Review

finding-12

/mubench/checkouts/chensun/cf23b99/build/CS5430/src/database/SocialNetworkDatabaseBoards.java

authorizedGoToBoard(Connection, String, String)

class SocialNetworkDatabaseBoards {
	/** Returns whether the user is authorized to go to this board.
	 * Equivalent checking as in GetBoardList:
	 * For Admins: Must be within the "admin" list of the board
	 * For Users: Must be within the "RegionPrivileges" list of the board for some region
	 * Assumes the board already exists and is not 'freeforall' board
	 */
	public static Boolean authorizedGoToBoard(Connection conn, String username, String boardname) {
		Statement stmt = null;
		PreparedStatement pstmt = null;
		ResultSet boards = null;
		ResultSet privResult = null;
		Boolean authorized = null;
		try {
			String getRegionPrivs, getRegionAdmins;
			String role = DatabaseAdmin.getUserRole(conn, username);
			
			if (role.equals("admin") || role.equals("sa")) { // an admin
				getRegionAdmins = "SELECT * FROM main.boardadmins WHERE bname = ? AND username = ?";
				pstmt = conn.prepareStatement(getRegionAdmins);
				pstmt.setString(1, boardname);
				pstmt.setString(2, username);
				privResult = pstmt.executeQuery();
				authorized = new Boolean(privResult.next());
				privResult.close();
				pstmt.close();
				privResult = null;
				pstmt = null;
			}
			else if (!role.equals("")) {
				stmt = conn.createStatement();
				getRegionPrivs = "SELECT privilege FROM " 
					+ boardname + ".regionprivileges WHERE username = ?";
				pstmt = conn.prepareStatement(getRegionPrivs);
				pstmt.setString(1, username);
				privResult = pstmt.executeQuery();
				authorized = new Boolean(privResult.next());
				privResult.close();
				pstmt.close();
				privResult = null;
				pstmt = null;
			}
			else { //there was an sql exception when getting the role.
				
			}
		}
		catch (SQLException e) {
			e.printStackTrace();
			
		}
		finally {
			DBManager.closeStatement(stmt);
			DBManager.closePreparedStatement(pstmt);
			DBManager.closeResultSet(boards);
		}
		return authorized;
	}
}