Hotfix 6.3.x sup 19628

cms-core/src/main/java/com/gentics/contentnode/rest/resource/impl/GroupResourceImpl.java

@@ -91,6 +91,7 @@
 import com.gentics.contentnode.rest.resource.GroupResource;
 import com.gentics.contentnode.rest.resource.parameter.FilterParameterBean;
 import com.gentics.contentnode.rest.resource.parameter.PagingParameterBean;
+import com.gentics.contentnode.rest.resource.parameter.PermsFilterParameterBean;
 import com.gentics.contentnode.rest.resource.parameter.PermsParameterBean;
 import com.gentics.contentnode.rest.resource.parameter.SortParameterBean;
 import com.gentics.contentnode.rest.util.AbstractNodeObjectFilter;
@@ -387,7 +388,7 @@ public int compare(UserGroup group1, UserGroup group2) {
 	@RequiredPerm(type = PermHandler.TYPE_ADMIN, bit = PermHandler.PERM_VIEW)
 	@RequiredPerm(type = UserGroup.TYPE_GROUPADMIN, bit = PermHandler.PERM_VIEW)
 	public GroupList list(@BeanParam FilterParameterBean filter, @BeanParam SortParameterBean sorting, @BeanParam PagingParameterBean paging,
-			@BeanParam PermsParameterBean perms) throws NodeException {
+			@BeanParam PermsParameterBean perms, @BeanParam PermsFilterParameterBean permFilter) throws NodeException {
 		try (Trx trx = ContentNodeHelper.trx()) {
 			Transaction t = trx.getTransaction();
 
@@ -399,6 +400,7 @@ public GroupList list(@BeanParam FilterParameterBean filter, @BeanParam SortPara
 			recursiveAddGroups(groups, user.getUserGroups());
 
 			GroupList response = ListBuilder.from(groups, UserGroup.TRANSFORM2REST)
+				.filter(o -> PermFilter.get(permFilter).matches(o))
 				.filter(ResolvableFilter.get(filter, "id", "globalId", "name", "description"))
 				.perms(permFunction(perms, ObjectPermission.view, ObjectPermission.edit, ObjectPermission.delete, ObjectPermission.setperm, ObjectPermission.userassignment))
 				.sort(ResolvableComparator.get(sorting, "id", "globalId", "name", "description"))
@@ -415,10 +417,13 @@ public GroupList list(@BeanParam FilterParameterBean filter, @BeanParam SortPara
 	@Path("/{id}")
 	@RequiredPerm(type = PermHandler.TYPE_ADMIN, bit = PermHandler.PERM_VIEW)
 	@RequiredPerm(type = UserGroup.TYPE_GROUPADMIN, bit = PermHandler.PERM_VIEW)
-	public GroupLoadResponse get(@PathParam("id") String id) throws NodeException {
+	public GroupLoadResponse get(@PathParam("id") String id, @BeanParam PermsParameterBean perms) throws NodeException {
 		try (Trx trx = ContentNodeHelper.trx()) {
 			UserGroup group = MiscUtils.load(UserGroup.class, id);
 			GroupLoadResponse response = new GroupLoadResponse(null, ResponseInfo.ok("Successfully loaded group"), UserGroup.TRANSFORM2REST.apply(group));
+			if (perms != null && perms.perms) {
+				response.setPerms(permFunction(perms, ObjectPermission.view, ObjectPermission.edit, ObjectPermission.delete, ObjectPermission.setperm, ObjectPermission.userassignment).apply(group).getRight());
+			}
 			trx.success();
 			return response;
 		}

cms-core/src/main/java/com/gentics/contentnode/rest/util/PermFilter.java

@@ -1,10 +1,17 @@
 package com.gentics.contentnode.rest.util;
 
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+
 import com.gentics.api.lib.exception.NodeException;
 import com.gentics.contentnode.object.AbstractContentObject;
 import com.gentics.contentnode.object.NodeObject;
 import com.gentics.contentnode.perm.PermHandler;
 import com.gentics.contentnode.perm.PermHandler.ObjectPermission;
+import com.gentics.contentnode.rest.resource.parameter.PermsFilterParameterBean;
 
 /**
  * Permission Filter.
@@ -19,29 +26,51 @@ public class PermFilter<T extends NodeObject> implements Filter<T> {
 	/**
 	 * Checked permission
 	 */
-	protected PermHandler.ObjectPermission perm;
+	protected Set<PermHandler.ObjectPermission> perms;
+
+	/**
+	 * Get the instance of the permission filter for the given permissions
+	 * @param perms permissions
+	 * @return filter
+	 */
+	public static <U extends NodeObject> PermFilter<U> get(PermHandler.ObjectPermission... perms) {
+		return get(null, perms);
+	}
 
 	/**
-	 * Get the instance of the permission filter for the given permission
-	 * @param perm permission
+	 * Get the instance of the permission filter for the given permissions, including possible filter bean contents
+	 * @param filter filter bean
+	 * @param perms permissions
 	 * @return filter
 	 */
-	public static <U extends NodeObject> PermFilter<U> get(PermHandler.ObjectPermission perm) {
-		return new PermFilter<>(perm);
+	public static <U extends NodeObject> PermFilter<U> get(PermsFilterParameterBean filter, PermHandler.ObjectPermission... perms) {
+		Set<PermHandler.ObjectPermission> parsedPerms = new HashSet<>(Arrays.asList(perms));
+		if (filter != null && filter.permitted != null) {
+			parsedPerms.addAll(filter.permitted.stream().map(ObjectPermission::get).filter(Objects::nonNull).collect(Collectors.toSet()));
+		}
+		return new PermFilter<>(parsedPerms);
 	}
 
 	/**
 	 * Create an instance of the filter
-	 * @param perm checked permission
+	 * @param perms checked permission
 	 */
-	protected PermFilter(PermHandler.ObjectPermission perm) {
-		this.perm = perm;
+	protected PermFilter(Set<PermHandler.ObjectPermission> perms) {
+		this.perms = perms;
 	}
 
 	/* (non-Javadoc)
 	 * @see com.gentics.contentnode.rest.util.NodeObjectFilter#matches(com.gentics.lib.base.object.NodeObject)
 	 */
 	public boolean matches(NodeObject object) throws NodeException {
-		return AbstractContentObject.isEmptyId(object.getId()) || perm.checkObject(object);
+		if (AbstractContentObject.isEmptyId(object.getId())) {
+			return true;
+		}
+		for (ObjectPermission perm : perms) {
+			if (!perm.checkObject(object)) {
+				return false;
+			}
+		}
+		return true;
 	}
 }

cms-core/src/test/java/com/gentics/contentnode/tests/rest/group/GroupEditPermissionsTest.java

@@ -185,7 +185,7 @@ public void testRead() throws NodeException {
 			exceptionRule.expect(InsufficientPrivilegesException.class, String.format("Keine Berechtigung für die Gruppe %d.", testedGroup.getId()));
 		}
 		try (Trx trx = new Trx(testUser)) {
-			Group ownGroup = new GroupResourceImpl().get(String.valueOf(testedGroup.getId())).getGroup();
+			Group ownGroup = new GroupResourceImpl().get(String.valueOf(testedGroup.getId()), null).getGroup();
 			assertThat(ownGroup).as("Read group").has(attribute("id", testedGroup.getId()));
 			trx.success();
 		}