View Javadoc

    1   package org.apache.turbine.modules.actions.sessionvalidator;
    2
    3   /*
    4    * Licensed to the Apache Software Foundation (ASF) under one
    5    * or more contributor license agreements.  See the NOTICE file
    6    * distributed with this work for additional information
    7    * regarding copyright ownership.  The ASF licenses this file
    8    * to you under the Apache License, Version 2.0 (the
    9    * "License"); you may not use this file except in compliance
    10   * with the License.  You may obtain a copy of the License at
    11   *
    12   *   http://www.apache.org/licenses/LICENSE-2.0
    13   *
    14   * Unless required by applicable law or agreed to in writing,
    15   * software distributed under the License is distributed on an
    16   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    17   * KIND, either express or implied.  See the License for the
    18   * specific language governing permissions and limitations
    19   * under the License.
    20   */
    21
    22  import org.apache.commons.configuration.Configuration;
    23  import org.apache.commons.lang.StringUtils;
    24  import org.apache.commons.logging.Log;
    25  import org.apache.commons.logging.LogFactory;
    26  import org.apache.turbine.Turbine;
    27  import org.apache.turbine.TurbineConstants;
    28  import org.apache.turbine.annotation.TurbineConfiguration;
    29  import org.apache.turbine.annotation.TurbineService;
    30  import org.apache.turbine.om.security.User;
    31  import org.apache.turbine.pipeline.PipelineData;
    32  import org.apache.turbine.services.security.SecurityService;
    33  import org.apache.turbine.util.RunData;
    34
    35  /**
    36   * SessionValidator that requires login for use with Template Services
    37   * like Velocity or WebMacro.
    38   *
    39   * <br>
    40   *
    41   * Templating services requires a different Session Validator
    42   * because of the way it handles screens.  If you use the WebMacro or
    43   * Velocity Service with the DefaultSessionValidator, users will be able to
    44   * bypass login by directly addressing the template using
    45   * template/index.wm.  This is because the Page class looks for the
    46   * keyword "template" in the Path information and if it finds it will
    47   * reset the screen using it's lookup mechanism and thereby bypass
    48   * Login.
    49   *
    50   * Note that you will need to set the template.login property to the
    51   * login template.
    52   *
    53   * @author <a href="mailto:john.mcnally@clearink.com">John D. McNally</a>
    54   * @author <a href="mailto:mbryson@mont.mindspring.com">Dave Bryson</a>
    55   * @author <a href="mailto:hps@intermeta.de">Henning P. Schmiedehausen</a>
    56   * @author <a href="mailto:peter@courcoux.biz">Peter Courcoux</a>
    57   * @version $Id: TemplateSecureSessionValidator.java 1695634 2015-08-13 00:35:47Z tv $
    58   */
    59  public class TemplateSecureSessionValidator
    60      extends SessionValidator
    61  {
    62      /** Logging */
    63      private static Log log = LogFactory.getLog(
    64              TemplateSecureSessionValidator.class);
    65
    66      @TurbineService
    67      private SecurityService security;
    68
    69      @TurbineConfiguration
    70      private Configuration conf;
    71
    72      /**
    73       * doPerform is virtually identical to DefaultSessionValidator
    74       * except that it calls template methods instead of bare screen
    75       * methods. For example, it uses <code>setScreenTemplate</code> to
    76       * load the tr.props TEMPLATE_LOGIN instead of the default's
    77       * setScreen to TurbineConstants.SCREEN_LOGIN.
    78       *
    79       * @see DefaultSessionValidator
    80       * @param pipelineData Turbine information.
    81       * @throws Exception The anonymous user could not be obtained
    82       *         from the security service
    83       */
    84      @Override
    85      public void doPerform(PipelineData pipelineData)
    86      throws Exception
    87      {
    88          RunData data = getRunData(pipelineData);
    89          // Pull user from session.
    90          data.populate();
    91
    92          // The user may have not logged in, so create a "guest/anonymous" user.
    93          if (data.getUser() == null)
    94          {
    95              log.debug("Fixing up empty User Object!");
    96              User anonymousUser = security.getAnonymousUser();
    97              data.setUser(anonymousUser);
    98              data.save();
    99          }
    100
    101         // This is the secure session validator, so user must be logged in.
    102         if (!data.getUser().hasLoggedIn())
    103         {
    104             log.debug("User is not logged in!");
    105
    106             // only set the message if nothing else has already set it
    107             // (e.g. the LogoutUser action).
    108             if (StringUtils.isEmpty(data.getMessage()))
    109             {
    110                 data.setMessage(conf.getString(TurbineConstants.LOGIN_MESSAGE));
    111             }
    112
    113             // Set the screen template to the login page.
    114             String loginTemplate =
    115                 conf.getString(TurbineConstants.TEMPLATE_LOGIN);
    116
    117             log.debug("Sending User to the Login Screen ("
    118                     + loginTemplate + ")");
    119             data.getTemplateInfo().setScreenTemplate(loginTemplate);
    120
    121             // We're not doing any actions buddy! (except action.login which
    122             // will have been performed already)
    123             data.setAction(null);
    124         }
    125
    126         log.debug("Login Check finished!");
    127
    128         // Make sure we have some way to return a response.
    129         if (!data.hasScreen() && StringUtils.isEmpty(
    130                 data.getTemplateInfo().getScreenTemplate()))
    131         {
    132             String template = conf.getString(
    133                     TurbineConstants.TEMPLATE_HOMEPAGE);
    134
    135             if (StringUtils.isNotEmpty(template))
    136             {
    137                 data.getTemplateInfo().setScreenTemplate(template);
    138             }
    139             else
    140             {
    141                 data.setScreen(conf.getString(
    142                         TurbineConstants.SCREEN_HOMEPAGE));
    143             }
    144         }
    145
    146         // The session_access_counter can be placed as a hidden field in
    147         // forms.  This can be used to prevent a user from using the
    148         // browsers back button and submitting stale data.
    149         // FIXME!! a template needs to be written to use this with templates.
    150
    151         if (data.getParameters().containsKey("_session_access_counter")
    152                 && !security.isAnonymousUser(data.getUser()))
    153         {
    154             // See comments in screens.error.InvalidState.
    155             if (data.getParameters().getInt("_session_access_counter")
    156                     < (((Integer) data.getUser().getTemp(
    157                     "_session_access_counter")).intValue() - 1))
    158             {
    159                 if (data.getTemplateInfo().getScreenTemplate() != null)
    160                 {
    161                     data.getUser().setTemp("prev_template",
    162                             data.getTemplateInfo().getScreenTemplate()
    163                             .replace('/', ','));
    164                     data.getTemplateInfo().setScreenTemplate(conf.getString(
    165                             TurbineConstants.TEMPLATE_INVALID_STATE));
    166                 }
    167                 else
    168                 {
    169                     data.getUser().setTemp("prev_screen",
    170                                            data.getScreen().replace('/', ','));
    171                     data.setScreen(conf.getString(
    172                             TurbineConstants.SCREEN_INVALID_STATE));
    173                 }
    174                 data.getUser().setTemp("prev_parameters", data.getParameters());
    175                 data.setAction("");
    176             }
    177         }
    178
    179         // We do not want to allow both a screen and template parameter.
    180         // The template parameter is dominant.
    181         if (data.getTemplateInfo().getScreenTemplate() != null)
    182         {
    183             data.setScreen(null);
    184         }
    185
    186         // Comply with Turbine 4.0 standards
    187         pipelineData.get(Turbine.class).put(User.class, data.getUser());
    188     }
    189 }