securelinktag.java

一个很好的开源项目管理系统源代码

package net.java.workeffort.infrastructure.jsptags;

import java.io.IOException;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.JspTagException;
import javax.servlet.jsp.JspWriter;

import net.java.htmltag.BaseHandlerTag;
import net.java.workeffort.infrastructure.security.ISecurityProfile;

import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang.Validate;
import org.springframework.web.util.ExpressionEvaluationUtils;
import org.springframework.web.util.UrlPathHelper;


/**
 * Security aware links
 * @author Antony Joseph
 */
public class SecureLinkTag extends BaseHandlerTag {

    private String href;
    private String permissions;

    /**
     * @return Returns the href.
     */
    public String getHref() {
        return href;
    }

    /**
     * @param href The href to set.
     */
    public void setHref(String href) {
        this.href = href;
    }

    /**
     * @return Returns the permissions.
     */
    public String getPermissions() {
        return permissions;
    }

    /**
     * @param permissions The permissions to set.
     */
    public void setPermissions(String permissions) {
        this.permissions = permissions;
    }

    private boolean authorized = false;
    protected String text = null;

    /**
     * Render the beginning of the hyperlink.
     * <p>
     * Support for indexed property since Struts 1.1
     * @exception JspException if a JSP exception has occurred
     */
    public int doStartTag() throws JspException {

        permissions = ExpressionEvaluationUtils.evaluateString("permissions",
                permissions, pageContext);

        href = ExpressionEvaluationUtils.evaluateString("href", href,
                pageContext);

        HttpServletRequest request = (HttpServletRequest) pageContext
        .getRequest();
        
        String controllerPath = getControllerPath(request, href);


        ISecurityProfile securityProfile = (ISecurityProfile) pageContext
                .findAttribute(permissions);
        Validate.notNull(securityProfile);
        int accessDecision = securityProfile.getAccessDecision(controllerPath,
                "ACCESS");
        if (accessDecision == ISecurityProfile.ALLOWED
                || accessDecision == ISecurityProfile.CONDITIONAL) {
            // need this for endTag().
            authorized = true;
            // Generate the opening anchor element
            StringBuffer results = new StringBuffer("<a");

            prepareAttribute(results, "href", href);
            prepareAttribute(results, "accesskey", getAccesskey());
            prepareAttribute(results, "tabindex", getTabindex());
            results.append(prepareStyles());
            results.append(prepareEventHandlers());
            //prepareOther(results);
            results.append(">");

            localWrite(results.toString());

            // Evaluate the body of this tag
            this.text = null;
            return (EVAL_BODY_INCLUDE);
        }
        else
            return SKIP_BODY;

    }

    /**
     * Save the associated label from the body content.
     * @exception JspException if a JSP exception has occurred
     */
    public int doAfterBody() throws JspException {

        if (bodyContent != null) {
            String value = bodyContent.getString().trim();
            if (value.length() > 0)
                text = value;
        }
        return (SKIP_BODY);

    }

    /**
     * Render the end of the hyperlink.
     * @exception JspException if a JSP exception has occurred
     */
    public int doEndTag() throws JspException {

        // Prepare the textual content and ending element of this hyperlink
        StringBuffer results = new StringBuffer();
        if (text != null) {
            results.append(text);
        }
        if (authorized) {
            results.append("</a>");
            localWrite(results.toString());
        }

        return (EVAL_PAGE);

    }

    private void localWrite(String str) throws JspTagException {
        try {
            JspWriter out = pageContext.getOut();
            out.write(str);
        }
        catch (IOException e) {
            throw new JspTagException("I/O: " + e.getMessage());
        }
    }

    public void release() {
        super.release();
        href = null;
        permissions = null;
    }

    private String getControllerPath(HttpServletRequest request, String href) {
        String contextPath = request.getContextPath(); 
        String controllerPath = StringUtils.substringAfter(href, contextPath);
        int offset = controllerPath.indexOf("?");
        if (offset != -1) {
            return controllerPath.substring(0, offset);
        }
        else
            return controllerPath;
    }
}