fix admin permissions when accessing students or user endpoints (#103)

MatiasComercio · Feb 4, 2017 · 18faa99 · 18faa99
1 parent bf04d94
commit 18faa99
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 9 deletions.
diff --git a/webapp/src/main/java/ar/edu/itba/paw/webapp/controllers/StudentController.java b/webapp/src/main/java/ar/edu/itba/paw/webapp/controllers/StudentController.java
@@ -119,7 +119,7 @@ public Response studentsUpdate(@PathParam("docket") final int docket,
     }
 
 	  final int dni = LoggedUser.getDni();
-	  if(dni != oldStudent.getDni() || !LoggedUser.isAdmin()) {
+	  if(dni != oldStudent.getDni() && !LoggedUser.isAdmin()) {
 		  return status(Status.FORBIDDEN).build();
 	  }
 
@@ -177,7 +177,7 @@ public Response studentsCoursesNew(
     }
 
     final int dni = LoggedUser.getDni();
-    if(dni != student.getDni() || !LoggedUser.isAdmin()) {
+    if(dni != student.getDni() && !LoggedUser.isAdmin()) {
     	return status(Status.FORBIDDEN).build();
     }
 
@@ -208,7 +208,7 @@ public Response studentsCoursesDestroy(
 	  }
 
     final int dni = LoggedUser.getDni();
-    if(dni != student.getDni() || !LoggedUser.isAdmin()) {
+    if(dni != student.getDni() && !LoggedUser.isAdmin()) {
     	return status(Status.FORBIDDEN).build();
     }
 
@@ -259,7 +259,7 @@ public Response studentsGradesIndex(@PathParam("docket") final Integer docket){
     }
 
     final int dni = LoggedUser.getDni();
-    if(dni != student.getDni() || !LoggedUser.isAdmin()) {
+    if(dni != student.getDni() && !LoggedUser.isAdmin()) {
       return status(Status.FORBIDDEN).build();
     }
     final int totalCredits = cs.getTotalPlanCredits();
@@ -320,7 +320,7 @@ public Response studentsGradesUpdate(
     }
 
 	  final int dni = LoggedUser.getDni();
-	  if(dni != student.getDni() || !LoggedUser.isAdmin()) {
+	  if(dni != student.getDni() && !LoggedUser.isAdmin()) {
 		  return status(Status.FORBIDDEN).build();
 	  }
 
@@ -367,7 +367,7 @@ public Response studentsFinalInscriptionsNew(
     }
 
     final int dni = LoggedUser.getDni();
-    if(dni != student.getDni() || !LoggedUser.isAdmin()) {
+    if(dni != student.getDni() && !LoggedUser.isAdmin()) {
       return status(Status.FORBIDDEN).build();
     }
 
@@ -396,7 +396,7 @@ public Response studentsFinalInscriptionsDestroy(
     }
 
     final int dni = LoggedUser.getDni();
-    if(dni != student.getDni() || !LoggedUser.isAdmin()) {
+    if(dni != student.getDni() && !LoggedUser.isAdmin()) {
       return status(Status.FORBIDDEN).build();
     }
 
@@ -421,7 +421,7 @@ public Response studentsFinalInscriptionsAvailable(@PathParam("docket") final In
     }
 
     final int dni = LoggedUser.getDni();
-    if(dni != student.getDni() || !LoggedUser.isAdmin()) {
+    if(dni != student.getDni() && !LoggedUser.isAdmin()) {
       return status(Status.FORBIDDEN).build();
     }
 

diff --git a/webapp/src/main/java/ar/edu/itba/paw/webapp/controllers/UserController.java b/webapp/src/main/java/ar/edu/itba/paw/webapp/controllers/UserController.java
@@ -34,7 +34,7 @@ public Response usersPasswordChange(@PathParam("dni") final int dni,
                                       @Valid PasswordDTO passwordDTO) {
 
     final int loggedDni = LoggedUser.getDni();
-    if(loggedDni != dni  || !LoggedUser.isAdmin()) {
+    if(loggedDni != dni  && !LoggedUser.isAdmin()) {
       return status(Status.FORBIDDEN).build();
     }