001: package org.apache.turbine.modules.actions.sessionvalidator;
002:
003: /*
004: * Copyright 2001-2005 The Apache Software Foundation.
005: *
006: * Licensed under the Apache License, Version 2.0 (the "License")
007: * you may not use this file except in compliance with the License.
008: * You may obtain a copy of the License at
009: *
010: * http://www.apache.org/licenses/LICENSE-2.0
011: *
012: * Unless required by applicable law or agreed to in writing, software
013: * distributed under the License is distributed on an "AS IS" BASIS,
014: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015: * See the License for the specific language governing permissions and
016: * limitations under the License.
017: */
018:
019: import org.apache.commons.configuration.Configuration;
020:
021: import org.apache.commons.lang.StringUtils;
022:
023: import org.apache.commons.logging.Log;
024: import org.apache.commons.logging.LogFactory;
025:
026: import org.apache.turbine.Turbine;
027: import org.apache.turbine.TurbineConstants;
028:
029: import org.apache.turbine.services.security.TurbineSecurity;
030:
031: import org.apache.turbine.util.RunData;
032: import org.apache.turbine.util.TurbineException;
033:
034: /**
035: * The SessionValidator attempts to retrieve the User object from the
036: * Servlet API session that is associated with the request. If the
037: * data cannot be retrieved, it is handled here. If the user has not
038: * been marked as being logged into the system, the user is rejected
039: * and the screen is set to the screen.homepage value in
040: * TurbineResources.properties.
041: *
042: * <p>
043: *
044: * Other systems generally have a database table which stores this
045: * information, but we take advantage of the Servlet API here to save
046: * a hit to the database for each and every connection that a user
047: * makes.
048: *
049: * <p>
050: *
051: * This action is special in that it should only be executed by the
052: * Turbine servlet.
053: *
054: * @author <a href="mailto:mbryson@mont.mindspring.com">Dave Bryson</a>
055: * @author <a href="mailto:hps@intermeta.de">Henning P. Schmiedehausen</a>
056: * @version $Id: DefaultSessionValidator.java 264148 2005-08-29 14:21:04Z henning $
057: */
058: public class DefaultSessionValidator extends SessionValidator {
059: /** Logging */
060: private static Log log = LogFactory
061: .getLog(DefaultSessionValidator.class);
062:
063: /**
064: * Execute the action. The default is to populate the RunData
065: * object and, if the user is unknown, to force a login screen (as
066: * set in the tr.props).
067: *
068: * @see org.apache.turbine.modules.screens.error.InvalidState
069: * @param data Turbine RunData context information.
070: * @throws TurbineException The anonymous user could not be obtained
071: * from the security service
072: */
073: public void doPerform(RunData data) throws TurbineException {
074: Configuration conf = Turbine.getConfiguration();
075:
076: // Pull user from session.
077: data.populate();
078:
079: // The user may have not logged in, so create a "guest/anonymous" user.
080: if (data.getUser() == null) {
081: log.debug("Fixing up empty User Object!");
082: data.setUser(TurbineSecurity.getAnonymousUser());
083: data.save();
084: }
085:
086: // Make sure the User has logged into the system.
087: if (!data.getUser().hasLoggedIn()) {
088: // only set the message if nothing else has already set it
089: // (e.g. the LogoutUser action).
090: if (StringUtils.isEmpty(data.getMessage())) {
091: data.setMessage(conf
092: .getString(TurbineConstants.LOGIN_MESSAGE));
093: }
094:
095: // set the screen to be the login page
096: data.setScreen(conf
097: .getString(TurbineConstants.SCREEN_LOGIN));
098:
099: // We're not doing any actions buddy! (except action.login which
100: // will have been performed already)
101: data.setAction(null);
102: }
103:
104: if (!data.hasScreen()) {
105: data
106: .setMessage(conf
107: .getString(TurbineConstants.LOGIN_MESSAGE_NOSCREEN));
108: data.setScreen(conf
109: .getString(TurbineConstants.SCREEN_HOMEPAGE));
110: }
111:
112: if (data.getParameters().containsKey("_session_access_counter")) {
113: // See comments in screens.error.InvalidState.
114: if (data.getParameters().getInt("_session_access_counter") < (((Integer) data
115: .getUser().getTemp("_session_access_counter"))
116: .intValue() - 1)) {
117: data.getUser().setTemp("prev_screen", data.getScreen());
118: data.getUser().setTemp("prev_parameters",
119: data.getParameters());
120: data
121: .setScreen(conf
122: .getString(TurbineConstants.SCREEN_INVALID_STATE));
123: data.setAction("");
124: }
125: }
126: }
127: }
|