File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\security\HttpSessionContextIntegrationFilter2.java.html

1 /*
2 * The MIT License
3 *
4 * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 package hudson.security;
25
26 import org.acegisecurity.context.HttpSessionContextIntegrationFilter;
27 import org.acegisecurity.context.SecurityContext;
28 import org.acegisecurity.Authentication;
29
30 import javax.servlet.ServletException;
31 import javax.servlet.ServletRequest;
32 import javax.servlet.ServletResponse;
33 import javax.servlet.FilterChain;
34 import javax.servlet.http.HttpServletRequest;
35 import javax.servlet.http.HttpSession;
36 import java.io.IOException;
37
38 /**
39 * Erases the {@link SecurityContext} persisted in {@link HttpSession}
40 * if {@link InvalidatableUserDetails#isInvalid()} returns true.
41 *
42 * @see InvalidatableUserDetails
43 */
44 public class HttpSessionContextIntegrationFilter2 extends HttpSessionContextIntegrationFilter {
45 public HttpSessionContextIntegrationFilter2() throws ServletException {
46 setContext(NotSerilizableSecurityContext.class);
47 }
48
49 public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
50 HttpSession session = ((HttpServletRequest) req).getSession(false);
51 if(session!=null) {
52 SecurityContext o = (SecurityContext)session.getAttribute(ACEGI_SECURITY_CONTEXT_KEY);
53 if(o!=null) {
54 Authentication a = o.getAuthentication();
55 if(a!=null) {
56 if (a.getPrincipal() instanceof InvalidatableUserDetails) {
57 InvalidatableUserDetails ud = (InvalidatableUserDetails) a.getPrincipal();
58 if(ud.isInvalid())
59 // don't let Acegi see invalid security context
60 session.setAttribute(ACEGI_SECURITY_CONTEXT_KEY,null);
61 }
62 }
63 }
64 }
65
66 super.doFilter(req, res, chain);
67 }
68 }
69