svn commit: r375489 - /myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java

[de...@apache.org]

Author: dennisbyrne
Date: Mon Feb  6 21:24:54 2006
New Revision: 375489

URL: http://svn.apache.org/viewcvs?rev=375489&view=rev
Log:
MYFACES-1008, reported by lantian 

Modified:
    myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java

Modified: myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java
URL: http://svn.apache.org/viewcvs/myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java?rev=375489&r1=375488&r2=375489&view=diff
==============================================================================
--- myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java (original)
+++ myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java Mon Feb  6 21:24:54 2006
@@ -27,6 +27,8 @@
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -98,6 +100,33 @@
             throws IOException,
                    ServletException
     {
+
+        HttpServletRequest httpRequest = ((HttpServletRequest) request);
+        String pathInfo = httpRequest.getPathInfo();
+
+        // if it is a prefix mapping ...
+        if (pathInfo != null
+                && (pathInfo.startsWith("/WEB-INF") || pathInfo
+                        .startsWith("/META-INF")))
+        {
+            StringBuffer buffer = new StringBuffer();
+
+            buffer.append(" Someone is trying to access a secure resource : "
+                    + pathInfo);
+            buffer.append("\n remote address is " + httpRequest.getRemoteAddr());
+            buffer.append("\n remote host is " + httpRequest.getRemoteHost());
+            buffer.append("\n remote user is " + httpRequest.getRemoteUser());
+            buffer.append("\n request URI is " + httpRequest.getRequestURI());
+
+            log.warn(buffer.toString());
+
+            // Why does RI return a 404 and not a 403, SC_FORBIDDEN ?
+            
+            ((HttpServletResponse) response)
+                    .sendError(HttpServletResponse.SC_NOT_FOUND);
+            return;
+        }
+
 		if(log.isTraceEnabled()) log.trace("service begin");
         FacesContext facesContext
                 = _facesContextFactory.getFacesContext(_servletConfig.getServletContext(),