01: /* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
02: *
03: * Licensed under the Apache License, Version 2.0 (the "License");
04: * you may not use this file except in compliance with the License.
05: * You may obtain a copy of the License at
06: *
07: * http://www.apache.org/licenses/LICENSE-2.0
08: *
09: * Unless required by applicable law or agreed to in writing, software
10: * distributed under the License is distributed on an "AS IS" BASIS,
11: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12: * See the License for the specific language governing permissions and
13: * limitations under the License.
14: */
15:
16: package org.acegisecurity.ui;
17:
18: import org.acegisecurity.AccessDeniedException;
19:
20: import org.apache.commons.logging.Log;
21: import org.apache.commons.logging.LogFactory;
22:
23: import java.io.IOException;
24:
25: import javax.servlet.RequestDispatcher;
26: import javax.servlet.ServletException;
27: import javax.servlet.ServletRequest;
28: import javax.servlet.ServletResponse;
29: import javax.servlet.http.HttpServletRequest;
30: import javax.servlet.http.HttpServletResponse;
31:
32: /**
33: * Base implementation of {@link AccessDeniedHandler}.<p>This implementation sends a 403 (SC_FORBIDDEN) HTTP error
34: * code. In addition, if a {@link #errorPage} is defined, the implementation will perform a request dispatcher
35: * "forward" to the specified error page view. Being a "forward", the <code>SecurityContextHolder</code> will remain
36: * populated. This is of benefit if the view (or a tag library or macro) wishes to access the
37: * <code>SecurityContextHolder</code>. The request scope will also be populated with the exception itself, available
38: * from the key {@link #ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY}.</p>
39: *
40: * @author Ben Alex
41: * @version $Id: AccessDeniedHandlerImpl.java 1784 2007-02-24 21:00:24Z luke_t $
42: */
43: public class AccessDeniedHandlerImpl implements AccessDeniedHandler {
44: //~ Static fields/initializers =====================================================================================
45:
46: public static final String ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY = "ACEGI_SECURITY_403_EXCEPTION";
47: protected static final Log logger = LogFactory
48: .getLog(AccessDeniedHandlerImpl.class);
49:
50: //~ Instance fields ================================================================================================
51:
52: private String errorPage;
53:
54: //~ Methods ========================================================================================================
55:
56: public void handle(ServletRequest request,
57: ServletResponse response,
58: AccessDeniedException accessDeniedException)
59: throws IOException, ServletException {
60: if (errorPage != null) {
61: // Put exception into request scope (perhaps of use to a view)
62: ((HttpServletRequest) request).setAttribute(
63: ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY,
64: accessDeniedException);
65:
66: // Perform RequestDispatcher "forward"
67: RequestDispatcher rd = request
68: .getRequestDispatcher(errorPage);
69: rd.forward(request, response);
70: }
71:
72: if (!response.isCommitted()) {
73: // Send 403 (we do this after response has been written)
74: ((HttpServletResponse) response).sendError(
75: HttpServletResponse.SC_FORBIDDEN,
76: accessDeniedException.getMessage());
77: }
78: }
79:
80: /**
81: * The error page to use. Must begin with a "/" and is interpreted relative to the current context root.
82: *
83: * @param errorPage the dispatcher path to display
84: *
85: * @throws IllegalArgumentException if the argument doesn't comply with the above limitations
86: */
87: public void setErrorPage(String errorPage) {
88: if ((errorPage != null) && !errorPage.startsWith("/")) {
89: throw new IllegalArgumentException(
90: "ErrorPage must begin with '/'");
91: }
92:
93: this.errorPage = errorPage;
94: }
95: }
|