@Test public void testAllowedPath() throws IOException, ServletException { PublicationManagerFactory factory = Mockito.mock(PublicationManagerFactory.class); Mockito.when(factory.getPublicationMode()).thenReturn(PUBLICATION_MODE.STANDALONE); context.registerService(PublicationManagerFactory.class, factory); CMSSecurityConfigInstance config = new CMSSecurityConfigInstance(); config.activate(new CMSSecurityFilterConfig() { @Override public Class<? extends Annotation> annotationType() { return null; } @Override public String[] hostDomains() { return new String[] { "cms.apache.org" }; } @Override public String[] allowedPatterns() { return new String[] { "\\/static\\/.*" }; } @Override public String group() { return null; } }); context.registerService(CMSSecurityConfigInstance.class, config); securityFilter = context.registerInjectActivateService(new CMSSecurityFilter()); context.request().setServerName("cms.apache.org"); context.request().setServletPath("/static/test1.txt"); securityFilter.doFilter(context.request(), context.response(), Mockito.mock(FilterChain.class)); assertEquals(200, context.response().getStatus()); }
@Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (pubMgrFactory.getPublicationMode() == PUBLICATION_MODE.STANDALONE) { SlingHttpServletRequest slingRequest = (SlingHttpServletRequest) request; for (CMSSecurityConfigInstance securityConfig : securityConfigInstances) { log.trace("Checking to see if security config {} applies to request", securityConfig); if (securityConfig.applies(slingRequest)) { boolean allowed = checkAllowed(securityConfig, slingRequest); if (!allowed) { log.trace("Request to {} not allowed for user {}", slingRequest.getRequestURI(), slingRequest.getResourceResolver().getUserID()); ((HttpServletResponse) response).sendError(401); return; } } } } else { log.trace("Publication mode {} is not standalone", pubMgrFactory.getPublicationMode()); } chain.doFilter(request, response); }
CMSSecurityFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (pubMgrFactory.getPublicationMode() == PUBLICATION_MODE.STANDALONE) { SlingHttpServletRequest slingRequest = (SlingHttpServletRequest) request; for (CMSSecurityConfigInstance securityConfig : securityConfigInstances) { log.trace("Checking to see if security config {} applies to request", securityConfig); if (securityConfig.applies(slingRequest)) { boolean allowed = checkAllowed(securityConfig, slingRequest); if (!allowed) { log.trace("Request to {} not allowed for user {}", slingRequest.getRequestURI(), slingRequest.getResourceResolver().getUserID()); ((HttpServletResponse) response).sendError(401); return; } } } } else { log.trace("Publication mode {} is not standalone", pubMgrFactory.getPublicationMode()); } chain.doFilter(request, response); } }
CMSSecurityFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (pubMgrFactory.getPublicationMode() == PUBLICATION_MODE.STANDALONE) { SlingHttpServletRequest slingRequest = (SlingHttpServletRequest) request; for (CMSSecurityConfigInstance securityConfig : securityConfigInstances) { log.trace("Checking to see if security config {} applies to request", securityConfig); if (securityConfig.applies(slingRequest)) { boolean allowed = checkAllowed(securityConfig, slingRequest); if (!allowed) { log.trace("Request to {} not allowed for user {}", slingRequest.getRequestURI(), slingRequest.getResourceResolver().getUserID()); ((HttpServletResponse) response).sendError(401); return; } } } } else { log.trace("Publication mode {} is not standalone", pubMgrFactory.getPublicationMode()); } chain.doFilter(request, response); }  }
CMSSecurityFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (pubMgrFactory.getPublicationMode() == PUBLICATION_MODE.STANDALONE) { SlingHttpServletRequest slingRequest = (SlingHttpServletRequest) request; for (CMSSecurityConfigInstance securityConfig : securityConfigInstances) { log.trace("Checking to see if security config {} applies to request", securityConfig); if (securityConfig.applies(slingRequest)) { boolean allowed = checkAllowed(securityConfig, slingRequest); if (!allowed) { log.trace("Request to {} not allowed for user {}", slingRequest.getRequestURI(), slingRequest.getResourceResolver().getUserID()); ((HttpServletResponse) response).sendError(401); return; } } } } else { log.trace("Publication mode {} is not standalone", pubMgrFactory.getPublicationMode()); } chain.doFilter(request, response); }  @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest request, ServletResponse response, FilterChain chain); @Override void destroy(); }
CMSSecurityFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (pubMgrFactory.getPublicationMode() == PUBLICATION_MODE.STANDALONE) { SlingHttpServletRequest slingRequest = (SlingHttpServletRequest) request; for (CMSSecurityConfigInstance securityConfig : securityConfigInstances) { log.trace("Checking to see if security config {} applies to request", securityConfig); if (securityConfig.applies(slingRequest)) { boolean allowed = checkAllowed(securityConfig, slingRequest); if (!allowed) { log.trace("Request to {} not allowed for user {}", slingRequest.getRequestURI(), slingRequest.getResourceResolver().getUserID()); ((HttpServletResponse) response).sendError(401); return; } } } } else { log.trace("Publication mode {} is not standalone", pubMgrFactory.getPublicationMode()); } chain.doFilter(request, response); }  @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest request, ServletResponse response, FilterChain chain); @Override void destroy();  }