diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/AbstractServer.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/AbstractServer.java index 02c531d92cf44ec86c8595b14c329e37d89c66f3..7ef2144e2dbc170097cff42262a2a699bebc8265 100644 --- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/AbstractServer.java +++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/AbstractServer.java @@ -16,6 +16,7 @@ package ch.systemsx.cisd.openbis.generic.server; +import java.util.ArrayList; import java.util.Collections; import java.util.List; @@ -35,6 +36,7 @@ import ch.systemsx.cisd.openbis.generic.server.plugin.ISampleTypeSlaveServerPlug import ch.systemsx.cisd.openbis.generic.server.plugin.SampleServerPluginRegistry; import ch.systemsx.cisd.openbis.generic.server.util.HibernateTransformer; import ch.systemsx.cisd.openbis.generic.shared.IServer; +import ch.systemsx.cisd.openbis.generic.shared.authorization.validator.CustomGridExpressionValidator; import ch.systemsx.cisd.openbis.generic.shared.basic.IDataStoreBaseURLProvider; import ch.systemsx.cisd.openbis.generic.shared.basic.TechId; import ch.systemsx.cisd.openbis.generic.shared.basic.dto.DisplaySettings; @@ -310,9 +312,23 @@ public abstract class AbstractServer<T extends IServer> extends AbstractServiceW public List<GridCustomColumn> listGridCustomColumns(String sessionToken, String gridId) { - checkSession(sessionToken); - List<GridCustomColumnPE> columns = + Session session = getSession(sessionToken); + + List<GridCustomColumnPE> columnPEs = getDAOFactory().getGridCustomColumnDAO().listColumns(gridId); - return GridCustomColumnTranslator.translate(columns); + + List<GridCustomColumn> result = new ArrayList<GridCustomColumn>(); + List<GridCustomColumn> columns = GridCustomColumnTranslator.translate(columnPEs); + // we have to remove private columns of different users to avoid calculating them + CustomGridExpressionValidator validator = new CustomGridExpressionValidator(); + PersonPE currentPerson = session.tryGetPerson(); + for (GridCustomColumn column : columns) + { + if (validator.isValid(currentPerson, column)) + { + result.add(column); + } + } + return result; } } diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/authorization/validator/CustomGridExpressionValidator.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/authorization/validator/CustomGridExpressionValidator.java index 479ef6726c0c5819dd01861371a5483666e59621..06c3c0087e11c42f19839a1cd7a9fc30594dc44d 100644 --- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/authorization/validator/CustomGridExpressionValidator.java +++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/shared/authorization/validator/CustomGridExpressionValidator.java @@ -56,7 +56,7 @@ public final class CustomGridExpressionValidator extends registrator.getDatabaseInstance().getCode()); } - public boolean isInstanceAdmin(final PersonPE person, final DatabaseInstance databaseInstance) + private static boolean isInstanceAdmin(final PersonPE person, final DatabaseInstance databaseInstance) { final Set<RoleAssignmentPE> roleAssignments = person.getAllPersonRoles(); for (final RoleAssignmentPE roleAssignment : roleAssignments)