Package org.apache.tapestry5.internal.services

Class WhitelistOnlyPageFilter

java.lang.Object

org.apache.tapestry5.internal.services.WhitelistOnlyPageFilter

All Implemented Interfaces:

ComponentRequestFilter

public class WhitelistOnlyPageFilter
extends java.lang.Object
implements ComponentRequestFilter

Ensures that a component event request does not reach a page annotated with WhitelistAccessOnly from a client that is not on the whitelist. A component event request identifies two pages: the active page (from the URL path) and the containing page (from the InternalConstants.CONTAINER_PAGE_NAME request parameter), whose component actually handles the event. Code from both pages runs for the request, so both are checked here. ComponentEventLinkEncoderImpl performs the same check while decoding the request, and is the gate that normally rejects these requests. This filter repeats it independently, so that any other route to the component event pipeline is covered as well. Page render requests are passed through: they are checked while decoding, and the page render dispatcher does not honour the "component not found" attribute used here to force a 404.

Since:

5.9.2

See Also:

WhitelistAccessOnly, MetaDataConstants.WHITELIST_ONLY_PAGE

Constructor Summary

Constructors

Constructor	Description
WhitelistOnlyPageFilter(Request request, MetaDataLocator metaDataLocator, ClientWhitelist clientWhitelist)

Method Summary

Modifier and Type	Method	Description
void	handleComponentEvent(ComponentEventRequestParameters parameters, ComponentRequestHandler handler)	Handler for a component action request which will trigger an event on a component and use the return value to send a response to the client (typically, a redirect to a page render URL).
void	handlePageRender(PageRenderRequestParameters parameters, ComponentRequestHandler handler)	Invoked to activate and render a page.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

WhitelistOnlyPageFilter

public WhitelistOnlyPageFilter(Request request,
                               MetaDataLocator metaDataLocator,
                               ClientWhitelist clientWhitelist)

Method Detail

handleComponentEvent

public void handleComponentEvent(ComponentEventRequestParameters parameters,
                                 ComponentRequestHandler handler)
                          throws java.io.IOException

Description copied from interface: ComponentRequestFilter

Handler for a component action request which will trigger an event on a component and use the return value to send a response to the client (typically, a redirect to a page render URL).

Specified by:

handleComponentEvent in interface ComponentRequestFilter

Parameters:

parameters - defining the requst

handler - next handler in the pipeline

Throws:

java.io.IOException

handlePageRender

public void handlePageRender(PageRenderRequestParameters parameters,
                             ComponentRequestHandler handler)
                      throws java.io.IOException

Description copied from interface: ComponentRequestFilter

Invoked to activate and render a page. In certain cases, based on values returned when activating the page, a ComponentEventResultProcessor may be used to send an alternate response (typically, a redirect).

Specified by:

handlePageRender in interface ComponentRequestFilter

Parameters:

parameters - defines the page name and activation context

handler - next handler in the pipeline

Throws:

java.io.IOException