TRUNK-6203: Global properties access should be privileged

openmrs · May 31, 2024 · 0a8a9ad · 0a8a9ad
1 parent 589f30b
commit 0a8a9ad
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 10 deletions.
diff --git a/omod/src/main/java/org/openmrs/module/spa/filter/SpaFilter.java b/omod/src/main/java/org/openmrs/module/spa/filter/SpaFilter.java
@@ -22,21 +22,33 @@
 
 import org.apache.commons.lang3.StringUtils;
 import org.openmrs.api.context.Context;
+import org.openmrs.util.PrivilegeConstants;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import static org.openmrs.module.spa.SpaConstants.DEFAULT_SPA_BASE_URL;
 import static org.openmrs.module.spa.SpaConstants.GP_KEY_SPA_BASE_URL;
 
 public class SpaFilter implements Filter {
 
+	private static final Logger logger = LoggerFactory.getLogger(SpaFilter.class);
+
 	@Override
 	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
 
 		HttpServletRequest request = (HttpServletRequest) req;
-		String spaBasePath = Context.getAdministrationService().getGlobalProperty(GP_KEY_SPA_BASE_URL,
-				DEFAULT_SPA_BASE_URL);
-
-		if (StringUtils.isBlank(spaBasePath)) {
-			spaBasePath = DEFAULT_SPA_BASE_URL;
+
+		String spaBasePath = DEFAULT_SPA_BASE_URL;
+
+		try {
+			Context.addProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+			spaBasePath = Context.getAdministrationService().getGlobalProperty(GP_KEY_SPA_BASE_URL,
+					DEFAULT_SPA_BASE_URL);
+		} catch (Exception e) {
+			logger.error(e.getMessage(), e);
+		}
+		finally {
+			Context.removeProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
 		}
 
 		String requestURL = null;

diff --git a/omod/src/main/java/org/openmrs/module/spa/utils/SpaModuleUtils.java b/omod/src/main/java/org/openmrs/module/spa/utils/SpaModuleUtils.java
@@ -14,6 +14,7 @@
 import org.openmrs.api.context.Context;
 import org.openmrs.module.spa.SpaConstants;
 import org.openmrs.util.OpenmrsUtil;
+import org.openmrs.util.PrivilegeConstants;
 
 import java.io.File;
 
@@ -35,7 +36,14 @@ public class SpaModuleUtils {
      */
     public static File getSpaStaticFilesDir () {
         AdministrationService as = Context.getAdministrationService();
-        String folderName = as.getGlobalProperty(GP_LOCAL_DIRECTORY, DEFAULT_FRONTEND_DIRECTORY);
+        String folderName;
+        try {
+            Context.addProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+            folderName = as.getGlobalProperty(GP_LOCAL_DIRECTORY, DEFAULT_FRONTEND_DIRECTORY);
+        }
+        finally {
+            Context.removeProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+        }
 
         // try to load the repository folder straight away.
         File folder = new File(folderName);
@@ -50,9 +58,15 @@ public static File getSpaStaticFilesDir () {
 
     public static boolean isRemoteAssetsEnabled() {
         AdministrationService administrationService = Context.getAdministrationService();
-        String isRemoteAssetEnabled = administrationService.getGlobalProperty(GP_IS_REMOTE_ENABLED, "false");
-        log.info("Remote/Local frontend assets enabled {}", isRemoteAssetEnabled);
-        return Boolean.parseBoolean(isRemoteAssetEnabled);
+        try {
+            Context.addProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+            String isRemoteAssetEnabled = administrationService.getGlobalProperty(GP_IS_REMOTE_ENABLED, "false");
+            log.info("Remote/Local frontend assets enabled {}", isRemoteAssetEnabled);
+            return Boolean.parseBoolean(isRemoteAssetEnabled);
+        }
+        finally {
+            Context.removeProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+        }
     }
 
     /*

diff --git a/pom.xml b/pom.xml
@@ -33,7 +33,7 @@
 	</modules>
 
 	<properties>
-		<openMRSVersion>1.10.5</openMRSVersion>
+		<openMRSVersion>2.0.0</openMRSVersion>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>