File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\security\HudsonAuthenticationEntryPoint.java.html

1 /*
2 * The MIT License
3 *
4 * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 package hudson.security;
25
26 import com.google.common.base.Strings;
27 import org.acegisecurity.AuthenticationException;
28 import org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint;
29
30 import javax.servlet.ServletException;
31 import javax.servlet.ServletOutputStream;
32 import javax.servlet.ServletRequest;
33 import javax.servlet.ServletResponse;
34 import javax.servlet.http.HttpServletRequest;
35 import javax.servlet.http.HttpServletResponse;
36 import static javax.servlet.http.HttpServletResponse.SC_FORBIDDEN;
37
38 import java.io.FilterOutputStream;
39 import java.io.IOException;
40 import java.io.OutputStream;
41 import java.io.OutputStreamWriter;
42 import java.io.PrintWriter;
43 import java.net.URLEncoder;
44 import java.text.MessageFormat;
45 import java.util.zip.GZIPOutputStream;
46
47 /**
48 * For anonymous requests to pages that require authentication,
49 * first respond with {@link HttpServletResponse#SC_FORBIDDEN},
50 * then redirect browsers automatically to the login page.
51 *
52 * <p>
53 * This is a compromise to handle programmatic access and
54 * real browsers equally well.
55 *
56 * <p>
57 * The page that programs see is entirely white, and it auto-redirects,
58 * so humans wouldn't notice it.
59 *
60 * @author Kohsuke Kawaguchi
61 */
62 public class HudsonAuthenticationEntryPoint extends AuthenticationProcessingFilterEntryPoint {
63 @Override
64 public void commence(ServletRequest request, ServletResponse response, AuthenticationException authException) throws IOException, ServletException {
65 HttpServletRequest req = (HttpServletRequest) request;
66 HttpServletResponse rsp = (HttpServletResponse) response;
67
68 String requestedWith = req.getHeader("X-Requested-With");
69 if("XMLHttpRequest".equals(requestedWith)) {
70 // container authentication normally relies on session attribute to
71 // remember where the user came from, so concurrent AJAX requests
72 // often ends up sending users back to AJAX pages after successful login.
73 // this is not desirable, so don't redirect AJAX requests to the user.
74 // this header value is sent from Prototype.
75 rsp.sendError(SC_FORBIDDEN);
76 } else {
77 // give the opportunity to include the target URL
78 String uriFrom = req.getRequestURI();
79 if(!Strings.isNullOrEmpty(req.getQueryString())) uriFrom += "?" + req.getQueryString();
80 String loginForm = req.getContextPath()+getLoginFormUrl();
81 loginForm = MessageFormat.format(loginForm, URLEncoder.encode(uriFrom,"UTF-8"));
82 req.setAttribute("loginForm", loginForm);
83
84 rsp.setStatus(SC_FORBIDDEN);
85 rsp.setContentType("text/html;charset=UTF-8");
86 PrintWriter out;
87 try {
88 out = new PrintWriter(new OutputStreamWriter(rsp.getOutputStream()));
89 } catch (IllegalStateException e) {
90 out = rsp.getWriter();
91 }
92 out.printf(
93 "<html><head>" +
94 "<meta http-equiv='refresh' content='1;url=%1$s'/>" +
95 "<script>window.location.replace('%1$s');</script>" +
96 "</head>" +
97 "<body style='background-color:white; color:white;'>" +
98 "Authentication required</body></html>", loginForm
99 );
100 // Turn Off "Show Friendly HTTP Error Messages" Feature on the Server Side.
101 // See http://support.microsoft.com/kb/294807
102 for (int i=0; i < 10; i++)
103 out.print(" ");
104 out.close();
105 }
106 }
107 }
108