[pull] main from geonetwork:main

CONTRIBUTING.md

@@ -2,7 +2,11 @@
 
 Thank you for contributing to GeoNetwork!
 
-* Free-software: GeoNetwork is free-software, using the [GNU GENERAL PUBLIC LICENSE](LICENSE.md). Contributions provided by you, or your employer, are required to be compatible with this free-software license.
+* Free-software: GeoNetwork is free-software, using the [GNU GENERAL PUBLIC LICENSE](LICENSE.md).
+* Contributions provided by you, or your employer, are required to be compatible with this free-software license. You will therefor be asked to sign the [Contributor License Agreement](https://cla-assistant.io/geonetwork/) when you are contributing to the repositories. This process is automatically enabled when you create your first pull request via https://cla-assistant.io/.
+
+[![CLA assistant](https://cla-assistant.io/readme/badge/geonetwork/geonetwork)](https://cla-assistant.io/geonetwork/geonetwork)
+
 * Pull-request: GeoNetwork uses a pull-request workflow to review and accept changes. Pull-requests must be submitted against the *main* branch first, and may be back ported as required.
 
 # Pull requests

README.md

@@ -1,8 +1,6 @@
 # GeoNetwork opensource
 
-## Build Health
-
-[![Build Status](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml/badge.svg?branch=main)](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml?query=branch%3Amain)
+[![Build Status](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml/badge.svg?branch=main)](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml?query=branch%3Amain) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8626/badge)](https://www.bestpractices.dev/projects/8626)  [![CLA assistant](https://cla-assistant.io/readme/badge/geonetwork/geonetwork)](https://cla-assistant.io/geonetwork/geonetwork)
 
 ## Features
 
@@ -29,7 +27,4 @@ Developer documentation located in ``README.md`` files in the code-base:
 
 * General documentation for the project as a whole is in this [README.md](README.md)
 * [Software Development Documentation](/software_development/) provides instructions for setting up a development environment, building GeoNetwork, compiling user documentation, and making a releases.
-* Module specific documentation can be found in each module:
-
-## Open Source Security Foundation (OpenSSF) best practices status
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8626/badge)](https://www.bestpractices.dev/projects/8626)
+* Module specific documentation can be found in each module

cachingxslt/pom.xml

@@ -31,7 +31,7 @@
   <parent>
     <groupId>org.geonetwork-opensource</groupId>
     <artifactId>geonetwork</artifactId>
-    <version>4.4.6-SNAPSHOT</version>
+    <version>4.4.7-SNAPSHOT</version>
   </parent>
 
 

common/pom.xml

@@ -31,7 +31,7 @@
   <parent>
     <groupId>org.geonetwork-opensource</groupId>
     <artifactId>geonetwork</artifactId>
-    <version>4.4.6-SNAPSHOT</version>
+    <version>4.4.7-SNAPSHOT</version>
   </parent>
 
 

core/pom.xml

@@ -27,14 +27,21 @@
   <parent>
     <artifactId>geonetwork</artifactId>
     <groupId>org.geonetwork-opensource</groupId>
-    <version>4.4.6-SNAPSHOT</version>
+    <version>4.4.7-SNAPSHOT</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 
   <artifactId>gn-core</artifactId>
   <name>GeoNetwork core</name>
 
   <dependencies>
+
+    <dependency>
+      <groupId>org.geoserver.community.jwt-headers</groupId>
+      <artifactId>jwt-headers-util</artifactId>
+      <version>2.27-SNAPSHOT</version>
+    </dependency>
+
     <dependency>
       <groupId>net.objecthunter</groupId>
       <artifactId>exp4j</artifactId>
@@ -304,6 +311,10 @@
       <groupId>org.geotools</groupId>
       <artifactId>gt-geojson</artifactId>
     </dependency>
+    <dependency>
+      <groupId>com.jayway.jsonpath</groupId>
+      <artifactId>json-path</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.locationtech.jts</groupId>
       <artifactId>jts-core</artifactId>

core/src/main/java/jeeves/component/ProfileManager.java

@@ -65,11 +65,11 @@ public class ProfileManager {
      */
     public static Profile getLowestProfile(String[] profiles) {
         Profile lowestProfile = null;
-        int numberOfProfilesExtended = Profile.Administrator.getAll().size();
+        int numberOfProfilesExtended = Profile.Administrator.getProfileAndAllChildren().size();
 
         for (String profileName : profiles) {
             Profile p = Profile.valueOf(profileName);
-            Set<Profile> currentProfileSet = p.getAll();
+            Set<Profile> currentProfileSet = p.getProfileAndAllChildren();
             if (currentProfileSet.size() < numberOfProfilesExtended) {
                 lowestProfile = p;
                 numberOfProfilesExtended = currentProfileSet.size();
@@ -89,7 +89,7 @@ public static Profile getHighestProfile(Profile[] profiles) {
         int numberOfProfilesExtended = 0;
 
         for (Profile profile : profiles) {
-            Set<Profile> all = profile.getAll();
+            Set<Profile> all = profile.getProfileAndAllChildren();
             if (all.size() > numberOfProfilesExtended) {
                 highestProfile = profile;
                 numberOfProfilesExtended = all.size();

core/src/main/java/org/fao/geonet/api/exception/GeonetMaxUploadSizeExceededException.java

@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2001-2024 Food and Agriculture Organization of the
+ * United Nations (FAO-UN), United Nations World Food Programme (WFP)
+ * and United Nations Environment Programme (UNEP)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ *
+ * Contact: Jeroen Ticheler - FAO - Viale delle Terme di Caracalla 2,
+ * Rome - Italy. email: [email protected]
+ */
+
+package org.fao.geonet.api.exception;
+
+import java.util.Locale;
+
+import org.fao.geonet.exceptions.LocalizedException;
+
+public class GeonetMaxUploadSizeExceededException extends LocalizedException {
+
+    public GeonetMaxUploadSizeExceededException() {
+        super();
+    }
+
+    public GeonetMaxUploadSizeExceededException(String message) {
+        super(message);
+    }
+
+    public GeonetMaxUploadSizeExceededException(String message, Throwable cause) {
+        super(message, cause);
+    }
+
+    public GeonetMaxUploadSizeExceededException(Throwable cause) {
+        super(cause);
+    }
+
+    protected String getResourceBundleBeanQualifier() {
+        return "apiMessages";
+    }
+
+    @Override
+    public GeonetMaxUploadSizeExceededException withMessageKey(String messageKey) {
+        super.withMessageKey(messageKey);
+        return this;
+    }
+
+    @Override
+    public GeonetMaxUploadSizeExceededException withMessageKey(String messageKey, Object[] messageKeyArgs) {
+        super.withMessageKey(messageKey, messageKeyArgs);
+        return this;
+    }
+
+    @Override
+    public GeonetMaxUploadSizeExceededException withDescriptionKey(String descriptionKey) {
+        super.withDescriptionKey(descriptionKey);
+        return this;
+    }
+
+    @Override
+    public GeonetMaxUploadSizeExceededException withDescriptionKey(String descriptionKey, Object[] descriptionKeyArgs) {
+        super.withDescriptionKey(descriptionKey, descriptionKeyArgs);
+        return this;
+    }
+
+    @Override
+    public GeonetMaxUploadSizeExceededException withLocale(Locale locale) {
+        super.withLocale(locale);
+        return this;
+    }
+}

core/src/main/java/org/fao/geonet/api/records/attachments/AbstractStore.java

@@ -1,6 +1,6 @@
 /*
  * =============================================================================
- * ===	Copyright (C) 2019 Food and Agriculture Organization of the
+ * ===	Copyright (C) 2024 Food and Agriculture Organization of the
  * ===	United Nations (FAO-UN), United Nations World Food Programme (WFP)
  * ===	and United Nations Environment Programme (UNEP)
  * ===
@@ -35,21 +35,30 @@
 import org.fao.geonet.kernel.AccessManager;
 import org.fao.geonet.kernel.datamanager.IMetadataUtils;
 import org.fao.geonet.repository.MetadataRepository;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.context.ApplicationContext;
 import org.springframework.web.multipart.MultipartFile;
 
 import java.io.BufferedInputStream;
+import java.io.IOException;
 import java.io.InputStream;
+import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
+import java.util.Base64;
 import java.util.List;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
 
 public abstract class AbstractStore implements Store {
+    protected static final String RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_SEPARATOR = ":";
+    protected static final String RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_ESCAPED_SEPARATOR = "\\:";
+    private static final Logger log = LoggerFactory.getLogger(AbstractStore.class);
+
     @Override
     public final List<MetadataResource> getResources(final ServiceContext context, final String metadataUuid, final Sort sort,
             final String filter) throws Exception {
@@ -148,6 +157,29 @@ protected int canDownload(ServiceContext context, String metadataUuid, MetadataR
         return metadataId;
     }
 
+    protected String getFilenameFromHeader(final URL fileUrl) throws IOException {
+        HttpURLConnection connection = null;
+        try {
+            connection = (HttpURLConnection) fileUrl.openConnection();
+            connection.setRequestMethod("HEAD");
+            connection.connect();
+            String contentDisposition = connection.getHeaderField("Content-Disposition");
+
+            if (contentDisposition != null && contentDisposition.contains("filename=")) {
+                String filename = contentDisposition.split("filename=")[1].replace("\"", "").trim();
+                return filename.isEmpty() ? null : filename;
+            }
+            return null;
+        } catch (Exception e) {
+            log.error("Error retrieving resource filename from header", e);
+            return null;
+        } finally {
+            if (connection != null) {
+                connection.disconnect();
+            }
+        }
+    }
+
     protected String getFilenameFromUrl(final URL fileUrl) {
         String fileName = FilenameUtils.getName(fileUrl.getPath());
         if (fileName.contains("?")) {
@@ -194,7 +226,11 @@ public final MetadataResource putResource(ServiceContext context, String metadat
     @Override
     public final MetadataResource putResource(ServiceContext context, String metadataUuid, URL fileUrl,
             MetadataResourceVisibility visibility, Boolean approved) throws Exception {
-        return putResource(context, metadataUuid, getFilenameFromUrl(fileUrl), fileUrl.openStream(), null, visibility, approved);
+        String filename = getFilenameFromHeader(fileUrl);
+        if (filename == null) {
+            filename = getFilenameFromUrl(fileUrl);
+        }
+        return putResource(context, metadataUuid, filename, fileUrl.openStream(), null, visibility, approved);
     }
 
     @Override
@@ -279,4 +315,28 @@ public String toString() {
             }
         };
     }
+
+    private String escapeResourceManagementExternalProperties(String value) {
+        return value.replace(RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_SEPARATOR, RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_ESCAPED_SEPARATOR);
+    }
+
+    /**
+     * Create an encoded base 64 object id contains the following fields to uniquely identify the resource
+     * The fields are separated by a colon ":"
+     * @param type to identify type of storage - document/folder
+     * @param visibility of the resource public/private
+     * @param metadataId internal metadata id
+     * @param version identifier which can be used to directly get this version.
+     * @param resourceId or filename of the resource
+     * @return based 64 object id
+     */
+    protected String getResourceManagementExternalPropertiesObjectId(final String type, final MetadataResourceVisibility visibility, final Integer metadataId, final String version,
+                                                                     final String resourceId) {
+        return Base64.getEncoder().encodeToString(
+            ((type + RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_SEPARATOR +
+                escapeResourceManagementExternalProperties(visibility == null ? "" : visibility.toString().toLowerCase()) + RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_SEPARATOR +
+                metadataId + RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_SEPARATOR +
+                escapeResourceManagementExternalProperties(version == null ? "" : version) + RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_SEPARATOR +
+                escapeResourceManagementExternalProperties(resourceId)).getBytes()));
+    }
 }

core/src/main/java/org/fao/geonet/api/records/attachments/FilesystemStore.java

@@ -234,33 +234,43 @@ public String delResources(ServiceContext context, int metadataId) throws Except
         try {
             Log.info(Geonet.RESOURCES, String.format("Deleting all files from metadataId '%d'", metadataId));
             IO.deleteFileOrDirectory(metadataDir, true);
-            return String.format("Metadata '%s' directory removed.", metadataId);
+            Log.info(Geonet.RESOURCES,
+                String.format("Metadata '%d' directory removed.", metadataId));
+            return String.format("Metadata '%d' directory removed.", metadataId);
         } catch (Exception e) {
-            return String.format("Unable to remove metadata '%s' directory.", metadataId);
+            return String.format("Unable to remove metadata '%d' directory.", metadataId);
         }
     }
 
     @Override
     public String delResource(ServiceContext context, String metadataUuid, String resourceId, Boolean approved) throws Exception {
-        canEdit(context, metadataUuid, approved);
+        int metadataId = canEdit(context, metadataUuid, approved);
 
         try (ResourceHolder filePath = getResource(context, metadataUuid, resourceId, approved)) {
             Files.deleteIfExists(filePath.getPath());
-            return String.format("MetadataResource '%s' removed.", resourceId);
+            Log.info(Geonet.RESOURCES,
+                String.format("Resource '%s' removed for metadata %d (%s).", resourceId, metadataId, metadataUuid));
+            return String.format("Metadata resource '%s' removed.", resourceId);
         } catch (IOException e) {
+            Log.warning(Geonet.RESOURCES,
+                String.format("Unable to remove resource '%s' for metadata %d (%s). %s", resourceId, metadataId, metadataUuid, e.getMessage()));
             return String.format("Unable to remove resource '%s'.", resourceId);
         }
     }
 
     @Override
     public String delResource(final ServiceContext context, final String metadataUuid, final MetadataResourceVisibility visibility,
                               final String resourceId, Boolean approved) throws Exception {
-        canEdit(context, metadataUuid, approved);
+        int metadataId = canEdit(context, metadataUuid, approved);
 
         try (ResourceHolder filePath = getResource(context, metadataUuid, visibility, resourceId, approved)) {
             Files.deleteIfExists(filePath.getPath());
-            return String.format("MetadataResource '%s' removed.", resourceId);
+            Log.info(Geonet.RESOURCES,
+                String.format("Resource '%s' removed for metadata %d (%s).", resourceId, metadataId, metadataUuid));
+            return String.format("Metadata resource '%s' removed.", resourceId);
         } catch (IOException e) {
+            Log.warning(Geonet.RESOURCES,
+                String.format("Unable to remove resource '%s' for metadata %d (%s). %s", resourceId, metadataId, metadataUuid, e.getMessage()));
             return String.format("Unable to remove resource '%s'.", resourceId);
         }
     }

core/src/main/java/org/fao/geonet/kernel/AccessManager.java

@@ -509,6 +509,37 @@ private boolean hasEditingPermissionWithProfile(final ServiceContext context, fi
 
     }
 
+    /**
+     * Checks if the user has the specified profile or any profile with greater permissions within the group.
+     *
+     * @param context The service context containing the user's session.
+     * @param profile The profile to be verified.
+     * @param groupId The ID of the group in which the user's profile is to be verified.
+     * @return true if the user has the specified profile (or greater) within the group; false otherwise.
+     */
+    public boolean isProfileOrMoreOnGroup(final ServiceContext context, Profile profile, final int groupId) {
+        UserSession us = context.getUserSession();
+        if (!isUserAuthenticated(us)) {
+            return false;
+        }
+
+        // Grant access if the user is a global administrator
+        if (Profile.Administrator == us.getProfile()) {
+            return true;
+        }
+
+        // Get the profile and all its parent profiles to consider higher-level permissions
+        Set<Profile> acceptedProfiles = profile.getProfileAndAllParents();
+
+        // Build a specification to fetch any accepted profiles for the user in the specified group
+        Specification<UserGroup> spec = Specification.where(UserGroupSpecs.hasUserId(us.getUserIdAsInt()))
+            .and(UserGroupSpecs.hasGroupId(groupId))
+            .and(UserGroupSpecs.hasProfileIn(acceptedProfiles));
+        List<UserGroup> userGroups = userGroupRepository.findAll(spec);
+
+        return !userGroups.isEmpty();
+    }
+
     public int getPrivilegeId(final String name) {
         final Operation op = operationRepository.findByName(name);
         if (op == null) {