svn commit: r1530239 - in /myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago: portlet/PortletUtils.java webapp/Secret.java

[lo...@apache.org]

Author: lofwyr
Date: Tue Oct  8 11:43:06 2013
New Revision: 1530239

URL: http://svn.apache.org/r1530239
Log:
TOBAGO-1320: SessionSecret not compatible with portlets

Modified:
    myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/portlet/PortletUtils.java
    myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/webapp/Secret.java

Modified: myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/portlet/PortletUtils.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/portlet/PortletUtils.java?rev=1530239&r1=1530238&r2=1530239&view=diff
==============================================================================
--- myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/portlet/PortletUtils.java (original)
+++ myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/portlet/PortletUtils.java Tue Oct  8 11:43:06 2013
@@ -19,10 +19,13 @@
 
 package org.apache.myfaces.tobago.portlet;
 
+import org.apache.myfaces.tobago.webapp.Secret;
+
 import javax.faces.context.FacesContext;
 import javax.portlet.ActionRequest;
 import javax.portlet.PortletContext;
 import javax.portlet.PortletRequest;
+import javax.portlet.PortletSession;
 import javax.portlet.PortletURL;
 import javax.portlet.RenderResponse;
 import java.io.UnsupportedEncodingException;
@@ -100,4 +103,13 @@ public final class PortletUtils {
       request.setCharacterEncoding("UTF-8");
     }
   }
+
+  public static Secret getAttributeFromSessionForApplication(Object session, String name) {
+
+    if (PORTLET_API_AVAILABLE && session instanceof PortletSession) {
+      return (Secret) ((PortletSession) session).getAttribute(name, PortletSession.APPLICATION_SCOPE);
+    } else {
+      throw new IllegalArgumentException("Unknown session type: " + session.getClass().getName());
+    }
+  }
 }

Modified: myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/webapp/Secret.java
URL: http://svn.apache.org/viewvc/myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/webapp/Secret.java?rev=1530239&r1=1530238&r2=1530239&view=diff
==============================================================================
--- myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/webapp/Secret.java (original)
+++ myfaces/tobago/branches/tobago-1.0.x/core/src/main/java/org/apache/myfaces/tobago/webapp/Secret.java Tue Oct  8 11:43:06 2013
@@ -20,6 +20,7 @@
 package org.apache.myfaces.tobago.webapp;
 
 import org.apache.commons.codec.binary.Base64;
+import org.apache.myfaces.tobago.portlet.PortletUtils;
 import org.apache.myfaces.tobago.renderkit.html.HtmlAttributes;
 import org.apache.myfaces.tobago.renderkit.html.HtmlConstants;
 
@@ -75,24 +76,34 @@ public class Secret implements Serializa
    * Checks that the request contains a parameter {@link org.apache.myfaces.tobago.webapp.Secret#KEY}
    * which is equals to a secret value in the session.
    */
-  public static boolean check(FacesContext facesContext) {
-    Map requestParameterMap = facesContext.getExternalContext().getRequestParameterMap();
-    String fromRequest = (String) requestParameterMap.get(Secret.KEY);
-    Map sessionMap = facesContext.getExternalContext().getSessionMap();
-    Secret secret = (Secret) sessionMap.get(Secret.KEY);
+  public static boolean check(final FacesContext facesContext) {
+    final Map requestParameterMap = facesContext.getExternalContext().getRequestParameterMap();
+    final String fromRequest = (String) requestParameterMap.get(Secret.KEY);
+    final Object session = facesContext.getExternalContext().getSession(true);
+    final Secret secret;
+    if (session instanceof HttpSession) {
+      secret = (Secret) ((HttpSession) session).getAttribute(Secret.KEY);
+    } else {
+      secret = PortletUtils.getAttributeFromSessionForApplication(session, Secret.KEY);
+    }
     return secret != null && secret.secret.equals(fromRequest);
   }
 
   /**
    * Encode a hidden field with the secret value from the session.
    */
-  public static void encode(FacesContext facesContext, TobagoResponseWriter writer) throws IOException {
+  public static void encode(final FacesContext facesContext, final TobagoResponseWriter writer) throws IOException {
     writer.startElement(HtmlConstants.INPUT, null);
     writer.writeAttribute(HtmlAttributes.TYPE, "hidden", false);
     writer.writeAttribute(HtmlAttributes.NAME, Secret.KEY, false);
     writer.writeAttribute(HtmlAttributes.ID, Secret.KEY, false);
-    Map sessionMap = facesContext.getExternalContext().getSessionMap();
-    Secret secret = (Secret) sessionMap.get(Secret.class.getName());
+    final Object session = facesContext.getExternalContext().getSession(true);
+    final Secret secret;
+    if (session instanceof HttpSession) {
+      secret = (Secret) ((HttpSession) session).getAttribute(Secret.KEY);
+    } else {
+      secret = PortletUtils.getAttributeFromSessionForApplication(session, Secret.KEY);
+    }
     writer.writeAttribute(HtmlAttributes.VALUE, secret.secret, false);
     writer.endElement(HtmlConstants.INPUT);
   }