Prevent unauthorized access to book data even if hash id is known

Signed-off-by: Pekka Helenius <fincer89@hotmail.com>

bookstore/src/main/java/com/fjordtek/bookstore/web/BookController.java

@@ -259,15 +259,27 @@ public class BookController {
 			@PathVariable("hash_id") String bookHashId,
 			Model dataModel,
 			HttpServletRequest requestData,
-			HttpServletResponse responseData
+			HttpServletResponse responseData,
+			Authentication authData
 			) {
 
+		String authorities = authData.getAuthorities().toString();
+
 		try {
 			Long bookIdFromHash = bookHashRepository.findByHashId(bookHashId).getBookId();
 			Book book = bookRepository.findById(bookIdFromHash).get();
 
 			dataModel.addAttribute("book", book);
 
+			/*
+			 * Prevent other than MARKETING users to access hidden book
+			 * data even if they knew hash id.
+			 */
+			if (!book.getPublish() && !authorities.contains("MARKETING") ) {
+				//responseData.setStatus(HttpServletResponse.SC_BAD_REQUEST);
+				return "redirect:/" + bookListPageView;
+			}
+
 			httpServerLogger.log(requestData, responseData);
 			return bookEditPageView;
 
@@ -350,6 +362,15 @@ public class BookController {
 			return bookEditPageView;
 		}
 
+		/*
+		 * Prevent other than MARKETING users to access hidden book
+		 * data even if they knew hash id.
+		 */
+		if (!book.getPublish() && !authorities.contains("MARKETING") ) {
+			//responseData.setStatus(HttpServletResponse.SC_BAD_REQUEST);
+			return "redirect:/" + bookListPageView;
+		}
+
 		/*
 		 * More sophisticated methods are required to handle
 		 * user input with random letter cases etc. considered

bookstore/src/main/java/com/fjordtek/bookstore/web/BookRestController.java

@@ -78,12 +78,29 @@ public class BookRestController {
 	public @ResponseBody Optional<Book> getBookRestData(
 			@PathVariable("hash_id") String bookHashId,
 			HttpServletRequest requestData,
-			HttpServletResponse responseData
+			HttpServletResponse responseData,
+			Authentication authData
 			) {
 
+		String authorities = authData.getAuthorities().toString();
+
 		try {
 
 			Long bookId = new Long(bookHashRepository.findByHashId(bookHashId).getBookId());
+
+			Book book = bookRepository.findById(bookId).get();
+
+			/*
+			 * Prevent other than MARKETING users to access hidden book
+			 * data even if they knew hash id.
+			 */
+			if (!book.getPublish() && !authorities.contains("MARKETING") ) {
+		    	responseData.setHeader("Location", "/" + bookListPageView);
+		    	responseData.setStatus(302);
+		    	httpServerLogger.log(requestData, responseData);
+		    	return null;
+			}
+
 			httpServerLogger.log(requestData, responseData);
 			return bookRepository.findById(bookId);