7:51 p.m.
Author: ghjboss
Date: 2013-02-25 20:51:57 -0500 (Mon, 25 Feb 2013)
New Revision: 9181
Added:
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/java/org/gatein/management/gadget/mop/exportimport/server/IdentityFilter.java
Modified:
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/component/common/src/main/java/org/gatein/common/xml/stax/navigator/StaxNavUtils.java
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/pom.xml
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/webapp/WEB-INF/web.xml
Log:
commit the fix for BZ913125 and BZ913584
Modified:
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/component/common/src/main/java/org/gatein/common/xml/stax/navigator/StaxNavUtils.java
===================================================================
---
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/component/common/src/main/java/org/gatein/common/xml/stax/navigator/StaxNavUtils.java 2013-02-25
15:07:23 UTC (rev 9180)
+++
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/component/common/src/main/java/org/gatein/common/xml/stax/navigator/StaxNavUtils.java 2013-02-26
01:51:57 UTC (rev 9181)
@@ -31,6 +31,8 @@
import org.staxnav.ValueType;
import javax.xml.namespace.QName;
+import javax.xml.stream.XMLInputFactory;
+
import java.io.InputStream;
import java.io.Reader;
import java.util.Arrays;
@@ -190,7 +192,9 @@
private static StaxNavBuilder buildDefaultNavigator()
{
- return new StaxNavBuilderImpl();
+ return new StaxNavBuilderImpl()
+ // Do not support external entities in XML documents.
+ .withProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
}
private StaxNavUtils() {}
Modified:
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/pom.xml
===================================================================
---
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/pom.xml 2013-02-25
15:07:23 UTC (rev 9180)
+++
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/pom.xml 2013-02-26
01:51:57 UTC (rev 9181)
@@ -56,6 +56,11 @@
<artifactId>exo.kernel.container</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>org.exoplatform.core</groupId>
+ <artifactId>exo.core.component.security.core</artifactId>
+ <scope>provided</scope>
+ </dependency>
<!-- GWT Dependencies -->
<dependency>
<groupId>com.google.gwt</groupId>
Added:
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/java/org/gatein/management/gadget/mop/exportimport/server/IdentityFilter.java
===================================================================
---
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/java/org/gatein/management/gadget/mop/exportimport/server/IdentityFilter.java
(rev 0)
+++
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/java/org/gatein/management/gadget/mop/exportimport/server/IdentityFilter.java 2013-02-26
01:51:57 UTC (rev 9181)
@@ -0,0 +1,165 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2012, Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags. See the copyright.txt file in the
+ * distribution for a full listing of individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+
+package org.gatein.management.gadget.mop.exportimport.server;
+
+import org.exoplatform.container.ExoContainer;
+import org.exoplatform.container.web.AbstractFilter;
+import org.exoplatform.services.security.ConversationRegistry;
+import org.exoplatform.services.security.ConversationState;
+import org.exoplatform.services.security.Identity;
+import org.exoplatform.services.security.StateKey;
+import org.exoplatform.services.security.web.HttpSessionStateKey;
+import org.gatein.common.logging.Logger;
+import org.gatein.common.logging.LoggerFactory;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+import java.io.Writer;
+
+/**
+ * Identity filter which checks to see if an identity from the portal can be found before
processing request.
+ *
+ * @author <a href="mailto:nscavell@redhat.com">Nick Scavelli</a>
+ */
+public class IdentityFilter extends AbstractFilter implements Filter
+{
+
+ private static final Logger log = LoggerFactory.getLogger(IdentityFilter.class);
+
+ private String role;
+ private String group;
+ private String user;
+
+ @Override
+ protected void afterInit(FilterConfig config) throws ServletException
+ {
+ role = config.getInitParameter("role");
+ group = config.getInitParameter("group");
+ user = config.getInitParameter("user");
+ }
+
+ @Override
+ public void doFilter(ServletRequest request, ServletResponse response, FilterChain
chain) throws IOException, ServletException
+ {
+ HttpServletRequest httpRequest = (HttpServletRequest) request;
+ HttpServletResponse httpResponse = (HttpServletResponse) response;
+
+ HttpSession httpSession = httpRequest.getSession();
+ StateKey stateKey = new HttpSessionStateKey(httpSession);
+
+ ExoContainer container = getContainer();
+
+ ConversationRegistry conversationRegistry =
+ (ConversationRegistry)
container.getComponentInstanceOfType(ConversationRegistry.class);
+
+ ConversationState state = conversationRegistry.getState(stateKey);
+ if (state == null)
+ {
+ log.error("Conversation state not found. This typically means the GWT
Gadget application is either being access anonymously or from outside the portal.");
+ handleError(httpRequest, httpResponse, 401);
+ return;
+ }
+ Identity identity = state.getIdentity();
+ if (identity == null)
+ {
+ log.error("Identity not found from conversation state. This should not
happen. GWT Gadget will not process");
+ handleError(httpRequest, httpResponse, 401);
+ return;
+ }
+ ConversationState.setCurrent(state);
+
+ // Do not process if nothing was configured
+ if (role == null && group == null && user == null)
+ {
+ log.error("Neither role, group, or user was configured as part of
init-param of IdentityFilter for GWT Gadget application.");
+ handleError(httpRequest, httpResponse, 500);
+ return;
+ }
+
+ // Check roles
+ if (role != null)
+ {
+ for (String identityRole : identity.getRoles())
+ {
+ if (role.equals(identityRole))
+ {
+ chain.doFilter(request, response);
+ return;
+ }
+ }
+ }
+
+ // Check memberships
+ if (group != null)
+ {
+ if (identity.isMemberOf(group))
+ {
+ chain.doFilter(request, response);
+ return;
+ }
+ }
+
+ // Check user
+ if (user != null)
+ {
+ if (user.equals(identity.getUserId()))
+ {
+ chain.doFilter(request, response);
+ return;
+ }
+ }
+
+ log.error("GWT Gadget not authorized for user " + identity.getUserId() +
". Check the filter configuration for IdentityFilter in web.xml.");
+ handleError(httpRequest, httpResponse, 401);
+ }
+
+ @Override
+ public void destroy()
+ {
+ }
+
+ private void handleError(HttpServletRequest request, HttpServletResponse response, int
code) throws IOException
+ {
+ if (request.getServletPath().equals("/exportimport/upload"))
+ {
+ // Stupid GWT Upload can't properly handle a response.sendError...
+ response.setContentType("text/plain");
+ Writer writer = response.getWriter();
+ writer.write("<response><error>Resource not
available</error></response>");
+ writer.flush();
+ writer.close();
+ }
+ else
+ {
+ response.sendError(code);
+ }
+ }
+}
Modified:
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/webapp/WEB-INF/web.xml
===================================================================
---
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/webapp/WEB-INF/web.xml 2013-02-25
15:07:23 UTC (rev 9180)
+++
epp/portal/branches/embargo/EPP_5_2_2_GA_BZ913125_BZ913584/gadgets/gwtGadgets/src/main/webapp/WEB-INF/web.xml 2013-02-26
01:51:57 UTC (rev 9181)
@@ -45,6 +45,32 @@
<param-value>50</param-value>
</context-param>
+ <!-- Important to ensure secure access to the gadget -->
+ <filter>
+ <filter-name>IdentityFilter</filter-name>
+
<filter-class>org.gatein.management.gadget.mop.exportimport.server.IdentityFilter</filter-class>
+ <!-- Allows users with the specific role to access the gadget -->
+ <init-param>
+ <param-name>role</param-name>
+ <param-value>administrators</param-value>
+ </init-param>
+ <!-- Uncomment to allow members of the following group access to gadget. -->
+ <!--<init-param>
+ <param-name>group</param-name>
+ <param-value>/platform/administrators</param-value>
+ </init-param>-->
+ <!-- Uncomment to allow a specific user access to gadget. -->
+ <!--<init-param>
+ <param-name>user</param-name>
+ <param-value>root</param-value>
+ </init-param>-->
+ </filter>
+
+ <filter-mapping>
+ <filter-name>IdentityFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
<!-- GateIn service servlet -->
<servlet>
<servlet-name>gtnService</servlet-name>