You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by as...@apache.org on 2015/09/01 11:21:11 UTC
svn commit: r1700435 - in /sling/trunk/contrib/extensions/security/src:
main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
Author: asanso
Date: Tue Sep 1 09:21:11 2015
New Revision: 1700435
URL: http://svn.apache.org/r1700435
Log:
SLING-4983 - Limit the Content Disposition Filter to GET operations
Modified:
sling/trunk/contrib/extensions/security/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
sling/trunk/contrib/extensions/security/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
Modified: sling/trunk/contrib/extensions/security/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java
URL: http://svn.apache.org/viewvc/sling/trunk/contrib/extensions/security/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java?rev=1700435&r1=1700434&r2=1700435&view=diff
==============================================================================
--- sling/trunk/contrib/extensions/security/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java (original)
+++ sling/trunk/contrib/extensions/security/src/main/java/org/apache/sling/security/impl/ContentDispositionFilter.java Tue Sep 1 09:21:11 2015
@@ -221,47 +221,49 @@ public class ContentDispositionFilter im
* @see javax.servlet.ServletResponseWrapper#setContentType(java.lang.String)
*/
public void setContentType(String type) {
- String previousContentType = (String) request.getAttribute(ATTRIBUTE_NAME);
-
- if (previousContentType != null && previousContentType.equals(type)) {
- return;
- }
- request.setAttribute(ATTRIBUTE_NAME, type);
- Resource resource = request.getResource();
- String resourcePath = resource.getPath();
-
- if (!contentDispositionExcludedPaths.contains(resourcePath)) {
-
- if (enableContentDispositionAllPaths) {
- setContentDisposition(resource);
- } else {
-
- boolean contentDispositionAdded = false;
- if (contentDispositionPaths.contains(resourcePath)) {
-
- if (contentTypesMapping.containsKey(resourcePath)) {
- Set <String> exceptions = contentTypesMapping.get(resourcePath);
- if (!exceptions.contains(type)) {
+ if ("GET".equals(request.getMethod())) {
+ String previousContentType = (String) request.getAttribute(ATTRIBUTE_NAME);
+
+ if (previousContentType != null && previousContentType.equals(type)) {
+ return;
+ }
+ request.setAttribute(ATTRIBUTE_NAME, type);
+ Resource resource = request.getResource();
+ String resourcePath = resource.getPath();
+
+ if (!contentDispositionExcludedPaths.contains(resourcePath)) {
+
+ if (enableContentDispositionAllPaths) {
+ setContentDisposition(resource);
+ } else {
+
+ boolean contentDispositionAdded = false;
+ if (contentDispositionPaths.contains(resourcePath)) {
+
+ if (contentTypesMapping.containsKey(resourcePath)) {
+ Set <String> exceptions = contentTypesMapping.get(resourcePath);
+ if (!exceptions.contains(type)) {
+ contentDispositionAdded = setContentDisposition(resource);
+ }
+ } else {
contentDispositionAdded = setContentDisposition(resource);
}
- } else {
- contentDispositionAdded = setContentDisposition(resource);
- }
- }
- if (!contentDispositionAdded) {
- for (String path : contentDispositionPathsPfx) {
- if (resourcePath.startsWith(path)) {
- if (contentTypesMapping.containsKey(path)) {
- Set <String> exceptions = contentTypesMapping.get(path);
- if (!exceptions.contains(type)) {
+ }
+ if (!contentDispositionAdded) {
+ for (String path : contentDispositionPathsPfx) {
+ if (resourcePath.startsWith(path)) {
+ if (contentTypesMapping.containsKey(path)) {
+ Set <String> exceptions = contentTypesMapping.get(path);
+ if (!exceptions.contains(type)) {
+ setContentDisposition(resource);
+ break;
+ }
+ } else {
setContentDisposition(resource);
break;
}
- } else {
- setContentDisposition(resource);
- break;
- }
+ }
}
}
}
@@ -283,23 +285,19 @@ public class ContentDispositionFilter im
private boolean isJcrData(Resource resource){
boolean jcrData = false;
- try {
- if (resource!= null) {
- ValueMap props = resource.adaptTo(ValueMap.class);
- if (props != null && props.containsKey(PROP_JCR_DATA) ) {
- jcrData = true;
- } else {
- Resource jcrContent = resource.getChild(JCR_CONTENT_LEAF);
- if (jcrContent!= null) {
- props = jcrContent.adaptTo(ValueMap.class);
- if (props != null && props.containsKey(PROP_JCR_DATA) ) {
- jcrData = true;
- }
+ if (resource!= null) {
+ ValueMap props = resource.adaptTo(ValueMap.class);
+ if (props != null && props.containsKey(PROP_JCR_DATA) ) {
+ jcrData = true;
+ } else {
+ Resource jcrContent = resource.getChild(JCR_CONTENT_LEAF);
+ if (jcrContent!= null) {
+ props = jcrContent.adaptTo(ValueMap.class);
+ if (props != null && props.containsKey(PROP_JCR_DATA) ) {
+ jcrData = true;
}
- }
- }
- } catch (Exception e) {
- logger.error("Exception in isJcrData", e);
+ }
+ }
}
return jcrData;
}
Modified: sling/trunk/contrib/extensions/security/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java
URL: http://svn.apache.org/viewvc/sling/trunk/contrib/extensions/security/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java?rev=1700435&r1=1700434&r2=1700435&view=diff
==============================================================================
--- sling/trunk/contrib/extensions/security/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java (original)
+++ sling/trunk/contrib/extensions/security/src/test/java/org/apache/sling/security/impl/ContentDispositionFilterTest.java Tue Sep 1 09:21:11 2015
@@ -280,6 +280,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -320,6 +322,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -366,6 +370,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -412,6 +418,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -458,6 +466,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -510,6 +520,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -556,6 +568,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -596,6 +610,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -635,6 +651,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -680,6 +698,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -726,6 +746,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -766,6 +788,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -805,6 +829,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
will(returnValue(null));
allowing(request).setAttribute(RewriterResponse.ATTRIBUTE_NAME, "text/html");
@@ -851,6 +877,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -907,6 +935,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
exactly(1).of(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -967,6 +997,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
exactly(1).of(response).containsHeader("Content-Disposition");
will(returnValue(false));
exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1029,6 +1061,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
exactly(1).of(response).containsHeader("Content-Disposition");
will(returnValue(false));
exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1090,6 +1124,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
exactly(1).of(response).containsHeader("Content-Disposition");
will(returnValue(false));
exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1150,6 +1186,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
exactly(1).of(response).containsHeader("Content-Disposition");
will(returnValue(false));
exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1210,6 +1248,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
exactly(1).of(response).containsHeader("Content-Disposition");
will(returnValue(false));
exactly(1).of(response).containsHeader("Content-Disposition");
@@ -1269,6 +1309,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);
@@ -1322,6 +1364,8 @@ public class ContentDispositionFilterTes
context.checking(new Expectations() {
{
+ allowing(request).getMethod();
+ will(returnValue("GET"));
allowing(response).containsHeader("Content-Disposition");
will(returnValue(false));
allowing(request).getAttribute(RewriterResponse.ATTRIBUTE_NAME);