Source Code Cross Referenced for TemplateSecureSessionValidator.java in  » Project-Management » turbine » org » apache » turbine » modules » actions » sessionvalidator » Java Source Code / Java DocumentationJava Source Code and Java Documentation

Java Source Code / Java Documentation
1. 6.0 JDK Core
2. 6.0 JDK Modules
3. 6.0 JDK Modules com.sun
4. 6.0 JDK Modules com.sun.java
5. 6.0 JDK Modules sun
6. 6.0 JDK Platform
7. Ajax
8. Apache Harmony Java SE
9. Aspect oriented
10. Authentication Authorization
11. Blogger System
12. Build
13. Byte Code
14. Cache
15. Chart
16. Chat
17. Code Analyzer
18. Collaboration
19. Content Management System
20. Database Client
21. Database DBMS
22. Database JDBC Connection Pool
23. Database ORM
24. Development
25. EJB Server geronimo
26. EJB Server GlassFish
27. EJB Server JBoss 4.2.1
28. EJB Server resin 3.1.5
29. ERP CRM Financial
30. ESB
31. Forum
32. GIS
33. Graphic Library
34. Groupware
35. HTML Parser
36. IDE
37. IDE Eclipse
38. IDE Netbeans
39. Installer
40. Internationalization Localization
41. Inversion of Control
42. Issue Tracking
43. J2EE
44. JBoss
45. JMS
46. JMX
47. Library
48. Mail Clients
49. Net
50. Parser
51. PDF
52. Portal
53. Profiler
54. Project Management
55. Report
56. RSS RDF
57. Rule Engine
58. Science
59. Scripting
60. Search Engine
61. Security
62. Sevlet Container
63. Source Control
64. Swing Library
65. Template Engine
66. Test Coverage
67. Testing
68. UML
69. Web Crawler
70. Web Framework
71. Web Mail
72. Web Server
73. Web Services
74. Web Services apache cxf 2.0.1
75. Web Services AXIS2
76. Wiki Engine
77. Workflow Engines
78. XML
79. XML UI
Java
Java Tutorial
Java Open Source
Jar File Download
Java Articles
Java Products
Java by API
Photoshop Tutorials
Maya Tutorials
Flash Tutorials
3ds-Max Tutorials
Illustrator Tutorials
GIMP Tutorials
C# / C Sharp
C# / CSharp Tutorial
C# / CSharp Open Source
ASP.Net
ASP.NET Tutorial
JavaScript DHTML
JavaScript Tutorial
JavaScript Reference
HTML / CSS
HTML CSS Reference
C / ANSI-C
C Tutorial
C++
C++ Tutorial
Ruby
PHP
Python
Python Tutorial
Python Open Source
SQL Server / T-SQL
SQL Server / T-SQL Tutorial
Oracle PL / SQL
Oracle PL/SQL Tutorial
PostgreSQL
SQL / MySQL
MySQL Tutorial
VB.Net
VB.Net Tutorial
Flash / Flex / ActionScript
VBA / Excel / Access / Word
XML
XML Tutorial
Microsoft Office PowerPoint 2007 Tutorial
Microsoft Office Excel 2007 Tutorial
Microsoft Office Word 2007 Tutorial
Java Source Code / Java Documentation » Project Management » turbine » org.apache.turbine.modules.actions.sessionvalidator 
Source Cross Referenced  Class Diagram Java Document (Java Doc) 


001:        package org.apache.turbine.modules.actions.sessionvalidator;
002:
003:        /*
004:         * Copyright 2001-2005 The Apache Software Foundation.
005:         *
006:         * Licensed under the Apache License, Version 2.0 (the "License")
007:         * you may not use this file except in compliance with the License.
008:         * You may obtain a copy of the License at
009:         *
010:         *     http://www.apache.org/licenses/LICENSE-2.0
011:         *
012:         * Unless required by applicable law or agreed to in writing, software
013:         * distributed under the License is distributed on an "AS IS" BASIS,
014:         * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015:         * See the License for the specific language governing permissions and
016:         * limitations under the License.
017:         */
018:
019:        import org.apache.commons.configuration.Configuration;
020:
021:        import org.apache.commons.lang.StringUtils;
022:
023:        import org.apache.commons.logging.Log;
024:        import org.apache.commons.logging.LogFactory;
025:
026:        import org.apache.turbine.Turbine;
027:        import org.apache.turbine.TurbineConstants;
028:
029:        import org.apache.turbine.services.security.TurbineSecurity;
030:
031:        import org.apache.turbine.util.RunData;
032:        import org.apache.turbine.util.TurbineException;
033:
034:        /**
035:         * SessionValidator that requires login for use with Template Services
036:         * like Velocity or WebMacro.
037:         *
038:         * <br>
039:         *
040:         * Templating services requires a different Session Validator
041:         * because of the way it handles screens.  If you use the WebMacro or
042:         * Velocity Service with the DefaultSessionValidator, users will be able to
043:         * bypass login by directly addressing the template using
044:         * template/index.wm.  This is because the Page class looks for the
045:         * keyword "template" in the Path information and if it finds it will
046:         * reset the screen using it's lookup mechanism and thereby bypass
047:         * Login.
048:         *
049:         * Note that you will need to set the template.login property to the
050:         * login template.
051:         *
052:         * @author <a href="mailto:john.mcnally@clearink.com">John D. McNally</a>
053:         * @author <a href="mailto:mbryson@mont.mindspring.com">Dave Bryson</a>
054:         * @author <a href="mailto:hps@intermeta.de">Henning P. Schmiedehausen</a>
055:         * @version $Id: TemplateSecureSessionValidator.java 264148 2005-08-29 14:21:04Z henning $
056:         */
057:        public class TemplateSecureSessionValidator extends SessionValidator {
058:            /** Logging */
059:            private static Log log = LogFactory
060:                    .getLog(TemplateSecureSessionValidator.class);
061:
062:            /**
063:             * doPerform is virtually identical to DefaultSessionValidator
064:             * except that it calls template methods instead of bare screen
065:             * methods. For example, it uses <code>setScreenTemplate</code> to
066:             * load the tr.props TEMPLATE_LOGIN instead of the default's
067:             * setScreen to TurbineConstants.SCREEN_LOGIN.
068:             *
069:             * @see DefaultSessionValidator
070:             * @param data Turbine information.
071:             * @throws TurbineException The anonymous user could not be obtained
072:             *         from the security service
073:             */
074:            public void doPerform(RunData data) throws TurbineException {
075:                Configuration conf = Turbine.getConfiguration();
076:
077:                // Pull user from session.
078:                data.populate();
079:
080:                // The user may have not logged in, so create a "guest/anonymous" user.
081:                if (data.getUser() == null) {
082:                    log.debug("Fixing up empty User Object!");
083:                    data.setUser(TurbineSecurity.getAnonymousUser());
084:                    data.save();
085:                }
086:
087:                // This is the secure sessionvalidator, so user must be logged in.
088:                if (!data.getUser().hasLoggedIn()) {
089:                    log.debug("User is not logged in!");
090:
091:                    // only set the message if nothing else has already set it
092:                    // (e.g. the LogoutUser action).
093:                    if (StringUtils.isEmpty(data.getMessage())) {
094:                        data.setMessage(conf
095:                                .getString(TurbineConstants.LOGIN_MESSAGE));
096:                    }
097:
098:                    // Set the screen template to the login page.
099:                    String loginTemplate = conf
100:                            .getString(TurbineConstants.TEMPLATE_LOGIN);
101:
102:                    log.debug("Sending User to the Login Screen ("
103:                            + loginTemplate + ")");
104:                    data.getTemplateInfo().setScreenTemplate(loginTemplate);
105:
106:                    // We're not doing any actions buddy! (except action.login which
107:                    // will have been performed already)
108:                    data.setAction(null);
109:                }
110:
111:                log.debug("Login Check finished!");
112:
113:                // Make sure we have some way to return a response.
114:                if (!data.hasScreen()
115:                        && StringUtils.isEmpty(data.getTemplateInfo()
116:                                .getScreenTemplate())) {
117:                    String template = conf
118:                            .getString(TurbineConstants.TEMPLATE_HOMEPAGE);
119:
120:                    if (StringUtils.isNotEmpty(template)) {
121:                        data.getTemplateInfo().setScreenTemplate(template);
122:                    } else {
123:                        data.setScreen(conf
124:                                .getString(TurbineConstants.SCREEN_HOMEPAGE));
125:                    }
126:                }
127:
128:                // The session_access_counter can be placed as a hidden field in
129:                // forms.  This can be used to prevent a user from using the
130:                // browsers back button and submitting stale data.
131:                // FIXME!! a template needs to be written to use this with templates.
132:
133:                if (data.getParameters().containsKey("_session_access_counter")
134:                        && !TurbineSecurity.isAnonymousUser(data.getUser())) {
135:                    // See comments in screens.error.InvalidState.
136:                    if (data.getParameters().getInt("_session_access_counter") < (((Integer) data
137:                            .getUser().getTemp("_session_access_counter"))
138:                            .intValue() - 1)) {
139:                        if (data.getTemplateInfo().getScreenTemplate() != null) {
140:                            data.getUser().setTemp(
141:                                    "prev_template",
142:                                    data.getTemplateInfo().getScreenTemplate()
143:                                            .replace('/', ','));
144:                            data
145:                                    .getTemplateInfo()
146:                                    .setScreenTemplate(
147:                                            conf
148:                                                    .getString(TurbineConstants.TEMPLATE_INVALID_STATE));
149:                        } else {
150:                            data.getUser().setTemp("prev_screen",
151:                                    data.getScreen().replace('/', ','));
152:                            data
153:                                    .setScreen(conf
154:                                            .getString(TurbineConstants.SCREEN_INVALID_STATE));
155:                        }
156:                        data.getUser().setTemp("prev_parameters",
157:                                data.getParameters());
158:                        data.setAction("");
159:                    }
160:                }
161:
162:                // We do not want to allow both a screen and template parameter.
163:                // The template parameter is dominant.
164:                if (data.getTemplateInfo().getScreenTemplate() != null) {
165:                    data.setScreen(null);
166:                }
167:            }
168:        }
www.java2java.com | Contact Us
Copyright 2009 - 12 Demo Source and Support. All rights reserved.
All other trademarks are property of their respective owners.