Bug in Pluto PortletSessionImpl.getAttributeNames() ?

[Mike Burati <mb...@bowstreet.com>]

I haven't had time to figure out if I can get to the Pluto bugzilla yet and
just noticed this behavior, so I'm sorry in advance if this is already
logged...

PortletSessionImpl.java getAttributeNames() was fixed on 10/22 by blumm to
ensure that if scope==default, then only return attributes in portlet scope.

But, I think it's still broken in that it will return attribute names for
all portlet scoped attributes in the http session, not just for the portlet
making the call.

PortletSessionImpl.getAttribute(String key, DEFAULT_SCOPE) takes into
account the portlet ID before returning a portlet scoped session, but
PortletSessionImpl.getAttributeNames(DEFAULT_SCOPE) does not.

So, a portlet asks for a list of portlet scoped session attribute names, and
then does a getAttribute() on them and gets back null for any that belong to
other portlets.  This seems like a bug - I would expect getAttributeNames()
to only show me keys for attributes that I should be able to retrieve from
the session.

The following is the code from getAttribute that takes the portlet ID into
account:

            Object attribute =
httpSession.getAttribute("javax.portlet.p."+portletWindow.getId()+"?"+name);
            if (attribute == null)
            {
                // not sure, if this should be done for all attributes or
only javax.servlet.
                attribute = httpSession.getAttribute(name);
            }

(note the portletWindow.getID() call appended to the key used to do the
lookup)

Then in getAttributeNames(scope) it takes scope app vs default into account,
but not which portlet the attribute belongs to:

            while (attributes.hasMoreElements())
            {
                String attribute = (String)attributes.nextElement();

                int attributeScope =
PortletSessionUtil.decodeScope(attribute);
                
                if (attributeScope == PortletSession.PORTLET_SCOPE)
                {
                	String portletAttribute =
PortletSessionUtil.decodeAttributeName(attribute);
                	
                	if (portletAttribute!=null)
                	{ // it is in the portlet's namespace
                		portletAttributes.add(portletAttribute);
                	}
                }
           }