fix(security): require administrator role for user and account management

src/main/java/org/wise/portal/presentation/web/controllers/admin/AdminUtilsController.java

@@ -24,6 +24,7 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.wise.portal.domain.project.Project;
@@ -42,6 +43,7 @@
  * Admin utility functions like db migrations and batch scripts
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 public class AdminUtilsController {
 

src/main/java/org/wise/portal/presentation/web/controllers/admin/BatchCreateUserAccountsController.java

@@ -30,6 +30,7 @@
 import java.util.Calendar;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.validation.BindingResult;
@@ -55,6 +56,7 @@
  *
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/batchcreateuseraccounts.html")
 public class BatchCreateUserAccountsController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/EnableDisableUserController.java

@@ -29,6 +29,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -41,6 +42,7 @@
  * Only accessed by a WISE admin user.
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/enabledisableuser")
 public class EnableDisableUserController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/LookupUserController.java

@@ -29,6 +29,7 @@
 import javax.servlet.http.HttpServletRequest;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.validation.BindingResult;
@@ -50,6 +51,7 @@
  * @author Patrick Lawler
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/lookupuser")
 public class LookupUserController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/ManageUserRolesController.java

@@ -29,6 +29,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
@@ -44,6 +45,7 @@
  *
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/manageuserroles.html")
 public class ManageUserRolesController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/ShowAllUsersController.java

@@ -1,13 +1,15 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.wise.portal.service.authentication.UserDetailsService;
 
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/show-all-users")
 public class ShowAllUsersController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/UpdateProjectSharedPermissionsAPIController.java

@@ -1,6 +1,7 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.web.bind.annotation.*;
 import org.wise.portal.dao.ObjectNotFoundException;
@@ -13,6 +14,7 @@
 import java.util.List;
 import java.util.Set;
 
+@Secured("ROLE_ADMINISTRATOR")
 @RestController
 @RequestMapping("/api/admin/project/shared")
 public class UpdateProjectSharedPermissionsAPIController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/UpdateSharedProjectsController.java

@@ -1,11 +1,13 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.servlet.ModelAndView;
 
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/project/updatesharedprojects")
 public class UpdateSharedProjectsController {

src/main/java/org/wise/portal/presentation/web/controllers/run/ReplaceBase64WithPNGController.java

@@ -3,6 +3,7 @@
 import org.json.JSONObject;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.env.Environment;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -32,6 +33,7 @@
  * student data, it will replace the Base64 string with a reference to that png image in the
  * studentuploads folder.
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/run/replacebase64withpng.html")
 public class ReplaceBase64WithPNGController {

src/main/java/org/wise/portal/spring/impl/WebSecurityConfig.java

@@ -85,14 +85,23 @@ protected void configure(HttpSecurity http) throws Exception {
         .addFilterAfter(googleOpenIdConnectFilter(), OAuth2ClientContextFilter.class)
         .addFilterAfter(microsoftOpenIdConnectFilter(), OAuth2ClientContextFilter.class)
         .addFilterAfter(authenticationProcessingFilter(), GoogleOpenIdConnectFilter.class)
-        .authorizeRequests().antMatchers("/api/login/impersonate")
-        .hasAnyRole("ADMINISTRATOR", "RESEARCHER").antMatchers("/admin/**")
-        .hasAnyRole("ADMINISTRATOR", "RESEARCHER").antMatchers("/author/**").hasAnyRole("TEACHER")
+        .authorizeRequests()
+        // Matched the way Spring MVC matches, so a trailing slash cannot slip an exact path
+        // past these rules and into the broader "/admin/**" rule below.
+        .mvcMatchers("/admin/account/**", "/admin/portal/**", "/admin/news/**",
+            "/admin/mergeProjectMetadata", "/admin/project/updatesharedprojects",
+            "/admin/run/replacebase64withpng.html", "/api/admin/**")
+        .hasRole("ADMINISTRATOR")
+        .antMatchers("/api/login/impersonate").hasAnyRole("ADMINISTRATOR", "RESEARCHER")
+        .antMatchers("/admin/**").hasAnyRole("ADMINISTRATOR", "RESEARCHER")
+        .antMatchers("/author/**").hasAnyRole("TEACHER")
         .antMatchers("/project/notifyAuthor*/**").hasAnyRole("TEACHER")
-        .antMatchers("/student/account/info").hasAnyRole("TEACHER").antMatchers("/student/**")
-        .hasAnyRole("STUDENT").antMatchers("/studentStatus").hasAnyRole("TEACHER", "STUDENT")
-        .antMatchers("/teacher/**").hasAnyRole("TEACHER").antMatchers("/sso/discourse")
-        .hasAnyRole("TEACHER", "STUDENT").antMatchers("/").permitAll();
+        .antMatchers("/student/account/info").hasAnyRole("TEACHER")
+        .antMatchers("/student/**").hasAnyRole("STUDENT")
+        .antMatchers("/studentStatus").hasAnyRole("TEACHER", "STUDENT")
+        .antMatchers("/teacher/**").hasAnyRole("TEACHER")
+        .antMatchers("/sso/discourse").hasAnyRole("TEACHER", "STUDENT")
+        .antMatchers("/").permitAll();
     http.formLogin().loginPage("/login").permitAll();
     http.logout().addLogoutHandler(wiseLogoutHandler())
         .logoutRequestMatcher(new AntPathRequestMatcher("/api/logout"));

src/main/webapp/portal/admin/index.jsp

@@ -58,12 +58,12 @@
                 </div>
                 <div class="panelContent">
 
-                    <div class="sectionHead" style="padding-top: 0;">
-                        <spring:message code='admin.index.userManagement' />
-                    </div>
-                    <div class="sectionContent">
-                        <h5>
-                            <sec:authorize access="hasRole('ROLE_ADMINISTRATOR')">
+                    <sec:authorize access="hasRole('ROLE_ADMINISTRATOR')">
+                        <div class="sectionHead" style="padding-top: 0;">
+                            <spring:message code='admin.index.userManagement' />
+                        </div>
+                        <div class="sectionContent">
+                            <h5>
                                 <spring:message code='admin.index.list' />
                                 <spring:message code='admin.index.allUsersWhoLoggedIn' />
                                 <a href="${contextPath}/admin/account/show-online-users">
@@ -76,34 +76,34 @@
                                     <spring:message code='thisMonth' /></a> |
                                 <a href="${contextPath}/admin/account/show-recent-users?duration=thisYear">
                                     <spring:message code='thisYear' /></a>
-                            </sec:authorize>
-                        </h5>
-                        <h5>
-                            <spring:message code='admin.index.find' />
-                            <a href="${contextPath}/admin/account/lookupuser?userType=teacher">
-                                <spring:message code='teacher_cap' /></a> |
-                            <a href="${contextPath}/admin/account/lookupuser?userType=student">
-                                <spring:message code='student_cap' /></a>
-                        </h5>
-                        <h5>
-                            <spring:message code='admin.index.list' />
-                            <a href="${contextPath}/admin/account/show-all-users?userType=teacher">
-                                <spring:message code='admin.index.allTeachers' /></a> |
-                            <a href="${contextPath}/admin/account/show-all-users?userType=student">
-                                <spring:message code='admin.index.allStudents' /></a>
+                            </h5>
+                            <h5>
+                                <spring:message code='admin.index.find' />
+                                <a href="${contextPath}/admin/account/lookupuser?userType=teacher">
+                                    <spring:message code='teacher_cap' /></a> |
+                                <a href="${contextPath}/admin/account/lookupuser?userType=student">
+                                    <spring:message code='student_cap' /></a>
+                            </h5>
+                            <h5>
+                                <spring:message code='admin.index.list' />
+                                <a href="${contextPath}/admin/account/show-all-users?userType=teacher">
+                                    <spring:message code='admin.index.allTeachers' /></a> |
+                                <a href="${contextPath}/admin/account/show-all-users?userType=student">
+                                    <spring:message code='admin.index.allStudents' /></a>
 
-                        </h5>
-                        <h5>
-                            <a href="${contextPath}/admin/account/enabledisableuser">
-                                <spring:message code='admin.index.enableDisableUser' /></a>
-                        </h5>
-                        <c:if test="${isBatchCreateUserAccountsEnabled}">
+                            </h5>
                             <h5>
-                                <a href="${contextPath}/admin/account/batchcreateuseraccounts.html">
-                                    <spring:message code='admin.index.batchCreateUserAccounts' /></a>
+                                <a href="${contextPath}/admin/account/enabledisableuser">
+                                    <spring:message code='admin.index.enableDisableUser' /></a>
                             </h5>
-                        </c:if>
-                    </div>
+                            <c:if test="${isBatchCreateUserAccountsEnabled}">
+                                <h5>
+                                    <a href="${contextPath}/admin/account/batchcreateuseraccounts.html">
+                                        <spring:message code='admin.index.batchCreateUserAccounts' /></a>
+                                </h5>
+                            </c:if>
+                        </div>
+                    </sec:authorize>
 
                     <div class="sectionHead">
                         <spring:message code='admin.index.projectRunManagement' />