svn commit: r751501 - in /ofbiz/trunk: applications/order/src/org/ofb
Locked
 
|
Author: jonesde
Date: Sun Mar 8 19:14:14 2009 New Revision: 751501 URL: http://svn.apache.org/viewvc?rev=751501&view=rev Log: Changed EventHandler interface so that the run method takes the new Event and RequestMap objects so it knows more about them; the service event handler and the service multi event handler now look at the request-map to see if the security -> https attribute is true and if it is then it will only allow encrypted body parameters to be passed to the service, or in other words it won't allow URL parameters that are not encrypted to be passed in; also changed the RequestHandler so that it will not accept http POST requests to request-map with security -> https=true; both of these changes better protect service calls from a webapp and protect better against XSRF and similar attacks since spoofing https is more difficult Modified: ofbiz/trunk/applications/order/src/org/ofbiz/order/task/TaskEvents.java ofbiz/trunk/framework/webapp/config/WebappUiLabels.xml ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/ConfigXMLReader.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/RequestHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/AbstractJSONEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/BsfEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/CoreEvents.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/DojoJSONServiceEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventFactory.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/GroovyEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONJavaEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONServiceEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JavaEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/RomeEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SOAPEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceMultiEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceStreamHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SimpleEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/WfsEventHandler.java ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/XmlRpcEventHandler.java Modified: ofbiz/trunk/applications/order/src/org/ofbiz/order/task/TaskEvents.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/order/src/org/ofbiz/order/task/TaskEvents.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/applications/order/src/org/ofbiz/order/task/TaskEvents.java (original) +++ ofbiz/trunk/applications/order/src/org/ofbiz/order/task/TaskEvents.java Sun Mar 8 19:14:14 2009 @@ -32,6 +32,7 @@ import org.ofbiz.base.util.UtilMisc; import org.ofbiz.base.util.UtilProperties; import org.ofbiz.webapp.control.RequestHandler; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; import org.ofbiz.webapp.event.EventHandler; import org.ofbiz.webapp.event.EventHandlerException; import org.ofbiz.entity.GenericValue; @@ -93,7 +94,7 @@ if (addToOrderRole(request)) { try { EventHandler eh = rh.getEventFactory().getEventHandler("service"); - eh.invoke("", "wfAcceptRoleAssignment", request, response); + eh.invoke(new Event("service", "", "wfAcceptRoleAssignment", true), null, request, response); } catch (EventHandlerException e) { Debug.logError(e, "Invocation error", module); request.setAttribute("_ERROR_MESSAGE_", UtilProperties.getMessage(resource_error,"OrderFailedToInvokeTheWfAcceptRoleAssignmentService", locale)); @@ -113,7 +114,7 @@ if (addToOrderRole(request)) { try { EventHandler eh = rh.getEventFactory().getEventHandler("service"); - eh.invoke("", "wfDelegateAndAcceptAssignmet", request, response); + eh.invoke(new Event("service", "", "wfAcceptRoleAssignment", true), null, request, response); } catch (EventHandlerException e) { Debug.logError(e, "Invocation error", module); request.setAttribute("_ERROR_MESSAGE_", UtilProperties.getMessage(resource_error,"OrderFailedToInvokeTheWfDelegateAndAcceptAssignmentService", locale)); Modified: ofbiz/trunk/framework/webapp/config/WebappUiLabels.xml URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/config/WebappUiLabels.xml?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/config/WebappUiLabels.xml (original) +++ ofbiz/trunk/framework/webapp/config/WebappUiLabels.xml Sun Mar 8 19:14:14 2009 @@ -275,6 +275,10 @@ <value xml:lang="th">à¹à¸à¸´à¸à¸à¸§à¸²à¸¡à¸à¸´à¸à¸à¸¥à¸²à¸à¹à¸à¸à¸²à¸£à¹à¸£à¸µà¸¢à¸à¹à¸«à¸à¸¸à¸à¸²à¸£à¸à¹</value> <value xml:lang="zh">è°ç¨äºä»¶æ¶åºé</value> </property> + <property key="requestHandler.InsecureFormPostToSecureRequest"> + <value xml:lang="en">Not accepting insecure form data posted to a secure request</value> + <value xml:lang="es">No permite enviarle un forma inseguro a un pedido seguro</value> + </property> <property key="simpleEventHandler.event_not_completed"> <value xml:lang="de">Event konnte nicht abgeschlossen werden</value> <value xml:lang="en">Could not complete event</value> Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/ConfigXMLReader.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/ConfigXMLReader.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/ConfigXMLReader.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/ConfigXMLReader.java Sun Mar 8 19:14:14 2009 @@ -418,6 +418,13 @@ this.invoke = eventElement.getAttribute("invoke"); this.globalTransaction = !"false".equals(eventElement.getAttribute("global-transaction")); } + + public Event(String type, String path, String invoke, boolean globalTransaction) { + this.type = type; + this.path = path; + this.invoke = invoke; + this.globalTransaction = globalTransaction; + } } public static final RequestResponse emptyNoneRequestResponse = RequestResponse.createEmptyNoneRequestResponse(); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/RequestHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/RequestHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/RequestHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/control/RequestHandler.java Sun Mar 8 19:14:14 2009 @@ -65,7 +65,6 @@ public class RequestHandler { public static final String module = RequestHandler.class.getName(); - public static final String err_resource = "WebappUiLabels"; public static RequestHandler getRequestHandler(ServletContext servletContext) { RequestHandler rh = (RequestHandler) servletContext.getAttribute("_REQUEST_HANDLER_"); @@ -171,20 +170,29 @@ } } - // Check if we SHOULD be secure and are not. If we are posting let it pass to not lose data. (too late now anyway) - if (!request.isSecure() && requestMap.securityHttps && !request.getMethod().equalsIgnoreCase("POST")) { - StringBuilder urlBuf = new StringBuilder(); - urlBuf.append(request.getPathInfo()); - if (request.getQueryString() != null) { - urlBuf.append("?").append(request.getQueryString()); - } - String newUrl = RequestHandler.makeUrl(request, response, urlBuf.toString()); - if (newUrl.toUpperCase().startsWith("HTTPS")) { - // if we are supposed to be secure, redirect secure. - callRedirect(newUrl, response, request); + // Check if we SHOULD be secure and are not. + if (!request.isSecure() && requestMap.securityHttps) { + // If the requet method was POST then return an error to avoid problems with XSRF where the request may have come from another machine/program and had the same session ID but was not encrypted as it should have been (we used to let it pass to not lose data since it was too late to protect that data anyway) + if (request.getMethod().equalsIgnoreCase("POST")) { + // we can't redirect with the body parameters, and for better security from XSRF, just return an error message + Locale locale = UtilHttp.getLocale(request); + String errMsg = UtilProperties.getMessage("WebappUiLabels", "requestHandler.InsecureFormPostToSecureRequest", locale); + Debug.logError("Got a insecure (non-https) form POST to a secure (http) request [" + requestMap.uri + "], returning error", module); + throw new RequestHandlerException(errMsg); + } else { + StringBuilder urlBuf = new StringBuilder(); + urlBuf.append(request.getPathInfo()); + if (request.getQueryString() != null) { + urlBuf.append("?").append(request.getQueryString()); + } + String newUrl = RequestHandler.makeUrl(request, response, urlBuf.toString()); + if (newUrl.toUpperCase().startsWith("HTTPS")) { + // if we are supposed to be secure, redirect secure. + callRedirect(newUrl, response, request); + } } } - + // Check for HTTPS client (x.509) security if (request.isSecure() && requestMap.securityCert) { X509Certificate[] clientCerts = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate"); // 2.2 spec @@ -228,7 +236,7 @@ if (visit != null) { for (ConfigXMLReader.Event event: controllerConfig.firstVisitEventList) { try { - String returnString = this.runEvent(request, response, event.type, event.path, event.invoke, "firstvisit"); + String returnString = this.runEvent(request, response, event, null, "firstvisit"); if (returnString != null && !returnString.equalsIgnoreCase("success")) { throw new EventHandlerException("First-Visit event did not return 'success'."); } else if (returnString == null) { @@ -244,7 +252,7 @@ // Invoke the pre-processor (but NOT in a chain) for (ConfigXMLReader.Event event: controllerConfig.preprocessorEventList) { try { - String returnString = this.runEvent(request, response, event.type, event.path, event.invoke, "preprocessor"); + String returnString = this.runEvent(request, response, event, null, "preprocessor"); if (returnString != null && !returnString.equalsIgnoreCase("success")) { if (!returnString.contains(":_protect_:")) { throw new EventHandlerException("Pre-Processor event did not return 'success'."); @@ -292,7 +300,7 @@ String checkLoginReturnString = null; try { - checkLoginReturnString = this.runEvent(request, response, checkLoginEvent.type, checkLoginEvent.path, checkLoginEvent.invoke, "security-auth"); + checkLoginReturnString = this.runEvent(request, response, checkLoginEvent, null, "security-auth"); } catch (EventHandlerException e) { throw new RequestHandlerException(e.getMessage(), e); } @@ -325,7 +333,7 @@ long eventStartTime = System.currentTimeMillis(); // run the request event - eventReturn = this.runEvent(request, response, requestMap.event.type, requestMap.event.path, requestMap.event.invoke, "request"); + eventReturn = this.runEvent(request, response, requestMap.event, requestMap, "request"); // save the server hit for the request event if (this.trackStats(request)) { @@ -342,7 +350,7 @@ if (requestMap.requestResponseMap.containsKey("error")) { eventReturn = "error"; Locale locale = UtilHttp.getLocale(request); - String errMsg = UtilProperties.getMessage(RequestHandler.err_resource, "requestHandler.error_call_event", locale); + String errMsg = UtilProperties.getMessage("WebappUiLabels", "requestHandler.error_call_event", locale); request.setAttribute("_ERROR_MESSAGE_", errMsg + ": " + e.toString()); } else { throw new RequestHandlerException("Error calling event and no error response was specified", e); @@ -465,7 +473,7 @@ // first invoke the post-processor events. for (ConfigXMLReader.Event event: controllerConfig.postprocessorEventList) { try { - String returnString = this.runEvent(request, response, event.type, event.path, event.invoke, "postprocessor"); + String returnString = this.runEvent(request, response, event, requestMap, "postprocessor"); if (returnString != null && !returnString.equalsIgnoreCase("success")) { throw new EventHandlerException("Post-Processor event did not return 'success'."); } @@ -504,10 +512,10 @@ Map<String, Object> urlParams = null; if (session.getAttribute("_SAVED_VIEW_NAME_") != null) { viewName = (String) session.getAttribute("_SAVED_VIEW_NAME_"); - urlParams = (Map<String, Object>) session.getAttribute("_SAVED_VIEW_PARAMS_"); + urlParams = (Map<String, Object>) UtilGenerics.<String, Object>checkMap(session.getAttribute("_SAVED_VIEW_PARAMS_")); } else if (session.getAttribute("_LAST_VIEW_NAME_") != null) { viewName = (String) session.getAttribute("_LAST_VIEW_NAME_"); - urlParams = (Map<String, Object>) session.getAttribute("_LAST_VIEW_PARAMS_"); + urlParams = (Map<String, Object>) UtilGenerics.<String, Object>checkMap(session.getAttribute("_LAST_VIEW_PARAMS_")); } if (urlParams != null) { for (Map.Entry<String, Object> urlParamEntry: urlParams.entrySet()) { @@ -524,11 +532,11 @@ } /** Find the event handler and invoke an event. */ - public String runEvent(HttpServletRequest request, HttpServletResponse response, String type, - String path, String method, String trigger) throws EventHandlerException { - EventHandler eventHandler = eventFactory.getEventHandler(type); - String eventReturn = eventHandler.invoke(path, method, request, response); - if (Debug.verboseOn() || (Debug.infoOn() && "request".equals(trigger))) Debug.logInfo("Ran Event [" + type + ":" + path + "#" + method + "] from [" + trigger + "], result is [" + eventReturn + "]", module); + public String runEvent(HttpServletRequest request, HttpServletResponse response, + ConfigXMLReader.Event event, ConfigXMLReader.RequestMap requestMap, String trigger) throws EventHandlerException { + EventHandler eventHandler = eventFactory.getEventHandler(event.type); + String eventReturn = eventHandler.invoke(event, requestMap, request, response); + if (Debug.verboseOn() || (Debug.infoOn() && "request".equals(trigger))) Debug.logInfo("Ran Event [" + event.type + ":" + event.path + "#" + event.invoke + "] from [" + trigger + "], result is [" + eventReturn + "]", module); return eventReturn; } @@ -974,7 +982,7 @@ public void runAfterLoginEvents(HttpServletRequest request, HttpServletResponse response) { for (ConfigXMLReader.Event event: getControllerConfig().afterLoginEventList) { try { - String returnString = this.runEvent(request, response, event.type, event.path, event.invoke, "after-login"); + String returnString = this.runEvent(request, response, event, null, "after-login"); if (returnString != null && !returnString.equalsIgnoreCase("success")) { throw new EventHandlerException("Pre-Processor event did not return 'success'."); } @@ -987,7 +995,7 @@ public void runBeforeLogoutEvents(HttpServletRequest request, HttpServletResponse response) { for (ConfigXMLReader.Event event: getControllerConfig().beforeLogoutEventList) { try { - String returnString = this.runEvent(request, response, event.type, event.path, event.invoke, "before-logout"); + String returnString = this.runEvent(request, response, event, null, "before-logout"); if (returnString != null && !returnString.equalsIgnoreCase("success")) { throw new EventHandlerException("Pre-Processor event did not return 'success'."); } Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/AbstractJSONEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/AbstractJSONEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/AbstractJSONEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/AbstractJSONEventHandler.java Sun Mar 8 19:14:14 2009 @@ -35,8 +35,10 @@ import net.sf.json.JSONObject; import org.ofbiz.base.util.Debug; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; -public abstract class AbstractJSONEventHandler implements EventHandler{ +public abstract class AbstractJSONEventHandler implements EventHandler { public static final String module = JSONSimpleEventHandler.class.getName(); protected EventHandler service; @@ -44,9 +46,9 @@ public abstract void init(ServletContext context) throws EventHandlerException; - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { // call into the java handler for parameters parsing and invocation - String respCode = service.invoke(eventPath, eventMethod, request, response); + String respCode = service.invoke(null, requestMap, request, response); // pull out the service response from the request attribute Map<String, Object> attrMap = getAttributesAsMap(request); @@ -80,7 +82,7 @@ private Map<String, Object> getAttributesAsMap(HttpServletRequest request) { Map<String, Object> attrMap = FastMap.newInstance(); - Enumeration en = request.getAttributeNames(); + Enumeration<String> en = request.getAttributeNames(); while (en.hasMoreElements()) { String name = (String) en.nextElement(); Object val = request.getAttribute(name); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/BsfEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/BsfEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/BsfEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/BsfEventHandler.java Sun Mar 8 19:14:14 2009 @@ -21,6 +21,7 @@ import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; + import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -28,9 +29,9 @@ import org.apache.bsf.BSFException; import org.apache.bsf.BSFManager; import org.apache.bsf.util.IOUtils; - import org.ofbiz.base.util.Debug; import org.ofbiz.base.util.cache.UtilCache; +import org.ofbiz.webapp.control.ConfigXMLReader; /** * BsfEventHandler - BSF Event Handler @@ -49,7 +50,7 @@ /** * @see org.ofbiz.webapp.event.EventHandler#invoke(java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(ConfigXMLReader.Event event, ConfigXMLReader.RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { ServletContext context = (ServletContext) request.getAttribute("servletContext"); ClassLoader cl = Thread.currentThread().getContextClassLoader(); if (cl == null) @@ -69,23 +70,23 @@ bsfManager.declareBean("response", response, HttpServletResponse.class); // get the script type - String scriptType = BSFManager.getLangFromFilename(eventMethod); + String scriptType = BSFManager.getLangFromFilename(event.invoke); // load the script InputStream scriptStream = null; String scriptString = null; String cacheName = null; - if (eventPath == null || eventPath.length() == 0) { + if (event.path == null || event.path.length() == 0) { // we are a resource to be loaded off the classpath - cacheName = eventMethod; + cacheName = event.invoke; scriptString = eventCache.get(cacheName); if (scriptString == null) { synchronized(this) { if (scriptString == null) { - Debug.logInfo("Loading BSF Script from classpath at location: " + eventMethod, module); - scriptStream = cl.getResourceAsStream(eventMethod); + Debug.logInfo("Loading BSF Script from classpath at location: " + event.invoke, module); + scriptStream = cl.getResourceAsStream(event.invoke); if (scriptStream == null) { - throw new EventHandlerException("Could not find BSF script file at classpath location: " + eventMethod); + throw new EventHandlerException("Could not find BSF script file at classpath location: " + event.invoke); } scriptString = IOUtils.getStringFromReader(new InputStreamReader(scriptStream)); eventCache.put(cacheName, scriptString); @@ -94,14 +95,14 @@ } } else { // we are a script in the webapp - load by resource - cacheName = context.getServletContextName() + ":" + eventPath + eventMethod; + cacheName = context.getServletContextName() + ":" + event.path + event.invoke; scriptString = eventCache.get(cacheName); if (scriptString == null) { synchronized(this) { if (scriptString == null) { - scriptStream = context.getResourceAsStream(eventPath + eventMethod); + scriptStream = context.getResourceAsStream(event.path + event.invoke); if (scriptStream == null) { - throw new EventHandlerException("Could not find BSF script file in webapp context: " + eventPath + eventMethod); + throw new EventHandlerException("Could not find BSF script file in webapp context: " + event.path + event.invoke); } scriptString = IOUtils.getStringFromReader(new InputStreamReader(scriptStream)); eventCache.put(cacheName, scriptString); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/CoreEvents.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/CoreEvents.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/CoreEvents.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/CoreEvents.java Sun Mar 8 19:14:14 2009 @@ -55,6 +55,7 @@ import org.ofbiz.service.ServiceDispatcher; import org.ofbiz.service.calendar.RecurrenceRule; import org.ofbiz.webapp.control.RequestHandler; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; /** * CoreEvents - WebApp Events Related To Framework pieces @@ -555,8 +556,9 @@ // call the service via the ServiceEventHandler which // adapts an event to a service. + Event event = new Event("service", mode, serviceName, false); try { - return seh.invoke(mode, serviceName, request, response); + return seh.invoke(event, null, request, response); } catch (EventHandlerException e) { String errMsg = UtilProperties.getMessage(CoreEvents.err_resource, "coreEvents.service_eventhandler_exception", locale); request.setAttribute("_ERROR_MESSAGE_", "<li>" + errMsg + ": " + e.getMessage()); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/DojoJSONServiceEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/DojoJSONServiceEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/DojoJSONServiceEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/DojoJSONServiceEventHandler.java Sun Mar 8 19:14:14 2009 @@ -22,15 +22,14 @@ import java.io.UnsupportedEncodingException; import java.io.Writer; import java.util.Enumeration; +import java.util.List; import java.util.Locale; import java.util.Map; -import java.util.List; import java.util.TimeZone; import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; import javolution.util.FastList; import javolution.util.FastMap; @@ -38,11 +37,12 @@ import org.ofbiz.base.util.Debug; import org.ofbiz.base.util.UtilHttp; -import org.ofbiz.entity.GenericValue; import org.ofbiz.service.DispatchContext; import org.ofbiz.service.GenericServiceException; import org.ofbiz.service.LocalDispatcher; import org.ofbiz.service.ModelService; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * DojoJSONServiceEventHandler - JSON Object Wrapper around the ServiceEventHandler @@ -64,9 +64,9 @@ this.service.init(context); } - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { // call into the service handler for parameters parsing and invocation - String respCode = service.invoke(eventPath, eventMethod, request, response); + String respCode = service.invoke(null, requestMap, request, response); // pull out the service response from the request attribute Map<String, Object> attrMap = getAttributesAsMap(request); @@ -85,11 +85,11 @@ String serviceName = null; Locale locale = UtilHttp.getLocale(request); TimeZone timeZone = UtilHttp.getTimeZone(request); - HttpSession session = request.getSession(); - GenericValue userLogin = (GenericValue) session.getAttribute("userLogin"); + //HttpSession session = request.getSession(); + //GenericValue userLogin = (GenericValue) session.getAttribute("userLogin"); - // nake sure we have a defined service to call - serviceName = eventMethod; + // make sure we have a defined service to call + serviceName = event.invoke; if (serviceName == null) { throw new EventHandlerException("Service name (eventMethod) cannot be null"); } @@ -140,7 +140,7 @@ private Map<String, Object> getAttributesAsMap(HttpServletRequest request) { Map<String, Object> attrMap = FastMap.newInstance(); - Enumeration en = request.getAttributeNames(); + Enumeration<String> en = request.getAttributeNames(); while (en.hasMoreElements()) { String name = (String) en.nextElement(); Object val = request.getAttribute(name); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventFactory.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventFactory.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventFactory.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventFactory.java Sun Mar 8 19:14:14 2009 @@ -121,7 +121,7 @@ ServletContext application = ((ServletContext) request.getAttribute("servletContext")); RequestHandler handler = (RequestHandler) application.getAttribute("_REQUEST_HANDLER_"); ConfigXMLReader.ControllerConfig controllerConfig = handler.getControllerConfig(); - ConfigXMLReader.Event event = controllerConfig.requestMapMap.get(requestUri).event; - return handler.runEvent(request, response, event.type, event.path, event.invoke, "unknown"); + ConfigXMLReader.RequestMap requestMap = controllerConfig.requestMapMap.get(requestUri); + return handler.runEvent(request, response, requestMap.event, requestMap, "unknown"); } } Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/EventHandler.java Sun Mar 8 19:14:14 2009 @@ -18,9 +18,12 @@ *******************************************************************************/ package org.ofbiz.webapp.event; +import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.ServletContext; + +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * EventHandler - Event Handler Interface @@ -40,14 +43,13 @@ /** * Invoke the web event + * @param event Contains information about what to execute + * @param requestMap Contains information about the request-map the event was called from + * @param request The servlet request object + * @param response The servlet response object * - *@param eventPath The path or location of this event - *@param eventMethod The method to invoke - *@param request The servlet request object - *@param response The servlet response object *@return String Result code *@throws EventHandlerException */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException; + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException; } - Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/GroovyEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/GroovyEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/GroovyEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/GroovyEventHandler.java Sun Mar 8 19:14:14 2009 @@ -30,6 +30,8 @@ import org.ofbiz.base.util.GroovyUtil; import org.ofbiz.base.util.UtilHttp; import org.ofbiz.base.util.UtilMisc; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; public class GroovyEventHandler implements EventHandler { @@ -38,7 +40,7 @@ public void init(ServletContext context) throws EventHandlerException { } - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { try { Map<String, Object> groovyContext = FastMap.newInstance(); groovyContext.put("request", request); @@ -54,7 +56,7 @@ groovyContext.put("userLogin", session.getAttribute("userLogin")); groovyContext.put("parameters", UtilHttp.getCombinedMap(request, UtilMisc.toSet("delegator", "dispatcher", "security", "locale", "timeZone", "userLogin"))); - Object result = GroovyUtil.runScriptAtLocation(eventPath + eventMethod, groovyContext); + Object result = GroovyUtil.runScriptAtLocation(event.path + event.invoke, groovyContext); // check the result if (result != null && !(result instanceof String)) { throw new EventHandlerException("Event did not return a String result, it returned a " + result.getClass().getName()); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONJavaEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONJavaEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONJavaEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONJavaEventHandler.java Sun Mar 8 19:14:14 2009 @@ -22,8 +22,9 @@ import java.io.UnsupportedEncodingException; import java.io.Writer; import java.util.Enumeration; -import java.util.Map; import java.util.List; +import java.util.Map; + import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -32,6 +33,8 @@ import net.sf.json.JSONObject; import org.ofbiz.base.util.Debug; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * JSONJavaEventHandler - JSON Object Wrapper around the JavaEventHandler @@ -46,9 +49,9 @@ this.service.init(context); } - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { // call into the java handler for parameters parsing and invocation - String respCode = service.invoke(eventPath, eventMethod, request, response); + String respCode = service.invoke(event, requestMap, request, response); // pull out the service response from the request attribute Map<String, Object> attrMap = getAttributesAsMap(request); @@ -84,7 +87,7 @@ private Map<String, Object> getAttributesAsMap(HttpServletRequest request) { Map<String, Object> attrMap = FastMap.newInstance(); - Enumeration en = request.getAttributeNames(); + Enumeration<String> en = request.getAttributeNames(); while (en.hasMoreElements()) { String name = (String) en.nextElement(); Object val = request.getAttribute(name); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONServiceEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONServiceEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONServiceEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JSONServiceEventHandler.java Sun Mar 8 19:14:14 2009 @@ -22,8 +22,9 @@ import java.io.UnsupportedEncodingException; import java.io.Writer; import java.util.Enumeration; -import java.util.Map; import java.util.List; +import java.util.Map; + import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -32,6 +33,8 @@ import net.sf.json.JSONObject; import org.ofbiz.base.util.Debug; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * JSONServiceEventHandler - JSON Object Wrapper around the ServiceEventHandler @@ -46,9 +49,9 @@ this.service.init(context); } - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { // call into the service handler for parameters parsing and invocation - String respCode = service.invoke(eventPath, eventMethod, request, response); + String respCode = service.invoke(event, requestMap, request, response); // pull out the service response from the request attribute Map<String, Object> attrMap = getAttributesAsMap(request); @@ -84,7 +87,7 @@ private Map<String, Object> getAttributesAsMap(HttpServletRequest request) { Map<String, Object> attrMap = FastMap.newInstance(); - Enumeration en = request.getAttributeNames(); + Enumeration<String> en = request.getAttributeNames(); while (en.hasMoreElements()) { String name = (String) en.nextElement(); Object val = request.getAttribute(name); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JavaEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JavaEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JavaEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/JavaEventHandler.java Sun Mar 8 19:14:14 2009 @@ -20,13 +20,16 @@ import java.lang.reflect.Method; import java.util.Map; + +import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.ServletContext; import javolution.util.FastMap; import org.ofbiz.base.util.Debug; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * JavaEventHandler - Static Method Java Event Handler @@ -44,35 +47,35 @@ } /** - * @see org.ofbiz.webapp.event.EventHandler#invoke(java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + * @see org.ofbiz.webapp.event.EventHandler#invoke(Event, org.ofbiz.webapp.control.ConfigXMLReader.RequestMap, HttpServletRequest, HttpServletResponse) */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { - Class<?> eventClass = this.eventClassMap.get(eventPath); + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + Class<?> eventClass = this.eventClassMap.get(event.path); if (eventClass == null) { synchronized (this) { - eventClass = this.eventClassMap.get(eventPath); + eventClass = this.eventClassMap.get(event.path); if (eventClass == null) { try { ClassLoader loader = Thread.currentThread().getContextClassLoader(); - eventClass = loader.loadClass(eventPath); + eventClass = loader.loadClass(event.path); } catch (ClassNotFoundException e) { - Debug.logError(e, "Error loading class with name: " + eventPath + ", will not be able to run event...", module); + Debug.logError(e, "Error loading class with name: " + event.path + ", will not be able to run event...", module); } if (eventClass != null) { - eventClassMap.put(eventPath, eventClass); + eventClassMap.put(event.path, eventClass); } } } } - if (Debug.verboseOn()) Debug.logVerbose("[Set path/method]: " + eventPath + " / " + eventMethod, module); + if (Debug.verboseOn()) Debug.logVerbose("[Set path/method]: " + event.path + " / " + event.invoke, module); Class<?>[] paramTypes = new Class<?>[] {HttpServletRequest.class, HttpServletResponse.class}; Debug.logVerbose("*[[Event invocation]]*", module); Object[] params = new Object[] {request, response}; - return invoke(eventPath, eventMethod, eventClass, paramTypes, params); + return invoke(event.path, event.invoke, eventClass, paramTypes, params); } private String invoke(String eventPath, String eventMethod, Class<?> eventClass, Class[] paramTypes, Object[] params) throws EventHandlerException { Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/RomeEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/RomeEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/RomeEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/RomeEventHandler.java Sun Mar 8 19:14:14 2009 @@ -19,17 +19,19 @@ package org.ofbiz.webapp.event; -import org.ofbiz.webapp.control.RequestHandler; +import java.io.IOException; import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.ofbiz.webapp.control.RequestHandler; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; + import com.sun.syndication.feed.WireFeed; -import com.sun.syndication.io.WireFeedOutput; import com.sun.syndication.io.FeedException; - -import java.io.IOException; +import com.sun.syndication.io.WireFeedOutput; /** * RomeEventHandler @@ -58,7 +60,10 @@ this.out = new WireFeedOutput(); } - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + /** + * @see org.ofbiz.webapp.event.EventHandler#invoke(Event, org.ofbiz.webapp.control.ConfigXMLReader.RequestMap, HttpServletRequest, HttpServletResponse) + */ + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { // generate the main and entry links String entryLinkReq = request.getParameter("entryLinkReq"); String mainLinkReq = request.getParameter("mainLinkReq"); @@ -75,7 +80,7 @@ } // invoke the feed generator service (implements rssFeedInterface) - String respCode = service.invoke(eventPath, eventMethod, request, response); + String respCode = service.invoke(null, requestMap, request, response); // pull out the RSS feed from the request attributes WireFeed wireFeed = (WireFeed) request.getAttribute("wireFeed"); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SOAPEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SOAPEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SOAPEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SOAPEventHandler.java Sun Mar 8 19:14:14 2009 @@ -22,7 +22,6 @@ import java.io.IOException; import java.io.OutputStream; import java.io.Writer; -import java.util.Iterator; import java.util.List; import java.util.Map; @@ -50,6 +49,8 @@ import org.ofbiz.service.LocalDispatcher; import org.ofbiz.service.ModelService; import org.ofbiz.webapp.control.RequestHandler; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; import org.w3c.dom.Document; /** @@ -65,15 +66,10 @@ public void init(ServletContext context) throws EventHandlerException { } - /** Invoke the web event - *@param eventPath The path or location of this event - *@param eventMethod The method to invoke - *@param request The servlet request object - *@param response The servlet response object - *@return String Result code - *@throws EventHandlerException + /** + * @see org.ofbiz.webapp.event.EventHandler#invoke(Event, org.ofbiz.webapp.control.ConfigXMLReader.RequestMap, HttpServletRequest, HttpServletResponse) */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { LocalDispatcher dispatcher = (LocalDispatcher) request.getAttribute("dispatcher"); AxisServer axisServer; @@ -188,7 +184,7 @@ throw new EventHandlerException("Cannot get the envelope", e); } - List bodies = null; + List<Object> bodies = null; try { bodies = reqEnv.getBodyElements(); @@ -205,8 +201,7 @@ if (o instanceof RPCElement) { RPCElement body = (RPCElement) o; String serviceName = body.getMethodName(); - List params = null; - + List<RPCParam> params = null; try { params = body.getParams(); } catch (Exception e) { @@ -214,11 +209,7 @@ throw new EventHandlerException(e.getMessage(), e); } Map<String, Object> serviceContext = FastMap.newInstance(); - Iterator p = params.iterator(); - - while (p.hasNext()) { - RPCParam param = (RPCParam) p.next(); - + for (RPCParam param: params) { if (Debug.verboseOn()) Debug.logVerbose("[Reading Param]: " + param.getName(), module); serviceContext.put(param.getName(), param.getObjectValue()); } Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceEventHandler.java Sun Mar 8 19:14:14 2009 @@ -22,11 +22,10 @@ import java.io.File; import java.nio.ByteBuffer; -import java.util.Arrays; -import java.util.Iterator; import java.util.List; import java.util.Locale; import java.util.Map; +import java.util.Set; import java.util.TimeZone; import javax.servlet.ServletContext; @@ -53,6 +52,8 @@ import org.ofbiz.service.ModelService; import org.ofbiz.service.ServiceAuthException; import org.ofbiz.service.ServiceValidationException; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * ServiceEventHandler - Service Event Handler @@ -73,7 +74,7 @@ /** * @see org.ofbiz.webapp.event.EventHandler#invoke(java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { // make sure we have a valid reference to the Service Engine LocalDispatcher dispatcher = (LocalDispatcher) request.getAttribute("dispatcher"); if (dispatcher == null) { @@ -88,14 +89,14 @@ String mode = SYNC; String serviceName = null; - if (eventPath == null || eventPath.length() == 0) { + if (UtilValidate.isEmpty(event.path)) { mode = SYNC; } else { - mode = eventPath; + mode = event.path; } - // nake sure we have a defined service to call - serviceName = eventMethod; + // make sure we have a defined service to call + serviceName = event.invoke; if (serviceName == null) { throw new EventHandlerException("Service name (eventMethod) cannot be null"); } @@ -161,16 +162,14 @@ } upload.setSizeMax(maxUploadSize); - List uploadedItems = null; + List<FileItem> uploadedItems = null; try { uploadedItems = upload.parseRequest(request); } catch (FileUploadException e) { throw new EventHandlerException("Problems reading uploaded data", e); } if (uploadedItems != null) { - Iterator i = uploadedItems.iterator(); - while (i.hasNext()) { - FileItem item = (FileItem) i.next(); + for (FileItem item: uploadedItems) { String fieldName = item.getFieldName(); //byte[] itemBytes = item.get(); /* @@ -227,6 +226,7 @@ request.setAttribute("multiPartMap", multiPartMap); Map<String, Object> rawParametersMap = UtilHttp.getParameterMap(request, null, null); + Set<String> urlOnlyParameterNames = UtilHttp.getUrlOnlyParameterMap(request).keySet(); // we have a service and the model; build the context Map<String, Object> serviceContext = FastMap.newInstance(); @@ -242,11 +242,11 @@ Object value = null; if (modelParam.stringMapPrefix != null && modelParam.stringMapPrefix.length() > 0) { - Map paramMap = UtilHttp.makeParamMapWithPrefix(request, multiPartMap, modelParam.stringMapPrefix, null); + Map<String, Object> paramMap = UtilHttp.makeParamMapWithPrefix(request, multiPartMap, modelParam.stringMapPrefix, null); value = paramMap; if (Debug.verboseOn()) Debug.log("Set [" + modelParam.name + "]: " + paramMap, module); } else if (modelParam.stringListSuffix != null && modelParam.stringListSuffix.length() > 0) { - List paramList = UtilHttp.makeParamListWithSuffix(request, multiPartMap, modelParam.stringListSuffix, null); + List<Object> paramList = UtilHttp.makeParamListWithSuffix(request, multiPartMap, modelParam.stringListSuffix, null); value = paramList; } else { // first check the multi-part map @@ -262,6 +262,17 @@ // check the request parameters if (UtilValidate.isEmpty(value)) { + // special case for security: if this is a request-map defined as secure in controller.xml then only accept body parameters coming in, ie don't allow the insecure URL parameters + // NOTE: the RequestHandler will check the HttpSerletRequest security to make sure it is secure if the request-map -> security -> https=true, but we can't just look at the request.isSecure() method here because it is allowed to send secure requests for request-map with https=false + if (requestMap != null && requestMap.securityHttps) { + if (urlOnlyParameterNames.contains(name)) { + String errMsg = "Found URL parameter [" + name + "] passed to secure (https) request-map with uri [" + requestMap.uri + "] with an event that calls service [" + serviceName + "]; this is not allowed for security reasons!"; + Debug.logWarning(errMsg, module); + throw new EventHandlerException(errMsg); + } + // TODO: may want to allow parameters that map to entity PK fields to be in the URL, but that might be a big security hole since there are certain security sensitive entities that are made of only PK fields, or that only need PK fields to function (like UserLoginSecurityGroup) + } + // use the rawParametersMap from UtilHttp in order to also get pathInfo parameters, do canonicalization, etc value = rawParametersMap.get(name); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceMultiEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceMultiEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceMultiEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceMultiEventHandler.java Sun Mar 8 19:14:14 2009 @@ -22,6 +22,7 @@ import java.util.List; import java.util.Locale; import java.util.Map; +import java.util.Set; import java.util.TimeZone; import javax.servlet.ServletContext; @@ -33,6 +34,7 @@ import javolution.util.FastMap; import org.ofbiz.base.util.Debug; +import org.ofbiz.base.util.UtilGenerics; import org.ofbiz.base.util.UtilHttp; import org.ofbiz.base.util.UtilProperties; import org.ofbiz.base.util.UtilValidate; @@ -49,6 +51,8 @@ import org.ofbiz.service.ServiceValidationException; import org.ofbiz.webapp.control.ConfigXMLReader; import org.ofbiz.webapp.control.RequestHandler; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * ServiceMultiEventHandler - Event handler for running a service multiple times; for bulk forms @@ -72,7 +76,7 @@ /** * @see org.ofbiz.webapp.event.EventHandler#invoke(java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { // TODO: consider changing this to use the new UtilHttp.parseMultiFormData method // make sure we have a valid reference to the Service Engine @@ -89,10 +93,10 @@ String mode = SYNC; String serviceName = null; - if (eventPath == null || eventPath.length() == 0) { + if (UtilValidate.isEmpty(event.path)) { mode = SYNC; } else { - mode = eventPath; + mode = event.path; } // we only support SYNC mode in this handler @@ -101,7 +105,7 @@ } // nake sure we have a defined service to call - serviceName = eventMethod; + serviceName = event.invoke; if (serviceName == null) { throw new EventHandlerException("Service name (eventMethod) cannot be null"); } @@ -159,11 +163,12 @@ ConfigXMLReader.ControllerConfig controllerConfig = ConfigXMLReader.getControllerConfig(ConfigXMLReader.getControllerConfigURL(servletContext)); boolean eventGlobalTransaction = controllerConfig.requestMapMap.get(requestUri).event.globalTransaction; + Set<String> urlOnlyParameterNames = UtilHttp.getUrlOnlyParameterMap(request).keySet(); + // big try/finally to make sure commit or rollback are run boolean beganTrans = false; String returnString = null; try { - if (eventGlobalTransaction) { // start the global transaction try { @@ -206,10 +211,10 @@ Object value = null; if (modelParam.stringMapPrefix != null && modelParam.stringMapPrefix.length() > 0) { - Map paramMap = UtilHttp.makeParamMapWithPrefix(request, modelParam.stringMapPrefix, curSuffix); + Map<String, Object> paramMap = UtilHttp.makeParamMapWithPrefix(request, modelParam.stringMapPrefix, curSuffix); value = paramMap; } else if (modelParam.stringListSuffix != null && modelParam.stringListSuffix.length() > 0) { - List paramList = UtilHttp.makeParamListWithSuffix(request, modelParam.stringListSuffix, null); + List<Object> paramList = UtilHttp.makeParamListWithSuffix(request, modelParam.stringListSuffix, null); value = paramList; } else { // check attributes; do this before parameters so that attribute which can be changed by code can override parameters which can't @@ -217,7 +222,20 @@ // first check for request parameters if (value == null) { - String[] paramArr = request.getParameterValues(paramName + curSuffix); + String name = paramName + curSuffix; + + // special case for security: if this is a request-map defined as secure in controller.xml then only accept body parameters coming in, ie don't allow the insecure URL parameters + // NOTE: the RequestHandler will check the HttpSerletRequest security to make sure it is secure if the request-map -> security -> https=true, but we can't just look at the request.isSecure() method here because it is allowed to send secure requests for request-map with https=false + if (requestMap != null && requestMap.securityHttps) { + if (urlOnlyParameterNames.contains(name)) { + String errMsg = "Found URL parameter [" + name + "] passed to secure (https) request-map with uri [" + requestMap.uri + "] with an event that calls service [" + serviceName + "]; this is not allowed for security reasons!"; + Debug.logWarning(errMsg, module); + throw new EventHandlerException(errMsg); + } + // TODO: may want to allow parameters that map to entity PK fields to be in the URL, but that might be a big security hole since there are certain security sensitive entities that are made of only PK fields, or that only need PK fields to function (like UserLoginSecurityGroup) + } + + String[] paramArr = request.getParameterValues(name); if (paramArr != null) { if (paramArr.length > 1) { value = Arrays.asList(paramArr); @@ -327,8 +345,8 @@ successMessages.add(newSuccessMessage); } } - if (!UtilValidate.isEmpty((List)result.get(ModelService.SUCCESS_MESSAGE_LIST))) { - List newSuccessMessages = (List)result.get(ModelService.SUCCESS_MESSAGE_LIST); + if (!UtilValidate.isEmpty(result.get(ModelService.SUCCESS_MESSAGE_LIST))) { + List<String> newSuccessMessages = UtilGenerics.<String>checkList(result.get(ModelService.SUCCESS_MESSAGE_LIST)); for (int j = 0; j < newSuccessMessages.size(); j++) { String newSuccessMessage = (String)newSuccessMessages.get(j); if (!successMessages.contains(newSuccessMessage)) { Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceStreamHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceStreamHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceStreamHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/ServiceStreamHandler.java Sun Mar 8 19:14:14 2009 @@ -19,21 +19,27 @@ package org.ofbiz.webapp.event; -import org.ofbiz.entity.GenericDelegator; -import org.ofbiz.service.GenericDispatcher; -import org.ofbiz.service.LocalDispatcher; -import org.ofbiz.service.GenericServiceException; -import org.ofbiz.service.ServiceUtil; -import org.ofbiz.base.util.Debug; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.io.PrintStream; +import java.util.Map; import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import java.io.*; -import java.util.Map; import javolution.util.FastMap; +import org.ofbiz.base.util.Debug; +import org.ofbiz.entity.GenericDelegator; +import org.ofbiz.service.GenericDispatcher; +import org.ofbiz.service.GenericServiceException; +import org.ofbiz.service.LocalDispatcher; +import org.ofbiz.service.ServiceUtil; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; + /** * ServiceStreamHandler */ @@ -50,7 +56,7 @@ this.dispatcher = GenericDispatcher.getLocalDispatcher(dispatcherName, delegator); } - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { InputStream in; try { in = request.getInputStream(); @@ -72,7 +78,7 @@ Map<String, Object> resp; try { - resp = dispatcher.runSync(eventMethod, context); + resp = dispatcher.runSync(event.invoke, context); } catch (GenericServiceException e) { outputError(out, e, "Exception thrown in runSync()"); throw new EventHandlerException(e.getMessage(), e); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SimpleEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SimpleEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SimpleEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/SimpleEventHandler.java Sun Mar 8 19:14:14 2009 @@ -19,15 +19,18 @@ package org.ofbiz.webapp.event; import java.util.Locale; + +import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.ServletContext; import org.ofbiz.base.util.Debug; import org.ofbiz.base.util.UtilHttp; import org.ofbiz.base.util.UtilProperties; import org.ofbiz.minilang.MiniLangException; import org.ofbiz.minilang.SimpleMethod; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; /** * SimpleEventHandler - Simple Event Mini-Lang Handler @@ -45,17 +48,11 @@ } /** - * Invoke the web event - *@param eventPath The path or location of this event - *@param eventMethod The method to invoke - *@param request The servlet request object - *@param response The servlet response object - *@return String Result code - *@throws EventHandlerException + * @see org.ofbiz.webapp.event.EventHandler#invoke(Event, org.ofbiz.webapp.control.ConfigXMLReader.RequestMap, HttpServletRequest, HttpServletResponse) */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { - String xmlResource = eventPath; - String eventName = eventMethod; + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + String xmlResource = event.path; + String eventName = event.invoke; Locale locale = UtilHttp.getLocale(request); if (Debug.verboseOn()) Debug.logVerbose("[Set path/method]: " + xmlResource + " / " + eventName, module); Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/WfsEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/WfsEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/WfsEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/WfsEventHandler.java Sun Mar 8 19:14:14 2009 @@ -18,68 +18,41 @@ *******************************************************************************/ package org.ofbiz.webapp.event ; -import java.io.FileNotFoundException; import java.io.File; +import java.io.FileNotFoundException; import java.io.FileReader; import java.io.IOException; import java.io.StringWriter; -import java.io.Writer; -import java.io.OutputStream; -import java.io.InputStream; -import java.util.Iterator; -import java.util.List; -import java.util.Map; -import java.util.Set; import java.net.URI; -import java.net.URL; import java.net.URISyntaxException; +import java.net.URL; +import java.util.List; +import java.util.Map; + +import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.ServletContext; -import org.ofbiz.webapp.event.EventHandler; -import org.ofbiz.webapp.event.EventHandlerException; - -import javax.xml.parsers.DocumentBuilder; -import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; -import javolution.util.FastList; import javolution.util.FastMap; import org.ofbiz.base.location.FlexibleLocation; -import org.ofbiz.base.util.Debug; -import org.ofbiz.base.util.UtilMisc; -import org.ofbiz.base.util.UtilXml; import org.ofbiz.base.util.UtilFormatOut; import org.ofbiz.base.util.UtilProperties; import org.ofbiz.base.util.UtilValidate; -import org.ofbiz.entity.GenericDelegator; -import org.ofbiz.minilang.method.MethodContext; -import org.ofbiz.service.GenericServiceException; -import org.ofbiz.service.LocalDispatcher; -import org.ofbiz.service.ModelService; -import org.ofbiz.service.DispatchContext; -import org.ofbiz.service.ServiceUtil; -import org.ofbiz.webapp.control.RequestHandler; +import org.ofbiz.base.util.UtilXml; import org.ofbiz.minilang.SimpleMethod; - -import org.apache.xml.serialize.OutputFormat; -import org.apache.xml.serialize.XMLSerializer; +import org.ofbiz.minilang.method.MethodContext; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; import org.w3c.dom.Document; -import org.w3c.dom.DocumentFragment; import org.w3c.dom.Element; import org.w3c.dom.Node; -import org.xml.sax.EntityResolver; -import org.xml.sax.ErrorHandler; -import org.xml.sax.InputSource; import org.xml.sax.SAXException; -import org.xml.sax.SAXParseException; -import org.xml.sax.helpers.DefaultHandler; import freemarker.ext.beans.BeansWrapper; import freemarker.ext.dom.NodeModel; import freemarker.template.Configuration; -import freemarker.template.SimpleSequence; import freemarker.template.Template; import freemarker.template.TemplateException; @@ -107,8 +80,8 @@ *@return String Result code *@throws EventHandlerException */ - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { - LocalDispatcher dispatcher = (LocalDispatcher) request.getAttribute("dispatcher"); + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + //LocalDispatcher dispatcher = (LocalDispatcher) request.getAttribute("dispatcher"); String typeName = null; Element queryElem = null; @@ -137,7 +110,7 @@ SimpleMethod meth = new SimpleMethod(simpleElem, null, null); MethodContext methodContext = new MethodContext(request, response, null); String retStr = meth.exec(methodContext); //Need to check return string - List entityList = (List)request.getAttribute("entityList"); + List entityList = (List) request.getAttribute("entityList"); request.setAttribute("entityList", entityList); } catch (TemplateException ioe) { Modified: ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/XmlRpcEventHandler.java URL: http://svn.apache.org/viewvc/ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/XmlRpcEventHandler.java?rev=751501&r1=751500&r2=751501&view=diff ============================================================================== --- ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/XmlRpcEventHandler.java (original) +++ ofbiz/trunk/framework/webapp/src/org/ofbiz/webapp/event/XmlRpcEventHandler.java Sun Mar 8 19:14:14 2009 @@ -19,29 +19,46 @@ package org.ofbiz.webapp.event; -import org.apache.xmlrpc.common.ServerStreamConnection; -import org.apache.xmlrpc.common.XmlRpcHttpRequestConfig; -import org.apache.xmlrpc.common.XmlRpcHttpRequestConfigImpl; -import org.apache.xmlrpc.server.*; -import org.apache.xmlrpc.util.HttpUtil; -import org.apache.xmlrpc.XmlRpcHandler; -import org.apache.xmlrpc.XmlRpcException; -import org.apache.xmlrpc.XmlRpcRequest; -import org.ofbiz.service.*; -import org.ofbiz.entity.GenericDelegator; -import org.ofbiz.base.util.Debug; import static org.ofbiz.base.util.UtilGenerics.checkMap; -import org.ofbiz.base.util.UtilValidate; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.OutputStream; +import java.io.Writer; +import java.util.Locale; +import java.util.Map; import javax.servlet.ServletContext; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import java.io.*; -import java.util.Map; -import java.util.Locale; import javolution.util.FastMap; +import org.apache.xmlrpc.XmlRpcException; +import org.apache.xmlrpc.XmlRpcHandler; +import org.apache.xmlrpc.XmlRpcRequest; +import org.apache.xmlrpc.common.ServerStreamConnection; +import org.apache.xmlrpc.common.XmlRpcHttpRequestConfig; +import org.apache.xmlrpc.common.XmlRpcHttpRequestConfigImpl; +import org.apache.xmlrpc.server.AbstractReflectiveHandlerMapping; +import org.apache.xmlrpc.server.XmlRpcHttpServer; +import org.apache.xmlrpc.server.XmlRpcHttpServerConfig; +import org.apache.xmlrpc.server.XmlRpcNoSuchHandlerException; +import org.apache.xmlrpc.util.HttpUtil; +import org.ofbiz.base.util.Debug; +import org.ofbiz.base.util.UtilValidate; +import org.ofbiz.entity.GenericDelegator; +import org.ofbiz.service.DispatchContext; +import org.ofbiz.service.GenericDispatcher; +import org.ofbiz.service.GenericServiceException; +import org.ofbiz.service.LocalDispatcher; +import org.ofbiz.service.ModelService; +import org.ofbiz.service.ServiceUtil; +import org.ofbiz.webapp.control.ConfigXMLReader.Event; +import org.ofbiz.webapp.control.ConfigXMLReader.RequestMap; + /** * XmlRpcEventHandler */ @@ -71,7 +88,10 @@ } } - public String invoke(String eventPath, String eventMethod, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { + /** + * @see org.ofbiz.webapp.event.EventHandler#invoke(Event, org.ofbiz.webapp.control.ConfigXMLReader.RequestMap, HttpServletRequest, HttpServletResponse) + */ + public String invoke(Event event, RequestMap requestMap, HttpServletRequest request, HttpServletResponse response) throws EventHandlerException { String report = request.getParameter("echo"); if (report != null) { StringBuilder buf = new StringBuilder(); |
«
Return to OFBiz - Commits
|
1 view|%1 views
| Free forum by Nabble | Edit this page |