// make sure to set hidden accessingURL again
// set response header to alert ajax calls of a login error.
httpResponse.addHeader("LogginError", WebappUtil.getMessage("login_error"));
RequestDispatcher requestDispatcher=httpRequest.getRequestDispatcher("/login.jsp?accessingURL=" +
httpResponse.encodeURL(accessingURL) + "&loginError=" +
httpResponse.encodeURL(WebappUtil.getMessage("login_error")));
requestDispatcher.forward(httpRequest, httpResponse);
return;
}
}
} else if(!securityHandler.isPersonLoggedIn(httpRequest)) {
// the person isn't logged in, see if they are accessing a protected resource
// since we have a rest type of url, need to get path info to decide if path protected
String pathInfo=httpRequest.getPathInfo();
if(pathInfo != null) {
resource += pathInfo;
// using the rest type urls go only 3 '/' deep for security check (e.g. /xxx/xxxx/xxx)
resource=getSecurityURI(resource);
logger.finer("\nEntity Filter - checking if protect path = " + resource);
}
logger.finer("Checking resource to see if login required " + resource);
logger.finer("Entity Filter - Checking resource to see if login required - " + resource);
//resource=resource.substring(resource.lastIndexOf("/") + 1);
// if null page then using default welcome mechanism, assume it is an accessable page.
if(resource != null) {
if(securePages.contains(resource)) {
logger.finer("Entity Filter - have secure resource - " + resource);
// set response header to alert ajax calls of a login error.
httpResponse.addHeader("NeedLogin", "The user needs to be logged in");
// need to login to get to these page
//??? todo, need pathinfo and querystring
// what about post payload if an event is being submitted for creation
RequestDispatcher requestDispatcher=httpRequest.getRequestDispatcher("/login.jsp?accessingURL=" +
httpResponse.encodeURL(getAccessURL(httpRequest)));
requestDispatcher.forward(httpRequest, httpResponse);
return;
}
}
}