From portal-commits at lists.jboss.org Fri Apr 17 17:46:07 2009 Content-Type: multipart/mixed; boundary="===============4061167337570141315==" MIME-Version: 1.0 From: portal-commits at lists.jboss.org To: portal-commits at lists.jboss.org Subject: [portal-commits] JBoss Portal SVN: r13227 - in modules/identity/trunk/sso/src: test/java/org/jboss/portal/test/identity/sso and 1 other directory. Date: Fri, 17 Apr 2009 17:46:07 -0400 Message-ID: --===============4061167337570141315== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Author: sohil.shah(a)jboss.com Date: 2009-04-17 17:46:06 -0400 (Fri, 17 Apr 2009) New Revision: 13227 Modified: modules/identity/trunk/sso/src/main/java/org/jboss/portal/identity/sso/j= osso/JOSSOLogoutValve.java modules/identity/trunk/sso/src/test/java/org/jboss/portal/test/identity/= sso/JOSSOTestCase.java Log: JBEPP-33 - no validation for cookie value with SSO Modified: modules/identity/trunk/sso/src/main/java/org/jboss/portal/identit= y/sso/josso/JOSSOLogoutValve.java =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- modules/identity/trunk/sso/src/main/java/org/jboss/portal/identity/sso/= josso/JOSSOLogoutValve.java 2009-04-17 06:02:23 UTC (rev 13226) +++ modules/identity/trunk/sso/src/main/java/org/jboss/portal/identity/sso/= josso/JOSSOLogoutValve.java 2009-04-17 21:46:06 UTC (rev 13227) @@ -26,7 +26,6 @@ = import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.Cookie; = import org.apache.catalina.connector.Request; import org.apache.catalina.connector.Response; @@ -47,77 +46,15 @@ { HttpServletRequest httpRequest =3D (HttpServletRequest) request; request.setAttribute("ssoEnabled", "true"); - = - Cookie jossoPortalCookie =3D this.findJOSSOPortalLogoutCookie(httpRe= quest); - if(jossoPortalCookie !=3D null) - { - String referer =3D jossoPortalCookie.getValue(); - = - if(referer !=3D null && referer.trim().length() > 0) - { - //Delete this cookie - jossoPortalCookie =3D new Cookie("JOSSO_PORTAL_LOGOUT", ""); - jossoPortalCookie.setMaxAge(0); //setting the value to 0 shoul= d delete this cookie from the browser - response.addCookie(jossoPortalCookie); - = - //This form of redirect is needed instead of sendRedirect - //otherwise the JBOSS_PORTAL_LOGOUT cookie cleanup does not ha= ppen - StringBuffer buffer =3D new StringBuffer(); - buffer.append(""+"\n"); - buffer.append(""+"\n"); - buffer.append(""+"\n"); - buffer.append(""+"\n"); - buffer.append(""+"\n"); - buffer.append(""+"\n"); - buffer.append(""+"\n"); - = - response.getOutputStream().write(buffer.toString().getBytes()); - response.getOutputStream().flush(); - = - return; - } - } - = - // continue processing the request + = + //Logout not activated, Continue processing the request through the = system this.getNext().invoke(request, response); = + //Check if Logout was activated...If so, perform a JOSSO logout if(request.getAttribute("org.jboss.portal.logout") !=3D null) { = - String jossoLogout =3D httpRequest.getContextPath() + "/josso_logou= t/"; - = - Cookie cookie =3D new Cookie("JOSSO_PORTAL_LOGOUT",httpRequest.ge= tHeader("Referer")); - cookie.setMaxAge(-1); //setting the value so that cookie expires = when broser is closed - response.addCookie(cookie); - = + String jossoLogout =3D httpRequest.getContextPath() + "/josso_logout= /"; = response.sendRedirect(jossoLogout); } = - } = - = - /** - * = - * @param request - * @return - */ - private Cookie findJOSSOPortalLogoutCookie(HttpServletRequest request) - { - Cookie cookie =3D null; - = - Cookie[] cookies =3D request.getCookies(); - if(cookies !=3D null) - { - for(int i=3D0; iSohil Shah - * - */ + = private static class WebConversation { /** * */ - private HttpClient client =3D null; - private String sessionId =3D null; + private HttpClient client =3D null; = private int statusCode =3D 0; private String response =3D null; private String redirectLocation =3D null; private Cookie ssoCookie =3D null; + private Cookie sessionCookie =3D null; = /** * @@ -679,16 +595,6 @@ this.statusCode =3D statusCode; } = - public String getSessionId() - { - return sessionId; - } - - public void setSessionId(String sessionId) - { - this.sessionId =3D sessionId; - } - public String getRedirectLocation() { return redirectLocation; @@ -708,5 +614,20 @@ { this.ssoCookie =3D ssoCookie; } + = + public String getSessionId() + { + return this.sessionCookie.getValue(); + } + + public void setSessionCookie(Cookie sessionCookie) + { + this.sessionCookie =3D sessionCookie; + } + = + public Cookie getSessionCookie() + { + return this.sessionCookie; + } } } --===============4061167337570141315==--