    001package org.apache.turbine.modules.actions.sessionvalidator;
    002
    003/*
    004 * Licensed to the Apache Software Foundation (ASF) under one
    005 * or more contributor license agreements.  See the NOTICE file
    006 * distributed with this work for additional information
    007 * regarding copyright ownership.  The ASF licenses this file
    008 * to you under the Apache License, Version 2.0 (the
    009 * "License"); you may not use this file except in compliance
    010 * with the License.  You may obtain a copy of the License at
    011 *
    012 *   http://www.apache.org/licenses/LICENSE-2.0
    013 *
    014 * Unless required by applicable law or agreed to in writing,
    015 * software distributed under the License is distributed on an
    016 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    017 * KIND, either express or implied.  See the License for the
    018 * specific language governing permissions and limitations
    019 * under the License.
    020 */
    021
    022import org.apache.commons.lang.StringUtils;
    023import org.apache.commons.logging.Log;
    024import org.apache.commons.logging.LogFactory;
    025import org.apache.turbine.Turbine;
    026import org.apache.turbine.TurbineConstants;
    027import org.apache.turbine.annotation.TurbineConfiguration;
    028import org.apache.turbine.om.security.User;
    029import org.apache.turbine.pipeline.PipelineData;
    030import org.apache.turbine.util.RunData;
    031
    032/**
    033 * The SessionValidator attempts to retrieve the User object from the
    034 * Servlet API session that is associated with the request.  If the
    035 * data cannot be retrieved, it is handled here.  If the user has not
    036 * been marked as being logged into the system, the user is rejected
    037 * and the screen is set to the screen.homepage value in
    038 * TurbineResources.properties.
    039 *
    040 * <p>
    041 *
    042 * Other systems generally have a database table which stores this
    043 * information, but we take advantage of the Servlet API here to save
    044 * a hit to the database for each and every connection that a user
    045 * makes.
    046 *
    047 * <p>
    048 *
    049 * This action is special in that it should only be executed by the
    050 * Turbine servlet.
    051 *
    052 * @author <a href="mailto:mbryson@mont.mindspring.com">Dave Bryson</a>
    053 * @author <a href="mailto:hps@intermeta.de">Henning P. Schmiedehausen</a>
    054 * @author <a href="mailto:peter@courcoux.biz">Peter Courcoux</a>
    055 * @version $Id: DefaultSessionValidator.java 1812601 2017-10-19 06:40:28Z gk $
    056 */
    057public class DefaultSessionValidator
    058    extends SessionValidator
    059{
    060    /** Logging */
    061    private static Log log = LogFactory.getLog(DefaultSessionValidator.class);
    062
    063    @TurbineConfiguration( TurbineConstants.LOGIN_MESSAGE )
    064    private String loginMessage;
    065
    066    @TurbineConfiguration( TurbineConstants.SCREEN_LOGIN )
    067    private String screenLogin;
    068
    069    @TurbineConfiguration( TurbineConstants.LOGIN_MESSAGE_NOSCREEN )
    070    private String loginMessageNoScreen;
    071
    072
    073    /**
    074     * Execute the action.  The default is to populate the PipelineData
    075     * object and, if the user is unknown, to force a login screen (as
    076     * set in the tr.props).
    077     *
    078     * @see org.apache.turbine.modules.screens.error.InvalidState
    079     * @param pipelineData Turbine PipelineData context information.
    080     * @throws Exception The anonymous user could not be obtained
    081     *         from the security service
    082     */
    083    @Override
    084    public void doPerform(PipelineData pipelineData)
    085            throws Exception
    086    {
    087        RunData data = getRunData(pipelineData);
    088        // Pull user from session.
    089        data.populate();
    090
    091        // The user may have not logged in, so create a "guest/anonymous" user.
    092        if (data.getUser() == null)
    093        {
    094            log.debug("Fixing up empty User Object!");
    095            User anonymousUser = security.getAnonymousUser();
    096            data.setUser(anonymousUser);
    097            data.save();
    098        }
    099
    100        // Make sure the User has logged into the system.
    101        if (!data.getUser().hasLoggedIn())
    102        {
    103            // only set the message if nothing else has already set it
    104            // (e.g. the LogoutUser action).
    105            if (StringUtils.isEmpty(data.getMessage()))
    106            {
    107                data.setMessage(loginMessage);
    108            }
    109
    110            // set the screen to be the login page
    111            data.setScreen(screenLogin);
    112
    113            // We're not doing any actions buddy! (except action.login which
    114            // will have been performed already)
    115            data.setAction(null);
    116        }
    117
    118        if (!data.hasScreen())
    119        {
    120            data.setMessage(loginMessageNoScreen);
    121            data.setScreen(screenHomepage);
    122        }
    123
    124        handleFormCounterToken(data,true);
    125
    126        // Comply with Turbine 4.0 standards
    127        pipelineData.get(Turbine.class).put(User.class, data.getUser());
    128    }
    129}