For #5397: support checking new list permission

orbeon · Aug 11, 2022 · e01c954 · e01c954
1 parent 40b2c97
commit e01c954
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/form-runner/jvm/src/main/resources/apps/fr/summary/view.xhtml b/form-runner/jvm/src/main/resources/apps/fr/summary/view.xhtml
@@ -357,6 +357,12 @@
                     name="operations-from-role"
                     value="frf:authorizedOperationsBasedOnRolesXPath($source-form-metadata/permissions)"/>
 
+                <!-- Check if the user doesn't have the permission to 'list'
+                     https://github.com/orbeon/orbeon-forms/issues/5397 -->
+                <xf:action
+                    if="not('list' = $operations-from-role)"
+                    type="xpath">frf:sendError(403)</xf:action>
+
                 <!-- Remember global operations -->
                 <xf:setvalue
                     ref="xxf:instance('fr-authorized-operations')"

diff --git a/form-runner/shared/src/main/scala/org/orbeon/oxf/fr/permission/operations.scala b/form-runner/shared/src/main/scala/org/orbeon/oxf/fr/permission/operations.scala
@@ -44,6 +44,7 @@ object Operation extends Enum[Operation] {
   case object Read   extends Operation
   case object Update extends Operation
   case object Delete extends Operation
+  case object List   extends Operation
 }
 
 object Operations {
@@ -53,7 +54,8 @@ object Operations {
     Operation.Create,
     Operation.Read,
     Operation.Update,
-    Operation.Delete
+    Operation.Delete,
+    Operation.List
   )
 
   def parseFromHeaders(headers: Map[String, List[String]]): Option[Operations] =