You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@shiro.apache.org by lh...@apache.org on 2011/07/02 21:52:26 UTC
svn commit: r1142285 - in /shiro/trunk: ./
web/src/main/java/org/apache/shiro/web/filter/mgt/
web/src/main/java/org/apache/shiro/web/mgt/
web/src/main/java/org/apache/shiro/web/servlet/
web/src/main/java/org/apache/shiro/web/subject/support/ web/src/ma...
Author: lhazlewood
Date: Sat Jul 2 19:52:25 2011
New Revision: 1142285
URL: http://svn.apache.org/viewvc?rev=1142285&view=rev
Log:
SHIRO-266:
- Ensured that direct calls to the HttpServletRequest will honor 'noSessionCreation' filter settings as well (i.e. httpServletRequest.getSession() or httpServletRequest.getSession(true)).
- Added noSessionCreation checks to WebUtils, but with big warnings (and prefixing with an underscore) to indicate it is not intended to be used by Shiro end users.
- Changed NoSessionCreationFilter alias in the DefaultFilter enum to be 'noSessionCreation' instead of 'noSession'. It is more verbose but more accurate - it doesn't disable all session usage, just creating them (i.e. another part of the app may create a session that can still be used).
- Updated the gmaven plugin and actually enabled it for Maven builds (Groovy-based test cases were not being run from the command line - only in the IDE. Now they run via command line builds as expected).
Modified:
shiro/trunk/pom.xml
shiro/trunk/web/src/main/java/org/apache/shiro/web/filter/mgt/DefaultFilter.java
shiro/trunk/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluator.java
shiro/trunk/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java
shiro/trunk/web/src/main/java/org/apache/shiro/web/subject/support/WebDelegatingSubject.java
shiro/trunk/web/src/main/java/org/apache/shiro/web/util/WebUtils.java
shiro/trunk/web/src/test/groovy/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluatorTest.groovy
Modified: shiro/trunk/pom.xml
URL: http://svn.apache.org/viewvc/shiro/trunk/pom.xml?rev=1142285&r1=1142284&r2=1142285&view=diff
==============================================================================
--- shiro/trunk/pom.xml (original)
+++ shiro/trunk/pom.xml Sat Jul 2 19:52:25 2011
@@ -88,6 +88,7 @@
<!-- Test 3rd-party dependencies: -->
<easymock.version>3.0</easymock.version>
+ <gmaven.version>1.3</gmaven.version>
<groovy.version>1.7.8</groovy.version>
<junit.version>4.8.2</junit.version>
@@ -223,7 +224,7 @@
<plugin>
<groupId>org.codehaus.gmaven</groupId>
<artifactId>gmaven-plugin</artifactId>
- <version>1.2</version>
+ <version>${gmaven.version}</version>
<configuration>
<providerSelection>1.7</providerSelection>
<source>src/main/groovy</source>
@@ -232,7 +233,7 @@
<dependency>
<groupId>org.codehaus.gmaven.runtime</groupId>
<artifactId>gmaven-runtime-1.7</artifactId>
- <version>1.2</version>
+ <version>${gmaven.version}</version>
<exclusions>
<exclusion>
<groupId>org.codehaus.groovy</groupId>
@@ -334,6 +335,20 @@
<encoding>${project.build.sourceEncoding}</encoding>
</configuration>
</plugin>
+ <!-- Allow Groovy tests to run: -->
+ <plugin>
+ <groupId>org.codehaus.gmaven</groupId>
+ <artifactId>gmaven-plugin</artifactId>
+ <version>${gmaven.version}</version>
+ <executions>
+ <execution>
+ <goals>
+ <goal>compile</goal>
+ <goal>testCompile</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
<plugin>
<!-- Add SVN Revision To A JAR Manifest
- http://maven.apache.org/plugin-developers/cookbook/add-svn-revision-to-manifest.html
Modified: shiro/trunk/web/src/main/java/org/apache/shiro/web/filter/mgt/DefaultFilter.java
URL: http://svn.apache.org/viewvc/shiro/trunk/web/src/main/java/org/apache/shiro/web/filter/mgt/DefaultFilter.java?rev=1142285&r1=1142284&r2=1142285&view=diff
==============================================================================
--- shiro/trunk/web/src/main/java/org/apache/shiro/web/filter/mgt/DefaultFilter.java (original)
+++ shiro/trunk/web/src/main/java/org/apache/shiro/web/filter/mgt/DefaultFilter.java Sat Jul 2 19:52:25 2011
@@ -41,7 +41,7 @@ public enum DefaultFilter {
authc(FormAuthenticationFilter.class),
authcBasic(BasicHttpAuthenticationFilter.class),
logout(LogoutFilter.class),
- noSession(NoSessionCreationFilter.class),
+ noSessionCreation(NoSessionCreationFilter.class),
perms(PermissionsAuthorizationFilter.class),
port(PortFilter.class),
rest(HttpMethodPermissionFilter.class),
Modified: shiro/trunk/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluator.java
URL: http://svn.apache.org/viewvc/shiro/trunk/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluator.java?rev=1142285&r1=1142284&r2=1142285&view=diff
==============================================================================
--- shiro/trunk/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluator.java (original)
+++ shiro/trunk/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluator.java Sat Jul 2 19:52:25 2011
@@ -20,18 +20,15 @@ package org.apache.shiro.web.mgt;
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
import org.apache.shiro.subject.Subject;
-import org.apache.shiro.subject.support.DefaultSubjectContext;
import org.apache.shiro.web.util.WebUtils;
-import javax.servlet.ServletRequest;
-
/**
* A web-specific {@code SessionStorageEvaluator} that performs the same logic as the parent class
* {@link DefaultSessionStorageEvaluator} but additionally checks for a request-specific flag that may enable or
* disable session access.
* <p/>
* This implementation usually works in conjunction with the
- * {@link org.apache.shiro.web.filter.session.NoSessionCreationFilter NoSessionFilter}: If the {@code NoSessionFilter}
+ * {@link org.apache.shiro.web.filter.session.NoSessionCreationFilter}: If the {@code NoSessionCreationFilter}
* is configured in a filter chain, that filter will set a specific
* {@code ServletRequest} {@link javax.servlet.ServletRequest#setAttribute attribute} indicating that session creation
* should be disabled.
@@ -41,8 +38,8 @@ import javax.servlet.ServletRequest;
* Shiro from creating a session for the purpose of storing subject state.
* <p/>
* If the request attribute has
- * not been set (i.e. the {@code NoSessionFilter} is not configured or has been disabled), this class does nothing
- * and delegates to the parent class for existing behavior.
+ * not been set (i.e. the {@code NoSessionCreationFilter} is not configured or has been disabled), this class does
+ * nothing and delegates to the parent class for existing behavior.
*
* @since 1.2
*/
@@ -61,6 +58,7 @@ public class DefaultWebSessionStorageEva
* configuration property {@link #isSessionStorageEnabled()} and no request-specific override has turned off
* session storage, {@code false} otherwise.
*/
+ @SuppressWarnings({"SimplifiableIfStatement"})
@Override
public boolean isSessionStorageEnabled(Subject subject) {
if (subject.getSession(false) != null) {
@@ -73,18 +71,7 @@ public class DefaultWebSessionStorageEva
return false;
}
- //at this point there is no session yet, but general session storage is allowed. Let's check to see if there
- //is a request-specific override just in case:
- if (WebUtils.isWeb(subject)) {
- ServletRequest request = WebUtils.getRequest(subject);
- Object val = request.getAttribute(DefaultSubjectContext.SESSION_CREATION_ENABLED);
- if (val != null && val instanceof Boolean) {
- return (Boolean)val;
- }
- }
-
- //generally available and no request-specific override:
- return true;
+ return WebUtils._isSessionCreationEnabled(subject);
}
Modified: shiro/trunk/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java
URL: http://svn.apache.org/viewvc/shiro/trunk/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java?rev=1142285&r1=1142284&r2=1142285&view=diff
==============================================================================
--- shiro/trunk/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java (original)
+++ shiro/trunk/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java Sat Jul 2 19:52:25 2011
@@ -21,6 +21,8 @@ package org.apache.shiro.web.servlet;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
+import org.apache.shiro.subject.support.DisabledSessionException;
+import org.apache.shiro.web.util.WebUtils;
import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
@@ -138,15 +140,23 @@ public class ShiroHttpServletRequest ext
HttpSession httpSession;
if (isHttpSessions()) {
- httpSession = super.getSession(create);
+ httpSession = super.getSession(false);
+ if (httpSession == null && create) {
+ //Shiro 1.2: assert that creation is enabled (SHIRO-266):
+ if (WebUtils._isSessionCreationEnabled(this)) {
+ httpSession = super.getSession(create);
+ } else {
+ throw newNoSessionCreationException();
+ }
+ }
} else {
if (this.session == null) {
boolean existing = getSubject().getSession(false) != null;
- Session jsecSession = getSubject().getSession(create);
- if (jsecSession != null) {
- this.session = new ShiroHttpSession(jsecSession, this, this.servletContext);
+ Session shiroSession = getSubject().getSession(create);
+ if (shiroSession != null) {
+ this.session = new ShiroHttpSession(shiroSession, this, this.servletContext);
if (!existing) {
setAttribute(REFERENCED_SESSION_IS_NEW, Boolean.TRUE);
}
@@ -158,6 +168,21 @@ public class ShiroHttpServletRequest ext
return httpSession;
}
+ /**
+ * Constructs and returns a {@link DisabledSessionException} with an appropriate message explaining why
+ * session creation has been disabled.
+ *
+ * @return a new DisabledSessionException with appropriate no creation message
+ * @since 1.2
+ */
+ private DisabledSessionException newNoSessionCreationException() {
+ String msg = "Session creation has been disabled for the current request. This exception indicates " +
+ "that there is either a programming error (using a session when it should never be " +
+ "used) or that Shiro's configuration needs to be adjusted to allow Sessions to be created " +
+ "for the current request. See the " + DisabledSessionException.class.getName() + " JavaDoc " +
+ "for more.";
+ return new DisabledSessionException(msg);
+ }
public HttpSession getSession() {
return getSession(true);
Modified: shiro/trunk/web/src/main/java/org/apache/shiro/web/subject/support/WebDelegatingSubject.java
URL: http://svn.apache.org/viewvc/shiro/trunk/web/src/main/java/org/apache/shiro/web/subject/support/WebDelegatingSubject.java?rev=1142285&r1=1142284&r2=1142285&view=diff
==============================================================================
--- shiro/trunk/web/src/main/java/org/apache/shiro/web/subject/support/WebDelegatingSubject.java (original)
+++ shiro/trunk/web/src/main/java/org/apache/shiro/web/subject/support/WebDelegatingSubject.java Sat Jul 2 19:52:25 2011
@@ -22,12 +22,12 @@ import org.apache.shiro.mgt.SecurityMana
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.SessionContext;
import org.apache.shiro.subject.PrincipalCollection;
-import org.apache.shiro.subject.support.DefaultSubjectContext;
import org.apache.shiro.subject.support.DelegatingSubject;
import org.apache.shiro.util.StringUtils;
import org.apache.shiro.web.session.mgt.DefaultWebSessionContext;
import org.apache.shiro.web.session.mgt.WebSessionContext;
import org.apache.shiro.web.subject.WebSubject;
+import org.apache.shiro.web.util.WebUtils;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
@@ -86,18 +86,7 @@ public class WebDelegatingSubject extend
@Override
protected boolean isSessionCreationEnabled() {
boolean enabled = super.isSessionCreationEnabled();
- if (!enabled) {
- return false;
- }
- ServletRequest request = getServletRequest();
- if (request != null) {
- Object val = request.getAttribute(DefaultSubjectContext.SESSION_CREATION_ENABLED);
- if (val != null && val instanceof Boolean) {
- return (Boolean) val;
- }
- }
-
- return true;
+ return enabled && WebUtils._isSessionCreationEnabled(this);
}
@Override
Modified: shiro/trunk/web/src/main/java/org/apache/shiro/web/util/WebUtils.java
URL: http://svn.apache.org/viewvc/shiro/trunk/web/src/main/java/org/apache/shiro/web/util/WebUtils.java?rev=1142285&r1=1142284&r2=1142285&view=diff
==============================================================================
--- shiro/trunk/web/src/main/java/org/apache/shiro/web/util/WebUtils.java (original)
+++ shiro/trunk/web/src/main/java/org/apache/shiro/web/util/WebUtils.java Sat Jul 2 19:52:25 2011
@@ -21,6 +21,7 @@ package org.apache.shiro.web.util;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
+import org.apache.shiro.subject.support.DefaultSubjectContext;
import org.apache.shiro.util.StringUtils;
import org.apache.shiro.web.env.EnvironmentLoader;
import org.apache.shiro.web.env.WebEnvironment;
@@ -93,7 +94,7 @@ public class WebUtils {
/**
* Return the path within the web application for the given request.
- * <p>Detects include request URL if called within a RequestDispatcher include.
+ * Detects include request URL if called within a RequestDispatcher include.
* <p/>
* For example, for a request to URL
* <p/>
@@ -436,6 +437,47 @@ public class WebUtils {
}
/**
+ * Returns {@code true} if a session is allowed to be created for a subject-associated request, {@code false}
+ * otherwise.
+ * <p/>
+ * <b>This method exists for Shiro's internal framework needs and should never be called by Shiro end-users. It
+ * could be changed/removed at any time.</b>
+ *
+ * @param requestPairSource a {@link RequestPairSource} instance, almost always a
+ * {@link org.apache.shiro.web.subject.WebSubject WebSubject} instance.
+ * @return {@code true} if a session is allowed to be created for a subject-associated request, {@code false}
+ * otherwise.
+ */
+ public static boolean _isSessionCreationEnabled(Object requestPairSource) {
+ if (requestPairSource instanceof RequestPairSource) {
+ RequestPairSource source = (RequestPairSource) requestPairSource;
+ return _isSessionCreationEnabled(source.getServletRequest());
+ }
+ return true; //by default
+ }
+
+ /**
+ * Returns {@code true} if a session is allowed to be created for a subject-associated request, {@code false}
+ * otherwise.
+ * <p/>
+ * <b>This method exists for Shiro's internal framework needs and should never be called by Shiro end-users. It
+ * could be changed/removed at any time.</b>
+ *
+ * @param request incoming servlet request.
+ * @return {@code true} if a session is allowed to be created for a subject-associated request, {@code false}
+ * otherwise.
+ */
+ public static boolean _isSessionCreationEnabled(ServletRequest request) {
+ if (request != null) {
+ Object val = request.getAttribute(DefaultSubjectContext.SESSION_CREATION_ENABLED);
+ if (val != null && val instanceof Boolean) {
+ return (Boolean) val;
+ }
+ }
+ return true; //by default
+ }
+
+ /**
* A convenience method that merely casts the incoming <code>ServletRequest</code> to an
* <code>HttpServletRequest</code>:
* <p/>
Modified: shiro/trunk/web/src/test/groovy/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluatorTest.groovy
URL: http://svn.apache.org/viewvc/shiro/trunk/web/src/test/groovy/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluatorTest.groovy?rev=1142285&r1=1142284&r2=1142285&view=diff
==============================================================================
--- shiro/trunk/web/src/test/groovy/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluatorTest.groovy (original)
+++ shiro/trunk/web/src/test/groovy/org/apache/shiro/web/mgt/DefaultWebSessionStorageEvaluatorTest.groovy Sat Jul 2 19:52:25 2011
@@ -91,8 +91,6 @@ class DefaultWebSessionStorageEvaluatorT
expect(subject.getSession(false)).andReturn null
expect(subject.getServletRequest()).andReturn request
- expect(subject.getServletResponse()).andReturn response
- expect(subject.getServletRequest()).andReturn request
expect(request.getAttribute(eq(DefaultSubjectContext.SESSION_CREATION_ENABLED))).andReturn null
replay subject, request, response
@@ -112,8 +110,6 @@ class DefaultWebSessionStorageEvaluatorT
expect(subject.getSession(false)).andReturn null
expect(subject.getServletRequest()).andReturn request
- expect(subject.getServletResponse()).andReturn response
- expect(subject.getServletRequest()).andReturn request
expect(request.getAttribute(eq(DefaultSubjectContext.SESSION_CREATION_ENABLED))).andReturn Boolean.FALSE
replay subject, request, response
@@ -133,8 +129,6 @@ class DefaultWebSessionStorageEvaluatorT
expect(subject.getSession(false)).andReturn null
expect(subject.getServletRequest()).andReturn request
- expect(subject.getServletResponse()).andReturn response
- expect(subject.getServletRequest()).andReturn request
expect(request.getAttribute(eq(DefaultSubjectContext.SESSION_CREATION_ENABLED))).andReturn new Object()
replay subject, request, response