"), to deal
6    * in the Software without restriction, including without limitation the rights
7    * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
8    * copies of the Software, and to permit persons to whom the Software is
9    * furnished to do so, subject to the following conditions:
10   *
11   * The above copyright notice and this permission notice shall be included in
12   * all copies or substantial portions of the Software.
13   *
14   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
18   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
19   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
20   * SOFTWARE.
21   */
22  
23  package com.liferay.portal.upgrade.v4_4_0;
24  
25  import com.liferay.portal.kernel.dao.jdbc.DataAccess;
26  import com.liferay.portal.kernel.log.Log;
27  import com.liferay.portal.kernel.log.LogFactoryUtil;
28  import com.liferay.portal.model.Group;
29  import com.liferay.portal.model.Location;
30  import com.liferay.portal.model.Organization;
31  import com.liferay.portal.model.ResourceConstants;
32  import com.liferay.portal.model.Role;
33  import com.liferay.portal.model.UserGroup;
34  import com.liferay.portal.upgrade.UpgradeException;
35  import com.liferay.portal.upgrade.UpgradeProcess;
36  import com.liferay.portlet.bookmarks.model.BookmarksFolder;
37  import com.liferay.portlet.documentlibrary.model.DLFolder;
38  import com.liferay.portlet.imagegallery.model.IGFolder;
39  import com.liferay.portlet.messageboards.model.MBCategory;
40  import com.liferay.portlet.shopping.model.ShoppingCategory;
41  
42  import java.sql.Connection;
43  import java.sql.PreparedStatement;
44  import java.sql.ResultSet;
45  
46  /**
47   * <a href="UpgradePermission.java.html"><b><i>View Source</i></b></a>
48   *
49   * @author Brian Wing Shun Chan
50   *
51   */
52  public class UpgradePermission extends UpgradeProcess {
53  
54      public void upgrade() throws UpgradeException {
55          _log.info("Upgrading");
56  
57          try {
58              doUpgrade();
59          }
60          catch (Exception e) {
61              throw new UpgradeException(e);
62          }
63      }
64  
65      protected void deletePermissionByActionIdAndResourceName(
66              String actionId, String resourceName)
67          throws Exception {
68  
69          Connection con = null;
70          PreparedStatement ps = null;
71          ResultSet rs = null;
72  
73          try {
74              con = DataAccess.getConnection();
75  
76              ps = con.prepareStatement(_GET_PERMISSION_SQL);
77  
78              ps.setString(1, actionId);
79              ps.setString(2, resourceName);
80  
81              rs = ps.executeQuery();
82  
83              while (rs.next()) {
84                  long permissionId = rs.getLong("permissionId");
85  
86                  deletePermissionByPermissionId(permissionId);
87              }
88          }
89          finally {
90              DataAccess.cleanUp(con, ps, rs);
91          }
92      }
93  
94      protected void deletePermissionByPermissionId(long permissionId)
95          throws Exception {
96  
97          runSQL(
98              "delete from Permission_ where permissionId = " + permissionId);
99          runSQL(
100             "delete from Groups_Permissions where permissionId = " +
101                 permissionId);
102         runSQL(
103             "delete from Roles_Permissions where permissionId = " +
104                 permissionId);
105         runSQL(
106             "delete from Users_Permissions where permissionId = " +
107                 permissionId);
108     }
109 
110     protected void deletePermissionByResourceId(long resourceId)
111         throws Exception {
112 
113         Connection con = null;
114         PreparedStatement ps = null;
115         ResultSet rs = null;
116 
117         try {
118             con = DataAccess.getConnection();
119 
120             ps = con.prepareStatement(
121                 "select permissionId from Permission_ where resourceId = ?");
122 
123             ps.setLong(1, resourceId);
124 
125             rs = ps.executeQuery();
126 
127             while (rs.next()) {
128                 long permissionId = rs.getLong("permissionId");
129 
130                 deletePermissionByPermissionId(permissionId);
131             }
132         }
133         finally {
134             DataAccess.cleanUp(con, ps, rs);
135         }
136     }
137 
138     protected void deleteResource(long codeId) throws Exception {
139         Connection con = null;
140         PreparedStatement ps = null;
141         ResultSet rs = null;
142 
143         try {
144             con = DataAccess.getConnection();
145 
146             ps = con.prepareStatement(
147                 "select resourceId from Resource_ where codeId = ?");
148 
149             ps.setLong(1, codeId);
150 
151             rs = ps.executeQuery();
152 
153             while (rs.next()) {
154                 long resourceId = rs.getLong("resourceId");
155 
156                 deletePermissionByResourceId(resourceId);
157 
158                 runSQL(
159                     "delete from Resource_ where resourceId = " + resourceId);
160             }
161         }
162         finally {
163             DataAccess.cleanUp(con, ps, rs);
164         }
165     }
166 
167     protected void deleteResourceCode(String resourceName)
168         throws Exception {
169 
170         Connection con = null;
171         PreparedStatement ps = null;
172         ResultSet rs = null;
173 
174         try {
175             con = DataAccess.getConnection();
176 
177             ps = con.prepareStatement(
178                 "select codeId from ResourceCode where name = ?");
179 
180             ps.setString(1, resourceName);
181 
182             rs = ps.executeQuery();
183 
184             while (rs.next()) {
185                 long codeId = rs.getLong("codeId");
186 
187                 deleteResource(codeId);
188 
189                 runSQL(
190                     "delete from ResourceCode where name = '" + resourceName +
191                         "'");
192             }
193         }
194         finally {
195             DataAccess.cleanUp(con, ps, rs);
196         }
197     }
198 
199     protected void deleteRolesPermissions(String roleName) throws Exception {
200         Connection con = null;
201         PreparedStatement ps = null;
202         ResultSet rs = null;
203 
204         try {
205             con = DataAccess.getConnection();
206 
207             ps = con.prepareStatement(_GET_ROLES_PERMISSIONS_SQL);
208 
209             ps.setString(1, roleName);
210 
211             rs = ps.executeQuery();
212 
213             while (rs.next()) {
214                 long roleId = rs.getLong("roleId");
215 
216                 runSQL(
217                     "delete from Roles_Permissions where roleId = " + roleId);
218             }
219         }
220         finally {
221             DataAccess.cleanUp(con, ps, rs);
222         }
223     }
224 
225     protected void deleteUsersPermissions(int scope) throws Exception {
226         Connection con = null;
227         PreparedStatement ps = null;
228         ResultSet rs = null;
229 
230         try {
231             con = DataAccess.getConnection();
232 
233             ps = con.prepareStatement(_GET_USERS_PERMISSIONS_SQL);
234 
235             ps.setLong(1, scope);
236 
237             rs = ps.executeQuery();
238 
239             while (rs.next()) {
240                 long permissionId = rs.getLong("permissionId");
241 
242                 runSQL(
243                     "delete from Users_Permissions where permissionId = " +
244                         permissionId);
245             }
246         }
247         finally {
248             DataAccess.cleanUp(con, ps, rs);
249         }
250     }
251 
252     protected void doUpgrade() throws Exception {
253         runSQL("delete from OrgGroupPermission");
254 
255         for (int i = 0; i < _DELETE_PERMISSIONS.length; i++) {
256             Object[] permission = _DELETE_PERMISSIONS[i];
257 
258             String actionId = (String)permission[0];
259             String resourceName = ((Class<?>)permission[1]).getName();
260 
261             deletePermissionByActionIdAndResourceName(actionId, resourceName);
262         }
263 
264         for (int i = 0; i < _UPDATE_PERMISSIONS.length; i++) {
265             Object[] permission = _UPDATE_PERMISSIONS[i];
266 
267             String oldActionId = (String)permission[0];
268             String newActionId = (String)permission[1];
269             String resourceName = ((Class<?>)permission[2]).getName();
270 
271             updatePermission(oldActionId, newActionId, resourceName);
272         }
273 
274         deleteResourceCode("com.liferay.portlet.blogs.model.BlogsCategory");
275 
276         deleteRolesPermissions("Community Administrator");
277         deleteRolesPermissions("Community Owner");
278         deleteRolesPermissions("Organization Administrator");
279 
280         deleteUsersPermissions(ResourceConstants.SCOPE_GROUP);
281     }
282 
283     protected void updatePermission(
284             String oldActionId, String newActionId, String resourceName)
285         throws Exception {
286 
287         Connection con = null;
288         PreparedStatement ps = null;
289         ResultSet rs = null;
290 
291         try {
292             con = DataAccess.getConnection();
293 
294             ps = con.prepareStatement(_GET_PERMISSION_SQL);
295 
296             ps.setString(1, oldActionId);
297             ps.setString(2, resourceName);
298 
299             rs = ps.executeQuery();
300 
301             while (rs.next()) {
302                 long permissionId = rs.getLong("permissionId");
303 
304                 runSQL(
305                     "update Permission_ set actionId = '" + newActionId +
306                         "' where permissionId = " + permissionId);
307             }
308         }
309         finally {
310             DataAccess.cleanUp(con, ps, rs);
311         }
312     }
313 
314     private static final String _GET_PERMISSION_SQL =
315         "select Permission_.permissionId from Permission_ inner join " +
316             "Resource_ on Resource_.resourceId = Permission_.resourceId " +
317                 "inner join ResourceCode on ResourceCode.codeId = " +
318                     "Resource_.codeId where Permission_.actionId = ? and " +
319                         "ResourceCode.name = ?";
320 
321     private static final String _GET_ROLES_PERMISSIONS_SQL =
322         "select Roles_Permissions.roleId from Roles_Permissions inner join " +
323             "Role_ on Role_.roleId = Roles_Permissions.roleId where " +
324                 "Role_.name = ?";
325 
326     private static final String _GET_USERS_PERMISSIONS_SQL =
327         "select Users_Permissions.permissionId from Users_Permissions inner " +
328             "join Permission_ on Permission_.permissionId = " +
329                 "Users_Permissions.permissionId inner join Resource_ on " +
330                     "Resource_.resourceId = Permission_.resourceId inner " +
331                         "join ResourceCode on ResourceCode.codeId = " +
332                             "Resource_.codeId where ResourceCode.scope = ?";
333 
334     private static Object[][] _DELETE_PERMISSIONS = new Object[][] {
335         new Object[] {
336             "ADMINISTRATE", Group.class
337         },
338         new Object[] {
339             "ADD_USER", Location.class
340         },
341         new Object[] {
342             "ADD_USER", Organization.class
343         },
344         new Object[] {
345             "DELETE_USER", Location.class
346         },
347         new Object[] {
348             "DELETE_USER", Organization.class
349         },
350         new Object[] {
351             "PERMISSIONS_USER", Location.class
352         },
353         new Object[] {
354             "PERMISSIONS_USER", Organization.class
355         },
356         new Object[] {
357             "UPDATE_USER", Location.class
358         },
359         new Object[] {
360             "UPDATE_USER", Organization.class
361         },
362         new Object[] {
363             "VIEW_USER", Location.class
364         },
365         new Object[] {
366             "VIEW_USER", Organization.class
367         }
368     };
369 
370     private static Object[][] _UPDATE_PERMISSIONS = new Object[][] {
371         new Object[] {
372             "ADD_CATEGORY", "ADD_SUBCATEGORY", MBCategory.class
373         },
374         new Object[] {
375             "ADD_CATEGORY", "ADD_SUBCATEGORY", ShoppingCategory.class
376         },
377         new Object[] {
378             "ADD_FOLDER", "ADD_SUBFOLDER", DLFolder.class
379         },
380         new Object[] {
381             "ADD_FOLDER", "ADD_SUBFOLDER", IGFolder.class
382         },
383         new Object[] {
384             "ADD_FOLDER", "ADD_SUBFOLDER", BookmarksFolder.class
385         },
386         new Object[] {
387             "ADD_LOCATION", "MANAGE_SUBORGANIZATIONS", Organization.class
388         },
389         new Object[] {
390             "ADD_PERMISSIONS", "DEFINE_PERMISSIONS", Role.class
391         },
392         new Object[] {
393             "ADD_USER", "MANAGE_USERS", Location.class
394         },
395         new Object[] {
396             "ADD_USER", "MANAGE_USERS", Organization.class
397         },
398         new Object[] {
399             "ASSIGN_USERS", "ASSIGN_MEMBERS", Group.class
400         },
401         new Object[] {
402             "ASSIGN_USERS", "ASSIGN_MEMBERS", Role.class
403         },
404         new Object[] {
405             "ASSIGN_USERS", "ASSIGN_MEMBERS", UserGroup.class
406         }
407     };
408 
409     private static Log _log = LogFactoryUtil.getLog(UpgradePermission.class);
410 
411 }