added permission checks to pull command

scm-core/src/main/java/sonia/scm/repository/api/PullCommandBuilder.java

@@ -33,10 +33,18 @@ package sonia.scm.repository.api;
 
 //~--- non-JDK imports --------------------------------------------------------
 
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryException;
 import sonia.scm.repository.spi.PullCommand;
 import sonia.scm.repository.spi.PullCommandRequest;
+import sonia.scm.security.RepositoryPermission;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -50,15 +58,25 @@ import java.io.IOException;
 public final class PullCommandBuilder
 {
 
+  /**
+   * the logger for PullCommandBuilder
+   */
+  private static final Logger logger =
+    LoggerFactory.getLogger(PullCommandBuilder.class);
+
+  //~--- constructors ---------------------------------------------------------
+
   /**
    * Constructs ...
    *
    *
    * @param command
+   * @param localRepository
    */
-  PullCommandBuilder(PullCommand command)
+  PullCommandBuilder(PullCommand command, Repository localRepository)
   {
     this.command = command;
+    this.localRepository = localRepository;
   }
 
   //~--- methods --------------------------------------------------------------
@@ -77,8 +95,21 @@ public final class PullCommandBuilder
   public PullResponse pull(Repository remoteRepository)
     throws IOException, RepositoryException
   {
+    Subject subject = SecurityUtils.getSubject();
+
+    //J-
+    subject.checkPermission(
+      new RepositoryPermission(localRepository, PermissionType.WRITE)
+    );
+    subject.checkPermission(
+      new RepositoryPermission(remoteRepository, PermissionType.READ)
+    );
+    //J+
+
     request.setRemoteRepository(remoteRepository);
 
+    logger.info("pull changes from {}", remoteRepository);
+
     return command.pull(request);
   }
 
@@ -87,6 +118,9 @@ public final class PullCommandBuilder
   /** Field description */
   private PullCommand command;
 
+  /** Field description */
+  private Repository localRepository;
+
   /** Field description */
   private PullCommandRequest request = new PullCommandRequest();
 }

scm-core/src/main/java/sonia/scm/repository/api/RepositoryService.java

@@ -316,7 +316,7 @@ public final class RepositoryService implements Closeable
         repository.getName());
     }
 
-    return new PullCommandBuilder(provider.getPullCommand());
+    return new PullCommandBuilder(provider.getPullCommand(), repository);
   }
 
   /**