SAK-32103: content.all.groups allows see all groups. (sakaiproject#3863)

* SAK-32103: content.all.groups allows see all groups. * Added NPE for getContainingSite
jbbadano · Feb 7, 2017 · 2264131 · 2264131
1 parent 343b3e1
commit 2264131
Showing 1 changed file with 3 additions and 9 deletions.
diff --git a/content/content-tool/tool/src/java/org/sakaiproject/content/tool/ListItem.java b/content/content-tool/tool/src/java/org/sakaiproject/content/tool/ListItem.java
@@ -145,7 +145,6 @@ public class ListItem
 	 */
 	private static final MetadataService metadataService = (MetadataService) ComponentManager.get(MetadataService.class.getCanonicalName());
 	private static final org.sakaiproject.tool.api.ToolManager toolManager = (org.sakaiproject.tool.api.ToolManager) ComponentManager.get(org.sakaiproject.tool.api.ToolManager.class.getCanonicalName());
-	private static final AuthzGroupService authzGroupService = (AuthzGroupService) ComponentManager.get(AuthzGroupService.class.getCanonicalName());
 
 	/** 
 	 ** Comparator for sorting Group objects
@@ -2649,17 +2648,12 @@ public boolean isPermitted(ContentPermissions permission)
      */
     public boolean isPossible(Group group)
     {
-    	if (group==null) return false;
+    	if (group == null || group.getContainingSite() == null) return false;
 
-    	Collection<Group> groupsToCheck = (AccessMode.GROUPED == this.inheritedAccessMode) ? this.inheritedGroups : this.possibleGroups;    	
-    	Collection<String> groupsToCheckReference = new ArrayList<String>();
-    	for (Group gr:groupsToCheck) {
-    		groupsToCheckReference.add(gr.getReference()); 
-    	}    	
     	String userId = UserDirectoryService.getCurrentUser().getId();
-    	Collection<String> groupsOfUser = authzGroupService.getAuthzGroupsIsAllowed(userId, SiteService.SITE_VISIT, groupsToCheckReference);
+    	if (group.getContainingSite().isAllowed(userId, ContentHostingService.AUTH_RESOURCE_ALL_GROUPS)) return true;
 
-    	return groupsOfUser.contains(group.getReference());
+    	return group.isAllowed(userId, SiteService.SITE_VISIT);
     }
 
 	/**