You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by "Poggenpohl, Daniel" <Da...@isst.fraunhofer.de> on 2015/08/04 11:15:08 UTC

Working with JPA - Page Requests - Checking if object with id exists - Redirecting if false

Hello everyone,

as the subject describes, we are trying to decide when to redirect the user to the error page.

Tapestry reads the context from the url. As it may happen, a (malicious or not) user can decide to try out IDs with a URL. When in the page request process should I look in the database, check if the object exists, and redirect to an error page if necessary?

Regards,
Daniel P.

Re: Working with JPA - Page Requests - Checking if object with id exists - Redirecting if false

Posted by Geoff Callender <ge...@gmail.com>.
Have you read this?

	http://jumpstart.doublenegative.com.au/jumpstart7/examples/infrastructure/handlingabadcontext/1

My personal preference is to treat ids that don’t exist, and ids that you are not authorised to, the same way: display a "does not exist” message on the same page. It will be detected in setupRender() or, if there’s a Form, in onPrepareForRender(). To keep it simple and consistent you can create an ExistenceChecker component that you use like this:

<t:form t:id="form" context=“personId" validate="this">
	<t:existencechecker exists=“person" name="message:Person-name">
		:
	</t:existencechecker>
</t:form>

ExistenceChecker could start like this:

public class ExistenceChecker {

	/**
	 * Usually set by testing the entity of interest, eg. exists=“person” 
	 * (which will be true if client is not null); or
	 * the entity list of interest, eg. exists="evaluations” 
	 * (which will be true if the list is not null and not empty).
	 */
	@Parameter(required = true)
	@Property
	private boolean exists;

	/**
	 * This name will be displayed to the user, substituted into the "object-doesnotexist" message.
	 */
	@Parameter(required = true)
	private String name;

Here’s my ExistenceChecker.tml:

<!DOCTYPE html>
<html xmlns:t="http://tapestry.apache.org/schema/tapestry_5_4.xsd" xmlns:p="tapestry:parameter">

<t:content>

	<t:if test="exists">
		<t:body />
	</t:if>
	<t:if test="!exists">
		<div class="alert ${alertClass} text-center">${doesNotExistMessage}</div>
	</t:if>
	
</t:content>

</html>

HTH,

Geoff


> On 4 Aug 2015, at 7:15 pm, Poggenpohl, Daniel <Da...@isst.fraunhofer.de> wrote:
> 
> Hello everyone,
> 
> as the subject describes, we are trying to decide when to redirect the user to the error page.
> 
> Tapestry reads the context from the url. As it may happen, a (malicious or not) user can decide to try out IDs with a URL. When in the page request process should I look in the database, check if the object exists, and redirect to an error page if necessary?
> 
> Regards,
> Daniel P.

Re: Working with JPA - Page Requests - Checking if object with id exists - Redirecting if false

Posted by Thiago H de Paula Figueiredo <th...@gmail.com>.
On Tue, 04 Aug 2015 09:07:45 -0300, Geoff Callender  
<ge...@gmail.com> wrote:

> On the minus side, it gets called more than you might expect:
>
> 	http://jumpstart.doublenegative.com.au/jumpstart7/examples/navigation/onactivateandonpassivate/3  
> <http://jumpstart.doublenegative.com.au/jumpstart7/examples/navigation/onactivateandonpassivate/3>

Yep, but if you don't do it on onActivate(), you may miss security checks  
for event handlers, just checking page render requets. :)

-- 
Thiago H. de Paula Figueiredo
Tapestry, Java and Hibernate consultant and developer
http://machina.com.br

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org

Re: Working with JPA - Page Requests - Checking if object with id exists - Redirecting if false

Posted by Geoff Callender <ge...@gmail.com>.
Just be aware that there are pluses and minuses to doing it in onActivate(). On the plus side, onActivate() is an event handler, so it can control what’s displayed next by its return type. The return type could even be new HttpError(404, "Page not found");

	http://jumpstart.doublenegative.com.au/jumpstart7/examples/navigation/returntypes1 <http://jumpstart.doublenegative.com.au/jumpstart7/examples/navigation/returntypes1>

On the minus side, it gets called more than you might expect:

	http://jumpstart.doublenegative.com.au/jumpstart7/examples/navigation/onactivateandonpassivate/3 <http://jumpstart.doublenegative.com.au/jumpstart7/examples/navigation/onactivateandonpassivate/3>

Geoff

> On 4 Aug 2015, at 9:51 pm, Thiago H de Paula Figueiredo <th...@gmail.com> wrote:
> 
> On Tue, 04 Aug 2015 06:15:08 -0300, Poggenpohl, Daniel <Da...@isst.fraunhofer.de> wrote:
> 
>> Hello everyone,
>> 
>> as the subject describes, we are trying to decide when to redirect the user to the error page.
>> 
>> Tapestry reads the context from the url. As it may happen, a (malicious or not) user can decide to try out IDs with a URL. When in the page request process should I look in the database, check if the object exists, and redirect to an error page if necessary?
> 
> onActivate() and return a non-null (and non-"this") value to tell Tapestry to do a redirection. See also http://tapestry.apache.org/page-navigation.html.
> 
> -- 
> Thiago H. de Paula Figueiredo
> Tapestry, Java and Hibernate consultant and developer
> http://machina.com.br
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>

Re: Working with JPA - Page Requests - Checking if object with id exists - Redirecting if false

Posted by Thiago H de Paula Figueiredo <th...@gmail.com>.
On Tue, 04 Aug 2015 06:15:08 -0300, Poggenpohl, Daniel  
<Da...@isst.fraunhofer.de> wrote:

> Hello everyone,
>
> as the subject describes, we are trying to decide when to redirect the  
> user to the error page.
>
> Tapestry reads the context from the url. As it may happen, a (malicious  
> or not) user can decide to try out IDs with a URL. When in the page  
> request process should I look in the database, check if the object  
> exists, and redirect to an error page if necessary?

onActivate() and return a non-null (and non-"this") value to tell Tapestry  
to do a redirection. See also  
http://tapestry.apache.org/page-navigation.html.

-- 
Thiago H. de Paula Figueiredo
Tapestry, Java and Hibernate consultant and developer
http://machina.com.br

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org

Re: Working with JPA - Page Requests - Checking if object with id exists - Redirecting if false

Posted by Barry Books <tr...@gmail.com>.
Generally I like solutions that don't require the page class to do anything
special so I wrote a request filter and a strategy service to do this. The
filter looks for @PageActivationContext and if there is one calls the
strategy service to see if the user has access to the object. This way all
pages/events are covered and the strategy service can handle different
permissions by object type.

On Tuesday, August 4, 2015, Poggenpohl, Daniel <
Daniel.Poggenpohl@isst.fraunhofer.de> wrote:

> Hello everyone,
>
> as the subject describes, we are trying to decide when to redirect the
> user to the error page.
>
> Tapestry reads the context from the url. As it may happen, a (malicious or
> not) user can decide to try out IDs with a URL. When in the page request
> process should I look in the database, check if the object exists, and
> redirect to an error page if necessary?
>
> Regards,
> Daniel P.
>