1   /**
2    * Copyright (c) 2000-2008 Liferay, Inc. All rights reserved.
3    *
4    * Permission is hereby granted, free of charge, to any person obtaining a copy
5    * of this software and associated documentation files (the "Software"), to deal
6    * in the Software without restriction, including without limitation the rights
7    * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
8    * copies of the Software, and to permit persons to whom the Software is
9    * furnished to do so, subject to the following conditions:
10   *
11   * The above copyright notice and this permission notice shall be included in
12   * all copies or substantial portions of the Software.
13   *
14   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
18   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
19   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
20   * SOFTWARE.
21   */
22  
23  package com.liferay.portal.upgrade.v4_4_0;
24  
25  import com.liferay.portal.kernel.dao.jdbc.DataAccess;
26  import com.liferay.portal.model.Group;
27  import com.liferay.portal.model.Location;
28  import com.liferay.portal.model.Organization;
29  import com.liferay.portal.model.ResourceConstants;
30  import com.liferay.portal.model.Role;
31  import com.liferay.portal.model.UserGroup;
32  import com.liferay.portal.upgrade.UpgradeException;
33  import com.liferay.portal.upgrade.UpgradeProcess;
34  import com.liferay.portlet.bookmarks.model.BookmarksFolder;
35  import com.liferay.portlet.documentlibrary.model.DLFolder;
36  import com.liferay.portlet.imagegallery.model.IGFolder;
37  import com.liferay.portlet.messageboards.model.MBCategory;
38  import com.liferay.portlet.shopping.model.ShoppingCategory;
39  
40  import java.sql.Connection;
41  import java.sql.PreparedStatement;
42  import java.sql.ResultSet;
43  
44  import org.apache.commons.logging.Log;
45  import org.apache.commons.logging.LogFactory;
46  
47  /**
48   * <a href="UpgradePermission.java.html"><b><i>View Source</i></b></a>
49   *
50   * @author Brian Wing Shun Chan
51   *
52   */
53  public class UpgradePermission extends UpgradeProcess {
54  
55      public void upgrade() throws UpgradeException {
56          _log.info("Upgrading");
57  
58          try {
59              doUpgrade();
60          }
61          catch (Exception e) {
62              throw new UpgradeException(e);
63          }
64      }
65  
66      protected void deletePermissionByActionIdAndResourceName(
67              String actionId, String resourceName)
68          throws Exception {
69  
70          Connection con = null;
71          PreparedStatement ps = null;
72          ResultSet rs = null;
73  
74          try {
75              con = DataAccess.getConnection();
76  
77              ps = con.prepareStatement(_GET_PERMISSION_SQL);
78  
79              ps.setString(1, actionId);
80              ps.setString(2, resourceName);
81  
82              rs = ps.executeQuery();
83  
84              while (rs.next()) {
85                  long permissionId = rs.getLong("permissionId");
86  
87                  deletePermissionByPermissionId(permissionId);
88              }
89          }
90          finally {
91              DataAccess.cleanUp(con, ps, rs);
92          }
93      }
94  
95      protected void deletePermissionByPermissionId(long permissionId)
96          throws Exception {
97  
98          runSQL(
99              "delete from Permission_ where permissionId = " + permissionId);
100         runSQL(
101             "delete from Groups_Permissions where permissionId = " +
102                 permissionId);
103         runSQL(
104             "delete from Roles_Permissions where permissionId = " +
105                 permissionId);
106         runSQL(
107             "delete from Users_Permissions where permissionId = " +
108                 permissionId);
109     }
110 
111     protected void deletePermissionByResourceId(long resourceId)
112         throws Exception {
113 
114         Connection con = null;
115         PreparedStatement ps = null;
116         ResultSet rs = null;
117 
118         try {
119             con = DataAccess.getConnection();
120 
121             ps = con.prepareStatement(
122                 "select permissionId from Permission_ where resourceId = ?");
123 
124             ps.setLong(1, resourceId);
125 
126             rs = ps.executeQuery();
127 
128             while (rs.next()) {
129                 long permissionId = rs.getLong("permissionId");
130 
131                 deletePermissionByPermissionId(permissionId);
132             }
133         }
134         finally {
135             DataAccess.cleanUp(con, ps, rs);
136         }
137     }
138 
139     protected void deleteResource(long codeId) throws Exception {
140         Connection con = null;
141         PreparedStatement ps = null;
142         ResultSet rs = null;
143 
144         try {
145             con = DataAccess.getConnection();
146 
147             ps = con.prepareStatement(
148                 "select resourceId from Resource_ where codeId = ?");
149 
150             ps.setLong(1, codeId);
151 
152             rs = ps.executeQuery();
153 
154             while (rs.next()) {
155                 long resourceId = rs.getLong("resourceId");
156 
157                 deletePermissionByResourceId(resourceId);
158 
159                 runSQL(
160                     "delete from Resource_ where resourceId = " + resourceId);
161             }
162         }
163         finally {
164             DataAccess.cleanUp(con, ps, rs);
165         }
166     }
167 
168     protected void deleteResourceCode(String resourceName)
169         throws Exception {
170 
171         Connection con = null;
172         PreparedStatement ps = null;
173         ResultSet rs = null;
174 
175         try {
176             con = DataAccess.getConnection();
177 
178             ps = con.prepareStatement(
179                 "select codeId from ResourceCode where name = ?");
180 
181             ps.setString(1, resourceName);
182 
183             rs = ps.executeQuery();
184 
185             while (rs.next()) {
186                 long codeId = rs.getLong("codeId");
187 
188                 deleteResource(codeId);
189 
190                 runSQL(
191                     "delete from ResourceCode where name = '" + resourceName +
192                         "'");
193             }
194         }
195         finally {
196             DataAccess.cleanUp(con, ps, rs);
197         }
198     }
199 
200     protected void deleteRolesPermissions(String roleName) throws Exception {
201         Connection con = null;
202         PreparedStatement ps = null;
203         ResultSet rs = null;
204 
205         try {
206             con = DataAccess.getConnection();
207 
208             ps = con.prepareStatement(_GET_ROLES_PERMISSIONS_SQL);
209 
210             ps.setString(1, roleName);
211 
212             rs = ps.executeQuery();
213 
214             while (rs.next()) {
215                 long roleId = rs.getLong("roleId");
216 
217                 runSQL(
218                     "delete from Roles_Permissions where roleId = " + roleId);
219             }
220         }
221         finally {
222             DataAccess.cleanUp(con, ps, rs);
223         }
224     }
225 
226     protected void deleteUsersPermissions(int scope) throws Exception {
227         Connection con = null;
228         PreparedStatement ps = null;
229         ResultSet rs = null;
230 
231         try {
232             con = DataAccess.getConnection();
233 
234             ps = con.prepareStatement(_GET_USERS_PERMISSIONS_SQL);
235 
236             ps.setLong(1, scope);
237 
238             rs = ps.executeQuery();
239 
240             while (rs.next()) {
241                 long permissionId = rs.getLong("permissionId");
242 
243                 runSQL(
244                     "delete from Users_Permissions where permissionId = " +
245                         permissionId);
246             }
247         }
248         finally {
249             DataAccess.cleanUp(con, ps, rs);
250         }
251     }
252 
253     protected void doUpgrade() throws Exception {
254         runSQL("delete from OrgGroupPermission");
255 
256         for (int i = 0; i < _DELETE_PERMISSIONS.length; i++) {
257             Object[] permission = _DELETE_PERMISSIONS[i];
258 
259             String actionId = (String)permission[0];
260             String resourceName = ((Class<?>)permission[1]).getName();
261 
262             deletePermissionByActionIdAndResourceName(actionId, resourceName);
263         }
264 
265         for (int i = 0; i < _UPDATE_PERMISSIONS.length; i++) {
266             Object[] permission = _UPDATE_PERMISSIONS[i];
267 
268             String oldActionId = (String)permission[0];
269             String newActionId = (String)permission[1];
270             String resourceName = ((Class<?>)permission[2]).getName();
271 
272             updatePermission(oldActionId, newActionId, resourceName);
273         }
274 
275         deleteResourceCode("com.liferay.portlet.blogs.model.BlogsCategory");
276 
277         deleteRolesPermissions("Community Administrator");
278         deleteRolesPermissions("Community Owner");
279         deleteRolesPermissions("Organization Administrator");
280 
281         deleteUsersPermissions(ResourceConstants.SCOPE_GROUP);
282     }
283 
284     protected void updatePermission(
285             String oldActionId, String newActionId, String resourceName)
286         throws Exception {
287 
288         Connection con = null;
289         PreparedStatement ps = null;
290         ResultSet rs = null;
291 
292         try {
293             con = DataAccess.getConnection();
294 
295             ps = con.prepareStatement(_GET_PERMISSION_SQL);
296 
297             ps.setString(1, oldActionId);
298             ps.setString(2, resourceName);
299 
300             rs = ps.executeQuery();
301 
302             while (rs.next()) {
303                 long permissionId = rs.getLong("permissionId");
304 
305                 runSQL(
306                     "update Permission_ set actionId = '" + newActionId +
307                         "' where permissionId = " + permissionId);
308             }
309         }
310         finally {
311             DataAccess.cleanUp(con, ps, rs);
312         }
313     }
314 
315     private static final String _GET_PERMISSION_SQL =
316         "select Permission_.permissionId from Permission_ inner join " +
317             "Resource_ on Resource_.resourceId = Permission_.resourceId " +
318                 "inner join ResourceCode on ResourceCode.codeId = " +
319                     "Resource_.codeId where Permission_.actionId = ? and " +
320                         "ResourceCode.name = ?";
321 
322     private static final String _GET_ROLES_PERMISSIONS_SQL =
323         "select Roles_Permissions.roleId from Roles_Permissions inner join " +
324             "Role_ on Role_.roleId = Roles_Permissions.roleId where " +
325                 "Role_.name = ?";
326 
327     private static final String _GET_USERS_PERMISSIONS_SQL =
328         "select Users_Permissions.permissionId from Users_Permissions inner " +
329             "join Permission_ on Permission_.permissionId = " +
330                 "Users_Permissions.permissionId inner join Resource_ on " +
331                     "Resource_.resourceId = Permission_.resourceId inner " +
332                         "join ResourceCode on ResourceCode.codeId = " +
333                             "Resource_.codeId where ResourceCode.scope = ?";
334 
335     private static Object[][] _DELETE_PERMISSIONS = new Object[][] {
336         new Object[] {
337             "ADMINISTRATE", Group.class
338         },
339         new Object[] {
340             "ADD_USER", Location.class
341         },
342         new Object[] {
343             "ADD_USER", Organization.class
344         },
345         new Object[] {
346             "DELETE_USER", Location.class
347         },
348         new Object[] {
349             "DELETE_USER", Organization.class
350         },
351         new Object[] {
352             "PERMISSIONS_USER", Location.class
353         },
354         new Object[] {
355             "PERMISSIONS_USER", Organization.class
356         },
357         new Object[] {
358             "UPDATE_USER", Location.class
359         },
360         new Object[] {
361             "UPDATE_USER", Organization.class
362         },
363         new Object[] {
364             "VIEW_USER", Location.class
365         },
366         new Object[] {
367             "VIEW_USER", Organization.class
368         }
369     };
370 
371     private static Object[][] _UPDATE_PERMISSIONS = new Object[][] {
372         new Object[] {
373             "ADD_CATEGORY", "ADD_SUBCATEGORY", MBCategory.class
374         },
375         new Object[] {
376             "ADD_CATEGORY", "ADD_SUBCATEGORY", ShoppingCategory.class
377         },
378         new Object[] {
379             "ADD_FOLDER", "ADD_SUBFOLDER", DLFolder.class
380         },
381         new Object[] {
382             "ADD_FOLDER", "ADD_SUBFOLDER", IGFolder.class
383         },
384         new Object[] {
385             "ADD_FOLDER", "ADD_SUBFOLDER", BookmarksFolder.class
386         },
387         new Object[] {
388             "ADD_LOCATION", "MANAGE_SUBORGANIZATIONS", Organization.class
389         },
390         new Object[] {
391             "ADD_PERMISSIONS", "DEFINE_PERMISSIONS", Role.class
392         },
393         new Object[] {
394             "ADD_USER", "MANAGE_USERS", Location.class
395         },
396         new Object[] {
397             "ADD_USER", "MANAGE_USERS", Organization.class
398         },
399         new Object[] {
400             "ASSIGN_USERS", "ASSIGN_MEMBERS", Group.class
401         },
402         new Object[] {
403             "ASSIGN_USERS", "ASSIGN_MEMBERS", Role.class
404         },
405         new Object[] {
406             "ASSIGN_USERS", "ASSIGN_MEMBERS", UserGroup.class
407         }
408     };
409 
410     private static Log _log = LogFactory.getLog(UpgradePermission.class);
411 
412 }