434 template paths

[mburri]

Validate the specified path for the template. Absolute paths starting with "/" and path traversals "../" are not allowed.

I allowed myself to add some wrapper methods in order to be able to write some unit tests and slightly refactor the save() method (mostly for readability)

fixes #434

[yvespp]

@mburri would it be better to move this validation to the business module? Else it has to be reimplemented for rest/angular again.

[mburri]

@yvespp moving the logic to business-module makes sense.
I'm not sure about the best way to handle the permission check. There is one in the EditTemplateView itself:

liima/AMW_web/src/main/java/ch/puzzle/itc/mobiliar/presentation/templateEdit/EditTemplateView.java

Line 266 in 5429171

if (template.getId() == null && !canAdd()) {

And one in the bussiness-module but only for templates for relations:
https://github.com/liimaorg/liima/blob/master/AMW_business/src/main/java/ch/puzzle/itc/mobiliar/business/template/boundary/TemplateEditor.java#L134

There is no permission check in the TemplateEditor for the other possible types (ResourceType/ Resource), see:

liima/AMW_web/src/main/java/ch/puzzle/itc/mobiliar/presentation/templateEdit/EditTemplateView.java

Line 276 in 5429171

else if (resourceId == null) {

I tried to move these to the template editor (different branch) but abandoned it for now because it became a really big change...

I think the simplest change would be to keep the permission check in EditTemplateView and move the template path validation to the TemplateEditor - or what do you think?

[mburri]

I moved the permission checks for resources and resource types to the template editor (see branch 434-template-paths-permission-check-explorations) - but i got quite confused by the method TemplateEditor#saveTemplateForRelation that already does check permissions - but in a different way than EditTemplateView#canModifyTemplates()

Further investigations revealed, that the permission checks to create/ update templates for resource, resourcetypes and/ or resource relation (that seem to fall back to resources or resource types) are also covered by annotations. The specific implementations are necessary to distinguish between create/ update a template.

What is the preferred way for permission checks in Liima:

• Annotations in the business-module
• Custom Logic/ throwing Exceptions in the business-module
• Custom Logic/ throwing Exceptions in the web-module (see EditTemplateView#canModifyTemplates())

Personally, I'd like to use annotations where possible.

[yvespp]

Via annotations is fine. For complicated checks it's probably easier in code.

[mburri]

I'm closing this issue without merging in favor of #595