    001// Copyright 2008-2013 The Apache Software Foundation
    002//
    003// Licensed under the Apache License, Version 2.0 (the "License");
    004// you may not use this file except in compliance with the License.
    005// You may obtain a copy of the License at
    006//
    007// http://www.apache.org/licenses/LICENSE-2.0
    008//
    009// Unless required by applicable law or agreed to in writing, software
    010// distributed under the License is distributed on an "AS IS" BASIS,
    011// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    012// See the License for the specific language governing permissions and
    013// limitations under the License.
    014
    015package org.apache.tapestry5.internal.services;
    016
    017import org.apache.tapestry5.Link;
    018import org.apache.tapestry5.LinkSecurity;
    019import org.apache.tapestry5.MetaDataConstants;
    020import org.apache.tapestry5.SymbolConstants;
    021import org.apache.tapestry5.ioc.annotations.Symbol;
    022import org.apache.tapestry5.services.*;
    023
    024import java.io.IOException;
    025
    026public class RequestSecurityManagerImpl implements RequestSecurityManager
    027{
    028    private final Request request;
    029
    030    private final Response response;
    031
    032    private final MetaDataLocator locator;
    033
    034    private final boolean securityEnabled;
    035
    036    private final ComponentEventLinkEncoder componentEventLinkEncoder;
    037
    038    public RequestSecurityManagerImpl(Request request, Response response,
    039                                      ComponentEventLinkEncoder componentEventLinkEncoder, MetaDataLocator locator, @Symbol(SymbolConstants.SECURE_ENABLED)
    040    boolean securityEnabled)
    041    {
    042        this.request = request;
    043        this.response = response;
    044        this.componentEventLinkEncoder = componentEventLinkEncoder;
    045        this.locator = locator;
    046        this.securityEnabled = securityEnabled;
    047    }
    048
    049    public boolean checkForInsecureComponentEventRequest(ComponentEventRequestParameters parameters) throws IOException
    050    {
    051        if (!needsRedirect(parameters.getActivePageName()))
    052        {
    053            return false;
    054        }
    055
    056        // Page is secure but request is not, so redirect.
    057        // We can safely ignore the forForm parameter since secure form requests are always done from
    058        // an already secured page
    059
    060        Link link = componentEventLinkEncoder.createComponentEventLink(parameters, false);
    061
    062        response.sendRedirect(link);
    063
    064        return true;
    065    }
    066
    067    public boolean checkForInsecurePageRenderRequest(PageRenderRequestParameters parameters) throws IOException
    068    {
    069        if (!needsRedirect(parameters.getLogicalPageName()))
    070            return false;
    071
    072        // Page is secure but request is not, so redirect.
    073
    074        Link link = componentEventLinkEncoder.createPageRenderLink(parameters);
    075
    076        response.sendRedirect(link);
    077
    078        return true;
    079    }
    080
    081    private boolean needsRedirect(String pageName)
    082    {
    083        if (!securityEnabled)
    084        {
    085            return false;
    086        }
    087
    088        // We don't (at this time) redirect from secure to insecure, just from insecure to secure.
    089
    090        if (request.isSecure())
    091        {
    092            return false;
    093        }
    094
    095        if (!isSecure(pageName))
    096        {
    097            return false;
    098        }
    099
    100        return true;
    101    }
    102
    103    private boolean isSecure(String pageName)
    104    {
    105        return locator.findMeta(MetaDataConstants.SECURE_PAGE, pageName, Boolean.class);
    106    }
    107
    108    public LinkSecurity checkPageSecurity(String pageName)
    109    {
    110        if (!securityEnabled)
    111        {
    112            return request.isSecure() ? LinkSecurity.SECURE : LinkSecurity.INSECURE;
    113        }
    114
    115        boolean securePage = isSecure(pageName);
    116
    117        if (request.isSecure() == securePage)
    118        {
    119            return securePage ? LinkSecurity.SECURE : LinkSecurity.INSECURE;
    120        }
    121
    122        // Return a value that will, ultimately, force an absolute URL.
    123
    124        return securePage ? LinkSecurity.FORCE_SECURE : LinkSecurity.FORCE_INSECURE;
    125    }
    126}