Merge remote-tracking branch 'tuomari/queue' into queuefixes

code/moya-beans/ejbModule/fi/codecrew/moya/beans/QueueBean.java

@@ -120,7 +120,7 @@ public class QueueBean implements QueueBeanLocal {
 					logger.info("Removed user {} from reserving queue", user);
 					logger.info("Removed user {} from reserving queue", user);
 				}
 				}
 				// There should neve be more than one instance, but make sure
 				// There should neve be more than one instance, but make sure
-				while (!queue.remove(user)) {
+				while (queue.remove(user)) {
 					logger.info("Removed user {} from queue");
 					logger.info("Removed user {} from queue");
 				}
 				}
 				ret = queEntries.remove(user);
 				ret = queEntries.remove(user);
@@ -189,6 +189,10 @@ public class QueueBean implements QueueBeanLocal {
 		// If queue is not enabled, user can always reserve
 		// If queue is not enabled, user can always reserve
 		if (!isQueueEnabled())
 		if (!isQueueEnabled())
 			return true;
 			return true;
+		if (map == null || user == null)
+		{
+			logger.warn("Can not check map {}, user {}", map, user);
+		}
 		boolean ret = getMapque(map).isReserving(user);
 		boolean ret = getMapque(map).isReserving(user);
 
 
 		// Do some housekeeping, but only on each 120
 		// Do some housekeeping, but only on each 120

code/moya-web/src/main/java/fi/codecrew/moya/rest/placemap/v1/PlacemapRestViewV1.java

@@ -22,6 +22,7 @@ import org.slf4j.LoggerFactory;
 
 
 import fi.codecrew.moya.beans.PermissionBeanLocal;
 import fi.codecrew.moya.beans.PermissionBeanLocal;
 import fi.codecrew.moya.beans.PlaceBeanLocal;
 import fi.codecrew.moya.beans.PlaceBeanLocal;
+import fi.codecrew.moya.beans.QueueBeanLocal;
 import fi.codecrew.moya.model.EventMap;
 import fi.codecrew.moya.model.EventMap;
 import fi.codecrew.moya.model.EventUser;
 import fi.codecrew.moya.model.EventUser;
 import fi.codecrew.moya.model.Place;
 import fi.codecrew.moya.model.Place;
@@ -47,6 +48,9 @@ public class PlacemapRestViewV1 {
 	@Inject
 	@Inject
 	private UserView userView;
 	private UserView userView;
 
 
+	@EJB
+	private QueueBeanLocal quebean;
+
 	//	@GET
 	//	@GET
 	//	@Path("/maps")
 	//	@Path("/maps")
 	//	public PlacemapMapRootPojo getMaps()
 	//	public PlacemapMapRootPojo getMaps()
@@ -116,6 +120,13 @@ public class PlacemapRestViewV1 {
 		}
 		}
 
 
 		Place p = placebean.find(placeId);
 		Place p = placebean.find(placeId);
+		EventMap map = p.getMap();
+		if (!quebean.isReserving(map, user))
+		{
+			logger.warn("User is not in reservation order ");
+			return Response.status(Response.Status.FORBIDDEN).build();
+		}
+
 		boolean success = false;
 		boolean success = false;
 		if (p.isReservedFor(user)) {
 		if (p.isReservedFor(user)) {
 			success = placebean.releasePlace(p);
 			success = placebean.releasePlace(p);

code/moya-web/src/main/java/fi/codecrew/moya/web/cdiview/map/AjaxMapView.java

@@ -139,7 +139,7 @@ public class AjaxMapView extends GenericCDIView {
 	public boolean canUserBuy() {
 	public boolean canUserBuy() {
 		return permbean.hasPermission(MapPermission.BUY_PLACES) &&
 		return permbean.hasPermission(MapPermission.BUY_PLACES) &&
 				(permbean.hasPermission(MapPermission.MANAGE_OTHERS) ||
 				(permbean.hasPermission(MapPermission.MANAGE_OTHERS) ||
-				quebean.isReserving(map, permbean.getCurrentUser())
+				quebean.isReserving(initMap(), permbean.getCurrentUser())
 				);
 				);
 	}
 	}