fix(security): require administrator role for user and account management (#322)

* fix(security): require administrator role for user and account management

The admin surface was gated by a single URL rule allowing both
administrators and researchers, so a researcher could reach the user,
role, portal and news management endpoints and grant themselves the
administrator role, disable accounts, or read other users' details.

Restrict those endpoints to administrators at the URL layer and add
method-level enforcement on the account management controllers so the
restriction does not depend on the URL configuration alone.

* fix(security): hide admin-only links in the admin index page

The user management links in the admin index page pointed at endpoints
that now require the administrator role, so a researcher would follow
them into a 403. Wrap the whole user management section in
<sec:authorize> instead, which also drops the nested check around the
logged-in user lists.

Require the administrator role for /admin/project/updatesharedprojects
as well. The page only drives the /api/admin/project/shared endpoints,
which administrators alone may call.

Drop the WebSecurityConfig comments; the rules speak for themselves.

* fix(security): close trailing slash bypass on exact admin paths

The admin-only rules for /admin/mergeProjectMetadata and
/admin/run/replacebase64withpng.html were exact ant patterns. Spring MVC
matches a trailing slash and routes /admin/mergeProjectMetadata/ to the
controller, but the ant matcher does not, so the request fell through to
the broader /admin/** rule and a researcher reached both endpoints.

Match these paths the way Spring MVC matches them, and secure the two
controllers directly so the rules are not the only guard.

Author: Isaries

src/main/java/org/wise/portal/presentation/web/controllers/admin/AdminUtilsController.java

@@ -24,6 +24,7 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.wise.portal.domain.project.Project;
@@ -42,6 +43,7 @@
  * Admin utility functions like db migrations and batch scripts
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 public class AdminUtilsController {
 

src/main/java/org/wise/portal/presentation/web/controllers/admin/BatchCreateUserAccountsController.java

@@ -30,6 +30,7 @@
 import java.util.Calendar;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.validation.BindingResult;
@@ -55,6 +56,7 @@
  *
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/batchcreateuseraccounts.html")
 public class BatchCreateUserAccountsController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/EnableDisableUserController.java

@@ -29,6 +29,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -41,6 +42,7 @@
  * Only accessed by a WISE admin user.
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/enabledisableuser")
 public class EnableDisableUserController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/LookupUserController.java

@@ -29,6 +29,7 @@
 import javax.servlet.http.HttpServletRequest;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.validation.BindingResult;
@@ -50,6 +51,7 @@
  * @author Patrick Lawler
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/lookupuser")
 public class LookupUserController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/ManageUserRolesController.java

@@ -29,6 +29,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
@@ -44,6 +45,7 @@
  *
  * @author Hiroki Terashima
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/manageuserroles.html")
 public class ManageUserRolesController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/ShowAllUsersController.java

@@ -1,13 +1,15 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.wise.portal.service.authentication.UserDetailsService;
 
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/account/show-all-users")
 public class ShowAllUsersController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/UpdateProjectSharedPermissionsAPIController.java

@@ -1,6 +1,7 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.web.bind.annotation.*;
 import org.wise.portal.dao.ObjectNotFoundException;
@@ -13,6 +14,7 @@
 import java.util.List;
 import java.util.Set;
 
+@Secured("ROLE_ADMINISTRATOR")
 @RestController
 @RequestMapping("/api/admin/project/shared")
 public class UpdateProjectSharedPermissionsAPIController {

src/main/java/org/wise/portal/presentation/web/controllers/admin/UpdateSharedProjectsController.java

@@ -1,11 +1,13 @@
 package org.wise.portal.presentation.web.controllers.admin;
 
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.servlet.ModelAndView;
 
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/project/updatesharedprojects")
 public class UpdateSharedProjectsController {

src/main/java/org/wise/portal/presentation/web/controllers/run/ReplaceBase64WithPNGController.java

@@ -3,6 +3,7 @@
 import org.json.JSONObject;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.env.Environment;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -32,6 +33,7 @@
  * student data, it will replace the Base64 string with a reference to that png image in the
  * studentuploads folder.
  */
+@Secured("ROLE_ADMINISTRATOR")
 @Controller
 @RequestMapping("/admin/run/replacebase64withpng.html")
 public class ReplaceBase64WithPNGController {

src/main/java/org/wise/portal/spring/impl/WebSecurityConfig.java

@@ -85,14 +85,23 @@ protected void configure(HttpSecurity http) throws Exception {
         .addFilterAfter(googleOpenIdConnectFilter(), OAuth2ClientContextFilter.class)
         .addFilterAfter(microsoftOpenIdConnectFilter(), OAuth2ClientContextFilter.class)
         .addFilterAfter(authenticationProcessingFilter(), GoogleOpenIdConnectFilter.class)
-        .authorizeRequests().antMatchers("/api/login/impersonate")
-        .hasAnyRole("ADMINISTRATOR", "RESEARCHER").antMatchers("/admin/**")
-        .hasAnyRole("ADMINISTRATOR", "RESEARCHER").antMatchers("/author/**").hasAnyRole("TEACHER")
+        .authorizeRequests()
+        // Matched the way Spring MVC matches, so a trailing slash cannot slip an exact path
+        // past these rules and into the broader "/admin/**" rule below.
+        .mvcMatchers("/admin/account/**", "/admin/portal/**", "/admin/news/**",
+            "/admin/mergeProjectMetadata", "/admin/project/updatesharedprojects",
+            "/admin/run/replacebase64withpng.html", "/api/admin/**")
+        .hasRole("ADMINISTRATOR")
+        .antMatchers("/api/login/impersonate").hasAnyRole("ADMINISTRATOR", "RESEARCHER")
+        .antMatchers("/admin/**").hasAnyRole("ADMINISTRATOR", "RESEARCHER")
+        .antMatchers("/author/**").hasAnyRole("TEACHER")
         .antMatchers("/project/notifyAuthor*/**").hasAnyRole("TEACHER")
-        .antMatchers("/student/account/info").hasAnyRole("TEACHER").antMatchers("/student/**")
-        .hasAnyRole("STUDENT").antMatchers("/studentStatus").hasAnyRole("TEACHER", "STUDENT")
-        .antMatchers("/teacher/**").hasAnyRole("TEACHER").antMatchers("/sso/discourse")
-        .hasAnyRole("TEACHER", "STUDENT").antMatchers("/").permitAll();
+        .antMatchers("/student/account/info").hasAnyRole("TEACHER")
+        .antMatchers("/student/**").hasAnyRole("STUDENT")
+        .antMatchers("/studentStatus").hasAnyRole("TEACHER", "STUDENT")
+        .antMatchers("/teacher/**").hasAnyRole("TEACHER")
+        .antMatchers("/sso/discourse").hasAnyRole("TEACHER", "STUDENT")
+        .antMatchers("/").permitAll();
     http.formLogin().loginPage("/login").permitAll();
     http.logout().addLogoutHandler(wiseLogoutHandler())
         .logoutRequestMatcher(new AntPathRequestMatcher("/api/logout"));