Review

finding-0

database/SocialNetworkDatabasePosts.java

authorizedFFAPost(Connection, String, int, String)

class SocialNetworkDatabasePosts {
	/**
	 * AUTHORIZATION FUNCTION
	 * Returns whether this user can go to/reply under the specified post # in the FFA board.
	 * The user must be the post's author or have a privilege in the post.
	 * Assumes post already exists.
	 * AuthType = "view" or "reply". For view, merely checks that a priv exists.
	 * For reply, checks that the priv is "viewpost"
	 */
	public static Boolean authorizedFFAPost(Connection conn, String username, int postNum, String authType) {
		
		Boolean isPostCreator = isFFAPostCreator(conn, username, postNum);
		if (isPostCreator == null) {
			return null;
		}
		else if (isPostCreator.booleanValue()) {
			return new Boolean(true);
		}
		else {		
			/*Retrieve the privilege for a given post and user*/
			PreparedStatement getPriv = null;
			String getPrivString = "SELECT privilege " +
					"FROM freeforall.postprivileges " +
					"WHERE pid = ? AND username = ?";
			ResultSet privResult = null;
			
			Boolean authorized = null;
			
			try {
				getPriv = conn.prepareStatement(getPrivString);
				getPriv.setInt(1, postNum);
				getPriv.setString(2, username);
				
				privResult = getPriv.executeQuery();
				
				//the privilege is at least View
				if (authType.equals("view")) {
					authorized = new Boolean(privResult.next());
				}
				else if (authType.equals("reply")) {
					if (privResult.next()) {
						authorized = new Boolean(privResult.getString("privilege").equals("viewpost"));
					}
					else {
						authorized = new Boolean(false);
					}
				}
			}
			catch (SQLException e) {
				e.printStackTrace();
			}
			finally {
				DBManager.closeResultSet(privResult);
				DBManager.closePreparedStatement(getPriv);
			}
			return authorized;
		}
	}
}