##### Coverage Report - org.melati.login.HttpSessionAccessHandler

Classes in this File | Line Coverage | Branch Coverage | Complexity
HttpSessionAccessHandler |
98% | 51/52
90% | 18/20
| 2.625;2.625

1 |  |
     /*
2 |  |
      * $Source: /usr/cvsroot/melati/melati/src/site/resources/withWebmacro/org.melati.login.HttpSessionAccessHandler.html,v $
3 |  |
      * $Revision: 1.1 $
4 |  |
      *
5 |  |
      * Copyright (C) 2000 William Chesters
6 |  |
      *
7 |  |
      * Part of Melati (http://melati.org), a framework for the rapid
8 |  |
      * development of clean, maintainable web applications.
9 |  |
      *
10 |  |
      * Melati is free software; Permission is granted to copy, distribute
11 |  |
      * and/or modify this software under the terms either:
12 |  |
      *
13 |  |
      * a) the GNU General Public License as published by the Free Software
14 |  |
      *    Foundation; either version 2 of the License, or (at your option)
15 |  |
      *    any later version,
16 |  |
      *
17 |  |
      *    or
18 |  |
      *
19 |  |
      * b) any version of the Melati Software License, as published
20 |  |
      *    at http://melati.org
21 |  |
      *
22 |  |
      * You should have received a copy of the GNU General Public License and
23 |  |
      * the Melati Software License along with this program;
24 |  |
      * if not, write to the Free Software Foundation, Inc.,
25 |  |
      * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA to obtain the
26 |  |
      * GNU General Public License and visit http://melati.org to obtain the
27 |  |
      * Melati Software License.
28 |  |
      *
29 |  |
      * Feel free to contact the Developers of Melati (http://melati.org),
30 |  |
      * if you would like to work out a different arrangement than the options
31 |  |
      * outlined here.  It is our intention to allow Melati to be used by as
32 |  |
      * wide an audience as possible.
33 |  |
      *
34 |  |
      * This program is distributed in the hope that it will be useful,
35 |  |
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
36 |  |
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
37 |  |
      * GNU General Public License for more details.
38 |  |
      *
39 |  |
      * Contact details for copyright holder:
40 |  |
      *
41 |  |
      *     William Chesters <williamc At paneris.org>
42 |  |
      *     http://paneris.org/~williamc
43 |  |
      *     Obrechtstraat 114, 2517VX Den Haag, The Netherlands
44 |  |
      */
45 |  |
46 |  |
     package org.melati.login;
47 |  |
48 |  |
49 |  |
     import javax.servlet.http.Cookie;
50 |  |
     import javax.servlet.http.HttpServletRequest;
51 |  |
     import javax.servlet.http.HttpServletResponse;
52 |  |
     import javax.servlet.http.HttpSession;
53 |  |
54 |  |
     import org.melati.Melati;
55 |  |
     import org.melati.poem.AccessPoemException;
56 |  |
     import org.melati.poem.PoemThread;
57 |  |
     import org.melati.poem.User;
58 |  |
     import org.melati.util.HttpServletRequestParameters;
59 |  |
     import org.melati.util.HttpUtil;
60 |  |
     import org.melati.util.MD5Util;
61 |  |
     import org.melati.util.ReconstructedHttpServletRequest;
62 |  |
     import org.melati.util.ReconstructedHttpServletRequestMismatchException;
63 |  |
     import org.melati.util.UTF8URLEncoder;
64 |  |
65 |  |
     /**
66 |  |
      * An {@link AccessHandler} which uses <code>Session</code> cookies to
67 |  |
      * elicit and maintain the user's login and password.
68 |  |
      */
69 | 10 |
     public class HttpSessionAccessHandler implements AccessHandler {
70 |  |
71 |  |
       /** Class name. */
72 |  |
       public static final String
73 |  |
          OVERLAY_PARAMETERS =
74 |  |
            "org.melati.login.HttpSessionAccessHandler.overlayParameters";
75 |  |
       /** Class name. */
76 |  |
       public static final String
77 |  |
          USER =
78 |  |
            "org.melati.login.HttpSessionAccessHandler.user";
79 |  |
80 |  |
       /**
81 |  |
        * The class name of the class implementing the login servlet.  Unless
82 |  |
        * overridden, this is <TT>org.melati.login.Login</TT>.
83 |  |
        *
84 |  |
        * @return the class name of login servlet
85 |  |
        * @see org.melati.login.Login
86 |  |
        */
87 |  |
       protected String loginPageServletClassName() {
88 | 14 |
         return "org.melati.login.Login";
89 |  |
       }
90 |  |
91 |  |
       /**
92 |  |
        * The URL of the login servlet.  Unless overridden, this is computed by
93 |  |
        * substituting {@link #loginPageServletClassName()} into the URL of the
94 |  |
        * request being serviced.
95 |  |
        *
96 |  |
        * @param melati   the current Melati
97 |  |
        * @param request  the request currently being serviced
98 |  |
        *
99 |  |
        * @return the login page url
100 |  |
        * @see #loginPageServletClassName
101 |  |
        */
102 |  |
       public String loginPageURL(Melati melati, HttpServletRequest request) {
103 | 14 |
         StringBuffer url = new StringBuffer();
104 | 14 |
         HttpUtil.appendRelativeZoneURL(url, request);
105 | 14 |
         url.append('/');
106 | 14 |
         url.append(loginPageServletClassName());
107 | 14 |
         url.append('/');
108 | 14 |
         url.append(melati.getPoemContext().getLogicalDatabase());
109 | 14 |
         url.append('/');
110 |  |
111 | 14 |
         return url.toString();
112 |  |
       }
113 |  |
114 |  |
115 |  |
       /**
116 |  |
        * Store the current request and redirect to the login page.
117 |  |
        *
118 |  |
        * {@inheritDoc}
119 |  |
        * @see org.melati.login.AccessHandler#handleAccessException
120 |  |
        */
121 |  |
       public void handleAccessException(Melati melati,
122 |  |
                                         AccessPoemException accessException)
123 |  |
           throws Exception {
124 | 14 |
         HttpServletRequest request = melati.getRequest();
125 | 14 |
         HttpServletResponse response = melati.getResponse();
126 | 14 |
         HttpSession session = request.getSession(true);
127 | 14 |
         session.setAttribute(Login.TRIGGERING_REQUEST_PARAMETERS,
128 |  |
                          new HttpServletRequestParameters(request));
129 | 14 |
         session.setAttribute(Login.TRIGGERING_EXCEPTION, accessException);
130 | 14 |
         melati.getWriter().reset();
131 | 14 |
         response.sendRedirect(loginPageURL(melati, request));
132 | 14 |
       }
133 |  |
134 |  |
       /**
135 |  |
        * Set the Access token to be used for this request.
136 |  |
        *
137 |  |
        * The Access Token is either picked up from the session, or from a cookie.
138 |  |
        * The cookie is keyed on the logical database and is used to
139 |  |
        * retrieve the user's login.
140 |  |
        * The login is used (with the logical database name) to retrieve an encoded
141 |  |
        * password which is then checked.
142 |  |
        *
143 |  |
        * {@inheritDoc}
144 |  |
        * @see org.melati.login.AccessHandler#establishUser(org.melati.Melati)
145 |  |
        */
146 |  |
       public Melati establishUser(Melati melati) {
147 |  |
         // now when we establish a user, we must also set the cookie
148 | 1069 |
         String ldb = melati.getPoemContext().getLogicalDatabase();
149 | 1069 |
         HttpSession session = melati.getSession();
150 | 1069 |
         synchronized (session) {
151 | 1069 |
           User user = (User)session.getAttribute(USER);
152 | 1069 |
           if (user == null) {
153 | 611 |
             user = getUserFromCookie(melati,ldb);
154 | 611 |
             if (user != null) {
155 | 10 |
               String cookie = getCookieValue(melati,ldb+user.getLogin());
156 | 10 |
               if (cookie == null ||
157 |  |
                   !cookie.equals(MD5Util.encode(user.getPassword())))
158 | 0 |
                 user = null;
159 |  |
             }
160 |  |
           }
161 | 1069 |
           logUsIn(melati,user);
162 | 1069 |
         }
163 | 1069 |
         return melati;
164 |  |
       }
165 |  |
166 |  |
       /**
167 |  |
        * Set our AccessToken.
168 |  |
        * NOTE Remember a User isa Token.
169 |  |
        *
170 |  |
        * @param melati the Melati to get our database from
171 |  |
        * @param user the token to set
172 |  |
        */
173 |  |
       protected void logUsIn(Melati melati, User user) {
174 | 1069 |
         PoemThread.setAccessToken(
175 |  |
             user == null ? melati.getDatabase().guestAccessToken() : user);
176 | 1069 |
       }
177 |  |
178 |  |
179 |  |
       /**
180 |  |
        * Extract User via the cookie.
181 |  |
        * @param melati our Melati
182 |  |
        * @param key cookie key
183 |  |
        * @return the found User or null
184 |  |
        */
185 |  |
       User getUserFromCookie(Melati melati,String key) {
186 | 611 |
         String login = getCookieValue(melati,key);
187 | 611 |
         if (login == null) return null;
188 | 10 |
         return (User)melati.getDatabase().getUserTable().getLoginColumn().
189 |  |
                   firstWhereEq(login);
190 |  |
       }
191 |  |
192 |  |
       /**
193 |  |
        * Extract a value from the cookies.
194 |  |
        *
195 |  |
        * @param melati the Melati in which the Request and its cookies are stored
196 |  |
        * @param key the key we need the value of
197 |  |
        * @return the cookie value or null
198 |  |
        */
199 |  |
       String getCookieValue(Melati melati,String key) {
200 |  |
         // try and get from cookie
201 |  |
         // Use default encoding, regardless of user's encoding
202 | 621 |
         key = UTF8URLEncoder.encode(key);
203 | 621 |
         Cookie[] cookies = melati.getRequest().getCookies();
204 | 621 |
         if(cookies == null) return null;
205 | 944 |
         for (int i=0; i<cookies.length; i++) {
206 | 497 |
           Cookie c = cookies[i];
207 | 497 |
             if (c.getName().equals(key))
208 | 20 |
               return UTF8URLEncoder.decode(c.getValue());
209 |  |
         }
210 | 447 |
         return null;
211 |  |
       }
212 |  |
213 |  |
       /**
214 |  |
        * If we are returning from a login rebuild the original request,
215 |  |
        * otherwise do nothing.
216 |  |
        *
217 |  |
        * {@inheritDoc}
218 |  |
        * @see org.melati.login.AccessHandler#buildRequest(org.melati.Melati)
219 |  |
        */
220 |  |
       public void buildRequest(Melati melati)
221 |  |
           throws ReconstructedHttpServletRequestMismatchException {
222 | 1069 |
         HttpSession session = melati.getSession();
223 |  |
224 |  |
         // First off, is the user continuing after a login?  If so, we want to
225 |  |
         // recover any POSTed fields from the request that triggered it.
226 |  |
227 | 1069 |
         synchronized (session) {
228 | 1069 |
           HttpServletRequestParameters oldParams =
229 |  |
               (HttpServletRequestParameters)session.getAttribute(OVERLAY_PARAMETERS);
230 |  |
231 | 1069 |
           if (oldParams != null) {
232 | 4 |
             session.removeAttribute(OVERLAY_PARAMETERS);
233 |  |
234 |  |
             // we don't want to create a new object here, rather we are simply
235 |  |
             // going to set up the old request parameters
236 |  |
237 | 4 |
             melati.setRequest(
238 |  |
                 new ReconstructedHttpServletRequest(oldParams,
239 |  |
                                                     melati.getRequest()));
240 |  |
           }
241 | 1069 |
         }
242 | 1069 |
       }
243 |  |
     }