Index: xdocs/guides/guide-ajax-api.xml =================================================================== --- xdocs/guides/guide-ajax-api.xml (revision 537111) +++ xdocs/guides/guide-ajax-api.xml (working copy) @@ -846,7 +846,148 @@ - + + + + + + + + + + + + + + + + + + + +
API:getuseinfo
Component:AjaxGetUserInformation
Description:Returns information about the currently logged in user. Can be used for example in AJAX based portlets to retrieve the userinfo in a more robust way. Will return success only if a user is currenly logged in, otherwise will return false.
Parameters:
+ + + + +
actiongetuserinfo
+ + + API example: + + + + + + XML Response: + + + success + userinformation + admin + org.apache.jetspeed.security.impl.UserPrincipalImpl + + Test Dude + Dudley + + +]]> + + + + + + + + + + + + + + + + + + + + + + +
API:getuseinfo
Component:AjaxGetUserList
Description:Provides basic information (username, ip-address, number of sessions and status) about currently logged in users in xml-format. Optionally it can also provide more detailed userinformation, number of guest sessions and include offline users as well.
Parameters:
+ + + + + + + + + + + + + + + + + + + + +
actiongetuserinfo
userinfoWhether we should include also userinfo (true | false [default])
offlineWhether we should include offline users (true | false [default])
guestWhether we should return also the guest sessions (true | false [default])
allIf set to true, will return every bits and piece there is (true | false [default])
+ + + +

+ By default the private information (emails, etc..) is protected with + RolesSecurityBehavior security, but can be changed in AJAX configuration + by altering the protectionScope constructor value to either "all" to protect + even the basic information or to "none" when everything will be shown for everyone (not wise on production). + The default value "private" will show just the basic information of online/offline users and number of guest sessions, + as the "private-offline" will not show even the offline users. Possible protectionScope values are "all", + "private-offline", "private" and "none". +

+ + + + API example: + + + + + + XML Response: + + + success + getuserlist + + + admin + 1 + online + 127.0.0.1 + + Test Dude + Dudley + + + 0 + + +]]> + + + + +
@@ -892,9 +1033,27 @@ + + + + + + + + + + + + + + + + + + - + @@ -904,6 +1063,24 @@ + + + + + + + + + + + + + + + + + + Index: components/portal/src/java/org/apache/jetspeed/layout/impl/GetUserListAction.java =================================================================== --- components/portal/src/java/org/apache/jetspeed/layout/impl/GetUserListAction.java (revision 537111) +++ components/portal/src/java/org/apache/jetspeed/layout/impl/GetUserListAction.java (working copy) @@ -69,6 +69,8 @@ protected Log log = LogFactory.getLog(GetUserListAction.class); private PortalStatistics pstats = null; private PortalSessionsManager psm = null; + // By default the protection is set to all + private String protectionScope = "all"; private final String PARAM_GUEST = "guest"; private final String PARAM_USERINFO = "userinfo"; @@ -96,23 +98,26 @@ this.psm = psm; } + public GetUserListAction(String template, + String errorTemplate, + UserManager um, + PortalStatistics pstats, + PortalSessionsManager psm, + RolesSecurityBehavior securityBehavior, + String protectionScope) + { + super(template, errorTemplate, um, securityBehavior); + this.pstats = pstats; + this.psm = psm; + this.protectionScope = protectionScope; + } + public boolean run(RequestContext requestContext, Map resultMap) throws AJAXException { boolean success = true; String status = "success"; - // Do a security check if a behavior is set - if(securityBehavior != null) - { - if(!checkAccess(requestContext, JetspeedActions.EDIT)) - { - success = false; - resultMap.put(REASON, "Insufficient access see user details."); - return success; - } - } - boolean includeGuests; boolean includeUserInfo; boolean includeOffline; @@ -131,6 +136,35 @@ includeUserInfo = isTrue(getActionParameter(requestContext, PARAM_USERINFO)); } + // Do a security check if a behavior is set + if(securityBehavior != null) + { + // If protection is set to "none", everything will be allowed + if(!checkAccess(requestContext, JetspeedActions.EDIT) && !this.protectionScope.equals("none")) + { + // If we have set protection to private only and security check failed, + // will return basic information still + if(this.protectionScope.equals("private-offline")) + { + // If private and offline information is protected, disable that and offline users. + includeUserInfo = false; + includeOffline = false; + } + else if(this.protectionScope.equals("private")) + { + // Only private information is protected. + includeUserInfo = false; + } + else + { + + success = false; + resultMap.put(REASON, "Insufficient access see user details."); + return success; + } + } + } + int numberOfCurrentUsers = 0; int numberOfCurrentLoggedInUsers = 0; Index: src/webapp/WEB-INF/assembly/ajax-layout.xml =================================================================== --- src/webapp/WEB-INF/assembly/ajax-layout.xml (revision 537111) +++ src/webapp/WEB-INF/assembly/ajax-layout.xml (working copy) @@ -507,6 +507,17 @@ + + @@ -527,6 +538,9 @@ + + private +