Index: lams_build/lib/lams/lams.jar =================================================================== diff -u -r0c0cbdac26679e47d5c48e045c30e5496e1f809b -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 Binary files differ Fisheye: Tag 6cea41c13ae7d7ef330284fa195209b9c201e5d2 refers to a dead (removed) revision in file `lams_central/src/java/org/lamsfoundation/lams/security/JspRedirectStrategy.java'. Fisheye: No comparison available. Pass `N' to diff? Index: lams_central/src/java/org/lamsfoundation/lams/security/LDAPAuthenticator.java =================================================================== diff -u -r540b84241d2fb70d9f9e4fb5ae8e99290fba5c4e -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/security/LDAPAuthenticator.java (.../LDAPAuthenticator.java) (revision 540b84241d2fb70d9f9e4fb5ae8e99290fba5c4e) +++ lams_central/src/java/org/lamsfoundation/lams/security/LDAPAuthenticator.java (.../LDAPAuthenticator.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -42,7 +42,7 @@ import org.lamsfoundation.lams.usermanagement.service.UserManagementService; import org.lamsfoundation.lams.util.Configuration; import org.lamsfoundation.lams.util.ConfigurationKeys; -import org.lamsfoundation.lams.web.util.HttpSessionManager; +import org.lamsfoundation.lams.web.session.SessionManager; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -62,21 +62,21 @@ } private UserManagementService getService() { - if (service == null) { - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager - .getInstance().getServletContext()); - service = (UserManagementService) ctx.getBean("userManagementService"); + if (LDAPAuthenticator.service == null) { + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager.getSession() + .getServletContext()); + LDAPAuthenticator.service = (UserManagementService) ctx.getBean("userManagementService"); } - return service; + return LDAPAuthenticator.service; } private LdapService getLdapService() { - if (ldapService == null) { - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager - .getInstance().getServletContext()); - ldapService = (LdapService) ctx.getBean("ldapService"); + if (LDAPAuthenticator.ldapService == null) { + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager.getSession() + .getServletContext()); + LDAPAuthenticator.ldapService = (LdapService) ctx.getBean("ldapService"); } - return ldapService; + return LDAPAuthenticator.ldapService; } public Attributes getAttrs() { @@ -95,9 +95,9 @@ Properties env = new Properties(); // setup initial connection to search for user's dn - env.setProperty(Context.INITIAL_CONTEXT_FACTORY, INITIAL_CONTEXT_FACTORY_VALUE); - env.setProperty(Context.SECURITY_AUTHENTICATION, Configuration - .get(ConfigurationKeys.LDAP_SECURITY_AUTHENTICATION)); + env.setProperty(Context.INITIAL_CONTEXT_FACTORY, LDAPAuthenticator.INITIAL_CONTEXT_FACTORY_VALUE); + env.setProperty(Context.SECURITY_AUTHENTICATION, + Configuration.get(ConfigurationKeys.LDAP_SECURITY_AUTHENTICATION)); env.setProperty(Context.PROVIDER_URL, Configuration.get(ConfigurationKeys.LDAP_PROVIDER_URL)); String securityProtocol = Configuration.get(ConfigurationKeys.LDAP_SECURITY_PROTOCOL); @@ -130,10 +130,10 @@ NamingEnumeration results = ctx.search(baseDN, filter, filterArgs, ctrl); while (results.hasMore()) { SearchResult result = results.next(); - if (log.isDebugEnabled()) { - log.debug("===> found matching object..."); - log.debug("name: " + result.getName()); - log.debug("namespace name: " + result.getNameInNamespace()); + if (LDAPAuthenticator.log.isDebugEnabled()) { + LDAPAuthenticator.log.debug("===> found matching object..."); + LDAPAuthenticator.log.debug("name: " + result.getName()); + LDAPAuthenticator.log.debug("namespace name: " + result.getNameInNamespace()); } Attributes attrs = result.getAttributes(); Attribute attr = attrs.get(Configuration.get(ConfigurationKeys.LDAP_LOGIN_ATTR)); @@ -153,33 +153,33 @@ } } if (StringUtils.isBlank(login)) { - log.error("===> No LDAP user found with username: " + username + LDAPAuthenticator.log.error("===> No LDAP user found with username: " + username + ". This could mean that the the login attribute is incorrect," + " the user doesn't exist, or that an initial bind user is required."); return false; } - + // authenticate env.setProperty(Context.SECURITY_PRINCIPAL, dn); env.setProperty(Context.SECURITY_CREDENTIALS, credential.toString()); ctx = new InitialLdapContext(env, null); // if no exception, success - log.debug("===> LDAP context created using DN: " + dn); + LDAPAuthenticator.log.debug("===> LDAP context created using DN: " + dn); isValid = true; // start checking whether we need to update user depending on its // attributes - if (log.isDebugEnabled()) { + if (LDAPAuthenticator.log.isDebugEnabled()) { NamingEnumeration enumAttrs = this.attrs.getAll(); while (enumAttrs.hasMoreElements()) { - log.debug(enumAttrs.next()); + LDAPAuthenticator.log.debug(enumAttrs.next()); } } // check user is disabled in ldap if (getLdapService().getDisabledBoolean(this.attrs)) { - log.debug("===> User is disabled in LDAP."); + LDAPAuthenticator.log.debug("===> User is disabled in LDAP."); User user = getService().getUserByLogin(username); if (user != null) { getService().disableUser(user.getUserId()); @@ -198,19 +198,20 @@ return true; } catch (AuthenticationNotSupportedException e) { - log.error("===> Authentication mechanism not supported. Check your " + LDAPAuthenticator.log.error("===> Authentication mechanism not supported. Check your " + ConfigurationKeys.LDAP_SECURITY_AUTHENTICATION + " parameter: " + Configuration.get(ConfigurationKeys.LDAP_SECURITY_AUTHENTICATION)); } catch (AuthenticationException e) { - log.info("===> Incorrect username (" + dn + ") or password. " + e.getMessage()); + LDAPAuthenticator.log.info("===> Incorrect username (" + dn + ") or password. " + e.getMessage()); } catch (Exception e) { - log.error("===> LDAP exception: " + e, e); + LDAPAuthenticator.log.error("===> LDAP exception: " + e, e); } finally { try { - if (ctx != null) + if (ctx != null) { ctx.close(); + } } catch (Exception e) { - log.error("===> gettting problem when closing context. Exception: " + e); + LDAPAuthenticator.log.error("===> gettting problem when closing context. Exception: " + e); } } Index: lams_central/src/java/org/lamsfoundation/lams/security/UniversalLoginModule.java =================================================================== diff -u -r0c0cbdac26679e47d5c48e045c30e5496e1f809b -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/security/UniversalLoginModule.java (.../UniversalLoginModule.java) (revision 0c0cbdac26679e47d5c48e045c30e5496e1f809b) +++ lams_central/src/java/org/lamsfoundation/lams/security/UniversalLoginModule.java (.../UniversalLoginModule.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -63,6 +63,7 @@ import org.lamsfoundation.lams.util.Configuration; import org.lamsfoundation.lams.util.ConfigurationKeys; import org.lamsfoundation.lams.util.HashUtil; +import org.lamsfoundation.lams.web.session.SessionManager; import org.lamsfoundation.lams.web.util.HttpSessionManager; import org.springframework.beans.factory.NoSuchBeanDefinitionException; import org.springframework.context.ApplicationContext; @@ -107,8 +108,8 @@ String username = getUsername(); UniversalLoginModule.log.debug("===> authenticating user: " + username); - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager - .getInstance().getServletContext()); + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager + .getSession().getServletContext()); if (service == null) { service = (UserManagementService) ctx.getBean("userManagementService"); Index: lams_central/src/java/org/lamsfoundation/lams/web/LessonOrderServlet.java =================================================================== diff -u -r56a78648ef24c607f16cb249439a2d624f6b8f12 -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/web/LessonOrderServlet.java (.../LessonOrderServlet.java) (revision 56a78648ef24c607f16cb249439a2d624f6b8f12) +++ lams_central/src/java/org/lamsfoundation/lams/web/LessonOrderServlet.java (.../LessonOrderServlet.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -41,7 +41,7 @@ import org.lamsfoundation.lams.usermanagement.UserOrganisationRole; import org.lamsfoundation.lams.usermanagement.service.UserManagementService; import org.lamsfoundation.lams.util.WebUtil; -import org.lamsfoundation.lams.web.util.HttpSessionManager; +import org.lamsfoundation.lams.web.session.SessionManager; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -67,7 +67,7 @@ Integer orgId = WebUtil.readIntParam(request, "orgId", false); String ids = request.getParameter("ids"); - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager.getInstance().getServletContext()); + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager.getSession().getServletContext()); UserManagementService service = (UserManagementService) ctx.getBean("userManagementService"); if (orgId != null && ids != null) { Index: lams_central/src/java/org/lamsfoundation/lams/web/LoginAsAction.java =================================================================== diff -u -r0191d40366afbe37b485950760632bb0aad9eb62 -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/web/LoginAsAction.java (.../LoginAsAction.java) (revision 0191d40366afbe37b485950760632bb0aad9eb62) +++ lams_central/src/java/org/lamsfoundation/lams/web/LoginAsAction.java (.../LoginAsAction.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -30,6 +30,7 @@ import org.apache.struts.action.ActionForm; import org.apache.struts.action.ActionForward; import org.apache.struts.action.ActionMapping; +import org.lamsfoundation.lams.usermanagement.User; import org.lamsfoundation.lams.usermanagement.dto.UserDTO; import org.lamsfoundation.lams.usermanagement.service.IUserManagementService; import org.lamsfoundation.lams.util.CentralConstants; @@ -61,21 +62,20 @@ if (service.isUserSysAdmin()) { if ((login != null) && (login.trim().length() > 0)) { - if (service.getUserByLogin(login) != null) { - + User user = service.getUserByLogin(login); + if (user != null) { // audit log when loginas UserDTO sysadmin = (UserDTO) SessionManager.getSession().getAttribute(AttributeNames.USER); IAuditService auditService = (IAuditService) ctx.getBean("auditService"); String[] args = new String[] { sysadmin.getLogin() + "(" + sysadmin.getUserID() + ")", login }; String message = messageService.getMessage("audit.admin.loginas", args); auditService.log(CentralConstants.MODULE_NAME, message); - // logout, but not the LAMS shared session; needed by UniversalLoginModule - // to check for sysadmin role - request.getSession().invalidate(); - + // login.jsp knows what to do with these + request.setAttribute("login", login); + request.setAttribute("password", user.getPassword()); // redirect to login page - return (new ActionForward("/login.jsp?login=" + login + "&password=dummy")); + return (new ActionForward("/login.jsp?redirectURL=/lams/index.jsp")); } } } else { Index: lams_central/src/java/org/lamsfoundation/lams/web/LoginRequestServlet.java =================================================================== diff -u -r0191d40366afbe37b485950760632bb0aad9eb62 -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/web/LoginRequestServlet.java (.../LoginRequestServlet.java) (revision 0191d40366afbe37b485950760632bb0aad9eb62) +++ lams_central/src/java/org/lamsfoundation/lams/web/LoginRequestServlet.java (.../LoginRequestServlet.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -22,23 +22,13 @@ import java.io.IOException; import java.net.URLEncoder; -import java.sql.Connection; -import java.sql.PreparedStatement; -import java.sql.ResultSet; -import java.sql.SQLException; -import javax.naming.InitialContext; -import javax.naming.NamingException; -import javax.security.auth.login.FailedLoginException; import javax.servlet.ServletException; -import javax.servlet.http.Cookie; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import javax.sql.DataSource; -import org.apache.catalina.authenticator.Constants; import org.apache.log4j.Logger; import org.lamsfoundation.lams.integration.ExtServerOrgMap; import org.lamsfoundation.lams.integration.ExtUserUseridMap; @@ -49,15 +39,15 @@ import org.lamsfoundation.lams.integration.service.IntegrationService; import org.lamsfoundation.lams.integration.util.LoginRequestDispatcher; import org.lamsfoundation.lams.usermanagement.User; +import org.lamsfoundation.lams.usermanagement.dto.UserDTO; import org.lamsfoundation.lams.util.CentralConstants; import org.lamsfoundation.lams.util.WebUtil; import org.lamsfoundation.lams.web.util.AttributeNames; import org.springframework.web.context.support.WebApplicationContextUtils; /** * The LoginRequestServlet handles login request by an integrated external system. This servlet checks for the UserId, - * Timestamp, Hash and ServerId if it's valid it fetch the password from database and pass it to j_security_check for - * authentication + * Timestamp, Hash and ServerId if it's valid it passes it to login.jsp * * @author Fei Yang, Anthony Xiao */ @@ -68,10 +58,6 @@ private static IntegrationService integrationService = null; - private static final String JNDI_DATASOURCE = "java:jboss/datasources/lams-ds"; - - private static final String PASSWORD_QUERY = "select password from lams_user where login=?"; - /** * The doGet method of the servlet.
* @@ -149,15 +135,12 @@ User user = userMap.getUser(); String login = user.getLogin(); - // The "extUser" attribute works as a flag to indicate if the user has logged in - String loginRequestUsername = (String) hses.getAttribute("extUser"); - if ((loginRequestUsername != null) && loginRequestUsername.equals(login)) { + UserDTO loggedInUserDTO = (UserDTO) hses.getAttribute(AttributeNames.USER); + String loggedInLogin = loggedInUserDTO == null ? null : loggedInUserDTO.getLogin(); + if ((loggedInLogin != null) && loggedInLogin.equals(login)) { String url = LoginRequestDispatcher.getRequestURL(request); response.sendRedirect(response.encodeRedirectURL(url)); return; - } else if (loginRequestUsername == null ? request.getRemoteUser() != null : !loginRequestUsername - .equals(login)) { - hses = recreateSession(request, response); } if (extCourseId != null) { @@ -166,10 +149,6 @@ courseName, method, prefix); } - // connect to DB and get password here - String pass = getUserPassword(userMap.getUser().getLogin()); - hses.setAttribute("extUser", login); - // check if there is a redirect URL parameter already String redirectURL = request.getParameter("redirectURL"); if (redirectURL == null) { @@ -178,7 +157,11 @@ } redirectURL = URLEncoder.encode(redirectURL, "UTF-8"); - response.sendRedirect("login.jsp?login=" + login + "&password=" + pass + "&redirectURL=" + redirectURL); + // login.jsp knows what to do with these + hses.setAttribute("login", login); + hses.setAttribute("password", user.getPassword()); + + response.sendRedirect("login.jsp?redirectURL=" + redirectURL); } catch (AuthenticationException e) { LoginRequestServlet.log.error("Authentication error: ", e); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Login Failed - authentication error"); @@ -189,15 +172,6 @@ } catch (UserInfoValidationException e) { LoginRequestServlet.log.error("User validation error: ", e); response.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage()); - } catch (FailedLoginException e) { - LoginRequestServlet.log.error("Login error: ", e); - response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Login Failed - user was not found"); - } catch (NamingException e) { - LoginRequestServlet.log.error("Naming error: ", e); - response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage()); - } catch (SQLException e) { - LoginRequestServlet.log.error("Database error: ", e); - response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage()); } } @@ -220,54 +194,6 @@ doGet(request, response); } - // using JDBC connection to prevent the caching of passwords by hibernate - private String getUserPassword(String username) throws FailedLoginException, NamingException, SQLException { - InitialContext ctx = new InitialContext(); - - DataSource ds = (DataSource) ctx.lookup(LoginRequestServlet.JNDI_DATASOURCE); - Connection conn = null; - String password = null; - try { - conn = ds.getConnection(); - PreparedStatement ps = conn.prepareStatement(LoginRequestServlet.PASSWORD_QUERY); - ps.setString(1, username); - ResultSet rs = ps.executeQuery(); - - // check if there is any result - if (rs.next() == false) { - throw new FailedLoginException("invalid username"); - } - - password = rs.getString(1); - rs.close(); - } finally { - if ((conn != null) && !conn.isClosed()) { - conn.close(); - } - } - return password; - } - - private HttpSession recreateSession(HttpServletRequest request, HttpServletResponse response) { - HttpSession hses = request.getSession(false); - hses.invalidate(); - hses = request.getSession(true); - - Cookie cookies[] = request.getCookies(); - if (cookies != null) { - for (int i = 0; i < cookies.length; i++) { - if (Constants.SINGLE_SIGN_ON_COOKIE.equals(cookies[i].getName())) { - Cookie cookie = new Cookie(cookies[i].getName(), ""); - cookie.setPath("/"); - cookie.setMaxAge(0); - response.addCookie(cookie); - break; - } - } - } - return hses; - } - private IntegrationService getService() { if (LoginRequestServlet.integrationService == null) { LoginRequestServlet.integrationService = (IntegrationService) WebApplicationContextUtils Index: lams_central/src/java/org/lamsfoundation/lams/web/SessionListener.java =================================================================== diff -u -r980c09297975494a4a302f7fd3241f3957dedf2a -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/web/SessionListener.java (.../SessionListener.java) (revision 980c09297975494a4a302f7fd3241f3957dedf2a) +++ lams_central/src/java/org/lamsfoundation/lams/web/SessionListener.java (.../SessionListener.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -28,12 +28,8 @@ import org.lamsfoundation.lams.web.util.HttpSessionManager; - /** - * Listens for the creation and destruction of http sessions, and reports back to - * the ClientSessionInfoManager. - * - * @web.listener + * Listens for the creation and destruction of http sessions. */ /* Should come out in web.xml as: * @@ -43,19 +39,17 @@ * * */ -public class SessionListener implements HttpSessionListener -{ +public class SessionListener implements HttpSessionListener { - /** HttpSessionListener interface */ - public void sessionCreated(HttpSessionEvent se) - { - HttpSessionManager.getInstance().sessionCreated(se); - } + /** HttpSessionListener interface */ + @Override + public void sessionCreated(HttpSessionEvent se) { + HttpSessionManager.sessionCreated(se); + } - /** HttpSessionListener interface */ - public void sessionDestroyed(HttpSessionEvent se) - { - //nothing to do - } - -} + /** HttpSessionListener interface */ + @Override + public void sessionDestroyed(HttpSessionEvent se) { + //nothing to do + } +} \ No newline at end of file Index: lams_central/src/java/org/lamsfoundation/lams/web/UpdateCollapsedGroupServlet.java =================================================================== diff -u -r07578aaa7f526c0c1b537c127cf5f88e0410d472 -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/web/UpdateCollapsedGroupServlet.java (.../UpdateCollapsedGroupServlet.java) (revision 07578aaa7f526c0c1b537c127cf5f88e0410d472) +++ lams_central/src/java/org/lamsfoundation/lams/web/UpdateCollapsedGroupServlet.java (.../UpdateCollapsedGroupServlet.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -18,67 +18,68 @@ * * http://www.gnu.org/licenses/gpl.txt * **************************************************************** - */ - -/* $Id$ */ -package org.lamsfoundation.lams.web; + */ +/* $Id$ */ +package org.lamsfoundation.lams.web; + import java.io.IOException; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import org.apache.log4j.Logger; import org.lamsfoundation.lams.usermanagement.Organisation; import org.lamsfoundation.lams.usermanagement.Role; import org.lamsfoundation.lams.usermanagement.User; import org.lamsfoundation.lams.usermanagement.UserOrganisation; import org.lamsfoundation.lams.usermanagement.UserOrganisationCollapsed; import org.lamsfoundation.lams.usermanagement.service.UserManagementService; import org.lamsfoundation.lams.util.WebUtil; -import org.lamsfoundation.lams.web.util.HttpSessionManager; +import org.lamsfoundation.lams.web.session.SessionManager; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; - + /** * @author jliew * * @web:servlet name="updateCollapsedGroup" * @web:servlet-mapping url-pattern="/servlet/updateCollapsedGroup" */ public class UpdateCollapsedGroupServlet extends HttpServlet { - - public void doGet(HttpServletRequest request, HttpServletResponse response) - throws ServletException, IOException { - - // get request parameters - Integer orgId = WebUtil.readIntParam(request, "orgId", false); - String collapsed = request.getParameter("collapsed"); - - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager.getInstance().getServletContext()); - UserManagementService service = (UserManagementService) ctx.getBean("userManagementService"); - - Organisation org = (Organisation)service.findById(Organisation.class, orgId); - User user = service.getUserByLogin(request.getRemoteUser()); - - // sysadmins always have non-collapsed groups; they aren't always members of the org anyway - if (request.isUserInRole(Role.SYSADMIN)) return; - - // insert or update userorg's collapsed status - if (org != null && collapsed != null && user != null) { - UserOrganisation uo = (UserOrganisation)service.getUserOrganisation(user.getUserId(), orgId); - UserOrganisationCollapsed uoc = uo.getUserOrganisationCollapsed(); - if (uoc != null) { - uoc.setCollapsed(new Boolean(collapsed)); - } else { - // new row in lams_user_organisation_collapsed - uoc = new UserOrganisationCollapsed(new Boolean(collapsed), uo); - } - service.save(uoc); - } + + @Override + public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { + + // get request parameters + Integer orgId = WebUtil.readIntParam(request, "orgId", false); + String collapsed = request.getParameter("collapsed"); + + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager.getSession() + .getServletContext()); + UserManagementService service = (UserManagementService) ctx.getBean("userManagementService"); + + Organisation org = (Organisation) service.findById(Organisation.class, orgId); + User user = service.getUserByLogin(request.getRemoteUser()); + + // sysadmins always have non-collapsed groups; they aren't always members of the org anyway + if (request.isUserInRole(Role.SYSADMIN)) { + return; } + // insert or update userorg's collapsed status + if ((org != null) && (collapsed != null) && (user != null)) { + UserOrganisation uo = service.getUserOrganisation(user.getUserId(), orgId); + UserOrganisationCollapsed uoc = uo.getUserOrganisationCollapsed(); + if (uoc != null) { + uoc.setCollapsed(new Boolean(collapsed)); + } else { + // new row in lams_user_organisation_collapsed + uoc = new UserOrganisationCollapsed(new Boolean(collapsed), uo); + } + service.save(uoc); + } + } + } - \ No newline at end of file Index: lams_central/src/java/org/lamsfoundation/lams/webservice/PresenceChatAction.java =================================================================== diff -u -rbe6b9658350d706f615e5ce3e4a6b96b8513c5ee -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/src/java/org/lamsfoundation/lams/webservice/PresenceChatAction.java (.../PresenceChatAction.java) (revision be6b9658350d706f615e5ce3e4a6b96b8513c5ee) +++ lams_central/src/java/org/lamsfoundation/lams/webservice/PresenceChatAction.java (.../PresenceChatAction.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -48,8 +48,8 @@ import org.lamsfoundation.lams.presence.service.IPresenceChatService; import org.lamsfoundation.lams.util.WebUtil; import org.lamsfoundation.lams.web.action.LamsDispatchAction; +import org.lamsfoundation.lams.web.session.SessionManager; import org.lamsfoundation.lams.web.util.AttributeNames; -import org.lamsfoundation.lams.web.util.HttpSessionManager; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -88,13 +88,13 @@ // roster is used also to get messages by other users, so we need to synchronise on it synchronized (roster) { Date currentDate = new Date(currentTime); - + if (!StringUtils.isBlank(nickname)) { // blank nickname means this is just check but user is not really using chat activeUsers.put(nickname, currentDate); } - if (currentTime - lastCheckTime > IPresenceChatService.PRESENCE_IDLE_TIMEOUT) { + if ((currentTime - lastCheckTime) > IPresenceChatService.PRESENCE_IDLE_TIMEOUT) { // store active users getPresenceChatService().updateUserPresence(lessonId, activeUsers); activeUsers.clear(); @@ -130,7 +130,7 @@ boolean getMessages = Boolean.parseBoolean(request.getParameter("getMessages")); // this is the current user String nickname = request.getParameter("to"); - + JSONObject responseJSON = new JSONObject(); // no need to fetch messages if presence is collapsed if (getMessages && !StringUtils.isBlank(nickname)) { @@ -229,8 +229,8 @@ private IPresenceChatService getPresenceChatService() { if (PresenceChatAction.presenceChatService == null) { - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager - .getInstance().getServletContext()); + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager.getSession() + .getServletContext()); PresenceChatAction.presenceChatService = (IPresenceChatService) ctx.getBean("presenceChatService"); } return PresenceChatAction.presenceChatService; Index: lams_central/web/login.jsp =================================================================== diff -u -r302268a60857c087e3e335320d109ddced439c80 -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/web/login.jsp (.../login.jsp) (revision 302268a60857c087e3e335320d109ddced439c80) +++ lams_central/web/login.jsp (.../login.jsp) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -3,15 +3,22 @@ <%@ taglib uri="tags-fmt" prefix="fmt"%> <%@ taglib uri="tags-core" prefix="c"%> <%@ taglib uri="tags-lams" prefix="lams"%> -<%@ page import="org.lamsfoundation.lams.security.JspRedirectStrategy"%> <%@ page import="org.lamsfoundation.lams.util.Configuration"%> <%@ page import="org.lamsfoundation.lams.util.ConfigurationKeys"%> -<%-- If you change this file, remember to update the copy made for CNG-21 --%> - +<%-- Attributes in request come from sysadmin LoginAs action + while in session from LoginRequestServlet +--%> + + + + +<%-- If credentials came from attributes, no need for encrypting --%> +<%= request.getAttribute("login") == null && session.getAttribute("login") == null && Configuration.getAsBoolean(ConfigurationKeys.LDAP_ENCRYPT_PASSWORD_FROM_BROWSER) %> <% - if (JspRedirectStrategy.loginPageRedirected(request, response)) { - return; + if (request.getAttribute("login") != null || session.getAttribute("login") != null) { + // invalidate session so a new user can be logged in + session.invalidate(); } %> @@ -22,7 +29,6 @@ j_security_login_page --> -<%= Configuration.getAsBoolean(ConfigurationKeys.LDAP_ENCRYPT_PASSWORD_FROM_BROWSER) %> <fmt:message key="title.login.window" /> @@ -32,13 +38,9 @@ Index: lams_central/web/main.jsp =================================================================== diff -u -ra7738613d14072a7cb276a890ec10a699bd9657b -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_central/web/main.jsp (.../main.jsp) (revision a7738613d14072a7cb276a890ec10a699bd9657b) +++ lams_central/web/main.jsp (.../main.jsp) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -1,6 +1,4 @@ <%@ page contentType="text/html; charset=utf-8" language="java"%> -<%@ page import="org.lamsfoundation.lams.security.JspRedirectStrategy"%> -<%@ page import="org.lamsfoundation.lams.web.util.HttpSessionManager"%> <%@ page import="org.lamsfoundation.lams.util.Configuration"%> <%@ page import="org.lamsfoundation.lams.util.ConfigurationKeys"%> <%@ taglib uri="tags-lams" prefix="lams"%> @@ -9,10 +7,6 @@ <%@ taglib uri="tags-function" prefix="fn"%> <%@ taglib uri="tags-tiles" prefix="tiles" %> -<%-- If you change this file, remember to update the copy made for CNG-21 --%> - -<%JspRedirectStrategy.welcomePageStatusUpdate(request, response);%> -<%HttpSessionManager.getInstance().updateHttpSessionByLogin(request.getSession(),request.getRemoteUser());%> Index: lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java =================================================================== diff -u -r0c0cbdac26679e47d5c48e045c30e5496e1f809b -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java (.../SsoHandler.java) (revision 0c0cbdac26679e47d5c48e045c30e5496e1f809b) +++ lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java (.../SsoHandler.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -43,7 +43,6 @@ import org.lamsfoundation.lams.usermanagement.service.UserManagementService; import org.lamsfoundation.lams.web.session.SessionManager; import org.lamsfoundation.lams.web.util.AttributeNames; -import org.lamsfoundation.lams.web.util.HttpSessionManager; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -72,16 +71,17 @@ ServletRequestContext context = exchange.getAttachment(ServletRequestContext.ATTACHMENT_KEY); HttpServletRequest request = (HttpServletRequest) context.getServletRequest(); - // LoginRequestServlet (integrations) sets this parameter + // get session here in case it was invalidated in login.jsp + HttpSession session = request.getSession(); + + // LoginRequestServlet (integrations) and LoginAsAction (sysadmin) set this parameter String redirectURL = request.getParameter("redirectURL"); if (!StringUtils.isBlank(redirectURL)) { SsoHandler.handleRedirectBack(context, redirectURL); } // store session so UniversalLoginModule can access it - HttpSession session = request.getSession(); SessionManager.startSession(request); - HttpSessionManager.getInstance().setServletContext(session.getServletContext()); // do the logging in UniversalLoginModule handler.handleRequest(exchange); SessionManager.endSession(); @@ -110,7 +110,7 @@ * ServletFormAuthenticationMechanism method. */ protected static void handleRedirectBack(ServletRequestContext context, String redirectURL) { - HttpSessionImpl httpSession = context.getCurrentServletContext().getSession(context.getExchange(), false); + HttpSessionImpl httpSession = context.getCurrentServletContext().getSession(context.getExchange(), true); if (httpSession != null) { Session session; if (System.getSecurityManager() == null) { Index: lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/UserManagementService.java =================================================================== diff -u -r1d2ff22c947ab0d5646bb02b8189ca668020bdbc -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/UserManagementService.java (.../UserManagementService.java) (revision 1d2ff22c947ab0d5646bb02b8189ca668020bdbc) +++ lams_common/src/java/org/lamsfoundation/lams/usermanagement/service/UserManagementService.java (.../UserManagementService.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -73,7 +73,6 @@ import org.lamsfoundation.lams.util.audit.IAuditService; import org.lamsfoundation.lams.web.session.SessionManager; import org.lamsfoundation.lams.web.util.AttributeNames; -import org.lamsfoundation.lams.web.util.HttpSessionManager; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -110,8 +109,8 @@ private IAuditService getAuditService() { if (UserManagementService.auditService == null) { - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager - .getInstance().getServletContext()); + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager.getSession() + .getServletContext()); UserManagementService.auditService = (IAuditService) ctx.getBean("auditService"); } return UserManagementService.auditService; @@ -151,6 +150,7 @@ this.userOrganisationDAO = userOrganisationDAO; } + @Override public void save(Object object) { try { if (object instanceof User) { @@ -187,6 +187,7 @@ return user; } + @Override public void saveOrganisationGrouping(OrganisationGrouping grouping, Collection newGroups) { if (grouping.getGroupingId() == null) { grouping.setGroups(new HashSet()); @@ -227,6 +228,7 @@ } } + @Override public void saveAll(Collection objects) { for (Object o : objects) { if (o instanceof User) { @@ -238,54 +240,67 @@ baseDAO.insertOrUpdateAll(objects); } + @Override public void delete(Object object) { baseDAO.delete(object); } + @Override public void deleteAll(Class clazz) { baseDAO.deleteAll(clazz); } + @Override public void deleteAll(Collection objects) { baseDAO.deleteAll(objects); } + @Override public void deleteById(Class clazz, Serializable id) { baseDAO.deleteById(clazz, id); } + @Override public void deleteByProperty(Class clazz, String name, Object value) { baseDAO.deleteByProperty(clazz, name, value); } + @Override public void deleteByProperties(Class clazz, Map properties) { baseDAO.deleteByProperties(clazz, properties); } + @Override public void deleteAnythingLike(Object object) { baseDAO.deleteAnythingLike(object); } + @Override public Object findById(Class clazz, Serializable id) { return baseDAO.find(clazz, id); } + @Override public List findAll(Class clazz) { return baseDAO.findAll(clazz); } + @Override public List findByProperty(Class clazz, String name, Object value) { return baseDAO.findByProperty(clazz, name, value); } + @Override public List findByProperties(Class clazz, Map properties) { return baseDAO.findByProperties(clazz, properties); } + @Override public List findAnythingLike(Object object) { return baseDAO.findAnythingLike(object); } + @Override public List searchByStringProperties(Class clazz, Map properties) { return baseDAO.searchByStringProperties(clazz, properties); } @@ -294,6 +309,7 @@ * @see org.lamsfoundation.lams.usermanagement.service.IUserManagementService * #getOrganisationRolesForUser(org.lamsfoundation.lams.usermanagement. User, java.util.List) */ + @Override public OrganisationDTO getOrganisationsForUserByRole(User user, List restrictToRoleNames) { List list = new ArrayList(); Iterator i = user.getUserOrganisations().iterator(); @@ -314,6 +330,7 @@ * #getOrganisationRolesForUser(org.lamsfoundation.lams.usermanagement. User, java.util.List, * java.util.Integer) */ + @Override public OrganisationDTO getOrganisationsForUserByRole(User user, List restrictToRoleNames, Integer courseId, List restrictToClassIds) { List dtolist = new ArrayList(); @@ -385,6 +402,7 @@ * Gets an organisation for a user, with the user's roles. Doesn't not return a tree of organisations. Will not * return the organisation if there isn't any roles for this user. */ + @Override public OrganisationDTO getOrganisationForUserWithRole(User user, Integer organisationId) { if ((user != null) && (organisationId != null)) { Map map = new HashMap(); @@ -403,6 +421,7 @@ * @see org.lamsfoundation.lams.usermanagement.service.IUserManagementService#getRolesForUserByOrganisation(org.lamsfoundation.lams.usermanagement.User, * java.lang.Integer) */ + @Override public List getRolesForUserByOrganisation(User user, Integer orgId) { List list = new ArrayList(); Map map = new HashMap(); @@ -423,6 +442,7 @@ /** * @see org.lamsfoundation.lams.usermanagement.service.IUserManagementService#getUsersFromOrganisation(int) */ + @Override public List getUsersFromOrganisation(Integer orgId) { String query = "select uo.user from UserOrganisation uo" + " where uo.organisation.organisationId=" + orgId + " order by uo.user.login"; @@ -433,6 +453,7 @@ * @see org.lamsfoundation.lams.usermanagement.service.IUserManagementService#getUsersFromOrganisationByRole(java.lang.Integer, * java.lang.String) */ + @Override @SuppressWarnings("unchecked") public Vector getUsersFromOrganisationByRole(Integer organisationID, String roleName, boolean isFlashCall, boolean getUser) { @@ -448,8 +469,8 @@ // it's ugly to put query string here, but it is a convention of this class so let's stick to it for now String query = "SELECT uo.user FROM UserOrganisation uo INNER JOIN uo.userOrganisationRoles r WHERE uo.organisation.organisationId=" + organisationID + " AND r.role.name= '" + roleName + "'"; - List queryResult = (List) baseDAO.find(query); - + List queryResult = baseDAO.find(query); + for (User user : queryResult) { if (isFlashCall && !getUser) { users.add(user.getUserFlashDTO()); @@ -459,15 +480,17 @@ users.add(user.getUserDTO()); } } - + return users; } + @Override public Organisation getRootOrganisation() { return (Organisation) baseDAO.findByProperty(Organisation.class, "organisationType.organisationTypeId", OrganisationType.ROOT_TYPE).get(0); } + @Override public boolean isUserInRole(Integer userId, Integer orgId, String roleName) { Map properties = new HashMap(); properties.put("userOrganisation.user.userId", userId); @@ -479,20 +502,23 @@ return true; } + @Override public List getOrganisationsByTypeAndStatus(Integer typeId, Integer stateId) { Map properties = new HashMap(); properties.put("organisationType.organisationTypeId", typeId); properties.put("organisationState.organisationStateId", stateId); return baseDAO.findByProperties(Organisation.class, properties); } + @Override public List getUserOrganisationRoles(Integer orgId, String login) { Map properties = new HashMap(); properties.put("userOrganisation.organisation.organisationId", orgId); properties.put("userOrganisation.user.login", login); return baseDAO.findByProperties(UserOrganisationRole.class, properties); } + @Override public List getUserOrganisationsForUserByTypeAndStatus(String login, Integer typeId, Integer stateId) { Map properties = new HashMap(); properties.put("user.login", login); @@ -501,6 +527,7 @@ return baseDAO.findByProperties(UserOrganisation.class, properties); } + @Override public List getUserOrganisationsForUserByTypeAndStatusAndParent(String login, Integer typeId, Integer stateId, Integer parentOrgId) { Map properties = new HashMap(); @@ -511,11 +538,13 @@ return baseDAO.findByProperties(UserOrganisation.class, properties); } + @Override public User getUserByLogin(String login) { List results = baseDAO.findByProperty(User.class, "login", login); return results.isEmpty() ? null : (User) results.get(0); } + @Override public void updatePassword(String login, String password) { try { User user = getUserByLogin(login); @@ -526,6 +555,7 @@ } } + @Override public UserOrganisation getUserOrganisation(Integer userId, Integer orgId) { Map properties = new HashMap(); properties.put("user.userId", userId); @@ -574,6 +604,7 @@ return workspace; } + @Override @SuppressWarnings("unchecked") public Organisation saveOrganisation(Organisation organisation, Integer userID) { @@ -650,6 +681,7 @@ return organisation; } + @Override @SuppressWarnings("unchecked") public void updateOrganisationandWorkspaceNames(Organisation organisation) { baseDAO.update(organisation); @@ -689,6 +721,7 @@ return runSeqName; } + @Override @SuppressWarnings("unchecked") public List getUserManageBeans(Integer orgId) { String query = "select u.userId,u.login,u.title,u.firstName,u.lastName, r " @@ -721,6 +754,7 @@ * * @param userId */ + @Override public void removeUser(Integer userId) throws Exception { User user = (User) findById(User.class, userId); @@ -765,6 +799,7 @@ } } + @Override public Boolean userHasData(User user) { if (user.getLearnerProgresses() != null) { if (!user.getLearnerProgresses().isEmpty()) { @@ -798,6 +833,7 @@ return false; } + @Override public void disableUser(Integer userId) { User user = (User) findById(User.class, userId); @@ -820,6 +856,7 @@ * @see org.lamsfoundation.lams.usermanagement.service.IUserManagementService#setRolesForUserOrganisation(org.lamsfoundation.lams.usermanagement.User, * java.lang.Integer, java.util.List) */ + @Override public void setRolesForUserOrganisation(User user, Integer organisationId, List rolesList) { // Don't pass in the org from the web layer. The import for roles @@ -965,6 +1002,7 @@ return uo; } + @Override public List filterRoles(List rolelist, Boolean isSysadmin, OrganisationType orgType) { List allRoles = new ArrayList(); allRoles.addAll(rolelist); @@ -991,10 +1029,12 @@ return allRoles; } + @Override public boolean hasRoleInOrganisation(User user, Integer roleId) { return hasRoleInOrganisation(user, roleId, getRootOrganisation()); } + @Override public boolean hasRoleInOrganisation(User user, Integer roleId, Organisation organisation) { if (roleDAO.getUserByOrganisationAndRole(user.getUserId(), roleId, organisation) != null) { return true; @@ -1003,6 +1043,7 @@ } } + @Override public void deleteChildUserOrganisations(User user, Organisation org) { if (!org.getOrganisationType().getOrganisationTypeId().equals(OrganisationType.COURSE_TYPE)) { return; @@ -1027,6 +1068,7 @@ } } + @Override public void deleteUserOrganisation(User user, Organisation org) { UserOrganisation uo = getUserOrganisation(user.getUserId(), org.getOrganisationId()); if (uo != null) { @@ -1045,18 +1087,21 @@ return userDTO != null ? userDTO.getUserID() : null; } + @Override public boolean isUserGlobalGroupAdmin() { Integer rootOrgId = getRootOrganisation().getOrganisationId(); Integer requestorId = getRequestorId(); return requestorId != null ? isUserInRole(requestorId, rootOrgId, Role.GROUP_ADMIN) : false; } + @Override public boolean isUserSysAdmin() { Integer rootOrgId = getRootOrganisation().getOrganisationId(); Integer requestorId = getRequestorId(); return requestorId != null ? isUserInRole(requestorId, rootOrgId, Role.SYSADMIN) : false; } + @Override public Integer getCountRoleForSystem(Integer roleId) { Integer count = roleDAO.getCountRoleForSystem(roleId); if (count != null) { @@ -1066,6 +1111,7 @@ } } + @Override public Integer getCountRoleForOrg(Integer orgId, Integer roleId) { Integer count = roleDAO.getCountRoleForOrg(roleId, orgId); if (count != null) { @@ -1075,25 +1121,29 @@ } } + @Override public Theme getDefaultFlashTheme() { String flashName = Configuration.get(ConfigurationKeys.DEFAULT_FLASH_THEME); List list = findByProperty(Theme.class, "name", flashName); return list != null ? (Theme) list.get(0) : null; } + @Override public Theme getDefaultHtmlTheme() { String htmlName = Configuration.get(ConfigurationKeys.DEFAULT_HTML_THEME); List list = findByProperty(Theme.class, "name", htmlName); return list != null ? (Theme) list.get(0) : null; } + @Override public void auditPasswordChanged(User user, String moduleName) { String[] args = new String[1]; args[0] = user.getLogin() + "(" + user.getUserId() + ")"; String message = messageService.getMessage("audit.user.password.change", args); getAuditService().log(moduleName, message); } + @Override public void auditUserCreated(User user, String moduleName) { String[] args = new String[2]; args[0] = user.getLogin() + "(" + user.getUserId() + ")"; @@ -1102,11 +1152,13 @@ getAuditService().log(moduleName, message); } + @Override public Integer getCountUsers() { String query = "select count(u) from User u"; return getFindIntegerResult(query); } + @Override public Integer getCountUsers(Integer authenticationMethodId) { String query = "select count(u) from User u " + "where u.authenticationMethod.authenticationMethodId=" + authenticationMethodId; @@ -1121,11 +1173,13 @@ return null; } + @Override public List getActiveCourseIdsByUser(Integer userId, boolean isSysadmin) { List list = organisationDAO.getActiveCourseIdsByUser(userId, isSysadmin); return populateCollapsedOrgDTOs(list, isSysadmin); } + @Override public List getArchivedCourseIdsByUser(Integer userId, boolean isSysadmin) { List list = organisationDAO.getArchivedCourseIdsByUser(userId, isSysadmin); return populateCollapsedOrgDTOs(list, isSysadmin); @@ -1157,6 +1211,7 @@ return dtoList; } + @Override public List searchUserSingleTerm(String term) { term = StringEscapeUtils.escapeSql(term); String query = "select u from User u where (u.login like '%" + term + "%' or u.firstName like '%" + term @@ -1166,6 +1221,7 @@ return list; } + @Override public List searchUserSingleTerm(String term, Integer filteredOrgId) { term = StringEscapeUtils.escapeSql(term); String query = "select u from User u where (u.login like '%" + term + "%' or u.firstName like '%" + term @@ -1176,6 +1232,7 @@ return list; } + @Override public List searchUserSingleTerm(String term, Integer orgId, Integer filteredOrgId) { term = StringEscapeUtils.escapeSql(term); String query = "select uo.user from UserOrganisation uo where (uo.user.login like '%" + term + "%'" @@ -1188,6 +1245,7 @@ return list; } + @Override public List searchUserSingleTerm(String term, Integer orgId, boolean includeChildOrgs) { term = StringEscapeUtils.escapeSql(term); String whereClause = ""; @@ -1203,30 +1261,35 @@ return list; } + @Override public List getAllUsers() { String query = "from User u where u.disabledFlag=0 order by u.login"; return baseDAO.find(query); } + @Override public List getAllUsers(Integer filteredOrgId) { String query = "from User u where u.disabledFlag=0 and u.userId not in" + " (select uo.user.userId from UserOrganisation uo where uo.organisation.organisationId=" + filteredOrgId + ")" + " order by u.login"; return baseDAO.find(query); } + @Override public List getAllUsersWithEmail(String email) { String query = "from User u where u.email=\'" + email + "\' order by u.login"; return baseDAO.find(query); } + @Override public List getUsersFromOrganisation(Integer orgId, Integer filteredOrgId) { String query = "select uo.user from UserOrganisation uo where uo.organisation.organisationId=" + orgId + " and uo.user.userId not in (select uo.user.userId from UserOrganisation uo" + " where uo.organisation.organisationId=" + filteredOrgId + ") order by uo.user.login"; return baseDAO.find(query); } + @Override public boolean canEditGroup(Integer userId, Integer orgId) { if (isUserSysAdmin() || isUserGlobalGroupAdmin()) { return true; @@ -1242,17 +1305,20 @@ return false; } + @Override public ForgotPasswordRequest getForgotPasswordRequest(String key) { List results = baseDAO.findByProperty(ForgotPasswordRequest.class, "requestKey", key); return results.isEmpty() ? null : (ForgotPasswordRequest) results.get(0); } + @Override public int removeUserFromOtherGroups(Integer userId, Integer orgId) { List uos = userOrganisationDAO.userOrganisationsNotById(userId, orgId); deleteAll(uos); return uos.size(); } + @Override public User getUserDTOByOpenidURL(String openidURL) { List results = baseDAO.findByProperty(User.class, "openidURL", openidURL); return results.isEmpty() ? null : (User) results.get(0); Index: lams_common/src/java/org/lamsfoundation/lams/util/LanguageUtil.java =================================================================== diff -u -r86672fe96b38e26e8e4641e91227f3d1c0bc7442 -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_common/src/java/org/lamsfoundation/lams/util/LanguageUtil.java (.../LanguageUtil.java) (revision 86672fe96b38e26e8e4641e91227f3d1c0bc7442) +++ lams_common/src/java/org/lamsfoundation/lams/util/LanguageUtil.java (.../LanguageUtil.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -32,7 +32,7 @@ import org.apache.commons.lang.StringUtils; import org.lamsfoundation.lams.usermanagement.SupportedLocale; import org.lamsfoundation.lams.usermanagement.service.IUserManagementService; -import org.lamsfoundation.lams.web.util.HttpSessionManager; +import org.lamsfoundation.lams.web.session.SessionManager; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -53,21 +53,20 @@ private static IUserManagementService service; private static IUserManagementService getService() { - if (service == null) { - WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(HttpSessionManager - .getInstance().getServletContext()); - service = (IUserManagementService) ctx.getBean("userManagementService"); + if (LanguageUtil.service == null) { + WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(SessionManager.getSession() + .getServletContext()); + LanguageUtil.service = (IUserManagementService) ctx.getBean("userManagementService"); } - return service; + return LanguageUtil.service; } - + public static void setService(IUserManagementService service) { LanguageUtil.service = service; } /** - * Get the default language, country, based on entries in the server - * configuration file. + * Get the default language, country, based on entries in the server configuration file. * * @return String[language, country] */ @@ -79,32 +78,36 @@ String serverLang = Configuration.get(ConfigurationKeys.SERVER_LANGUAGE); if (serverLang != null) { // assume either "en" or "en_AU" formats - if (serverLang.length() >= 2) + if (serverLang.length() >= 2) { languageIsoCode = serverLang.substring(0, 2); - if (serverLang.length() >= 5) + } + if (serverLang.length() >= 5) { countryIsoCode = serverLang.substring(3, 5); + } } // fallback to en_AU - if (languageIsoCode == null) - languageIsoCode = DEFAULT_LANGUAGE; - if (countryIsoCode == null) - languageIsoCode = DEFAULT_COUNTRY; + if (languageIsoCode == null) { + languageIsoCode = LanguageUtil.DEFAULT_LANGUAGE; + } + if (countryIsoCode == null) { + languageIsoCode = LanguageUtil.DEFAULT_COUNTRY; + } return new String[] { languageIsoCode, countryIsoCode }; } /** - * Get the default direction, based on the values in the server - * configuration file. + * Get the default direction, based on the values in the server configuration file. * * @return direction */ public static String getDefaultDirection() { String direction = Configuration.get(ConfigurationKeys.SERVER_PAGE_DIRECTION); - if (direction == null) - direction = DEFAULT_DIRECTION; + if (direction == null) { + direction = LanguageUtil.DEFAULT_DIRECTION; + } return direction; } @@ -122,49 +125,48 @@ */ public static SupportedLocale getDefaultLocale() { String localeName = Configuration.get(ConfigurationKeys.SERVER_LANGUAGE); - String langIsoCode = DEFAULT_LANGUAGE; - String countryIsoCode = DEFAULT_COUNTRY; - if (StringUtils.isNotBlank(localeName) && localeName.length() > 2) { + String langIsoCode = LanguageUtil.DEFAULT_LANGUAGE; + String countryIsoCode = LanguageUtil.DEFAULT_COUNTRY; + if (StringUtils.isNotBlank(localeName) && (localeName.length() > 2)) { langIsoCode = localeName.substring(0, 2); countryIsoCode = localeName.substring(3); } SupportedLocale locale = null; - locale = getSupportedLocaleOrNull(langIsoCode, countryIsoCode); + locale = LanguageUtil.getSupportedLocaleOrNull(langIsoCode, countryIsoCode); if (locale == null) { - locale = getSupportedLocaleOrNull(DEFAULT_LANGUAGE, DEFAULT_COUNTRY); + locale = LanguageUtil.getSupportedLocaleOrNull(LanguageUtil.DEFAULT_LANGUAGE, LanguageUtil.DEFAULT_COUNTRY); } return locale; } /** - * Searches for a locale based on language, then country, matching the - * single input string. Otherwise returns server default locale. + * Searches for a locale based on language, then country, matching the single input string. Otherwise returns server + * default locale. */ public static SupportedLocale getSupportedLocale(String input) { - List list = getService().findByProperty(SupportedLocale.class, "languageIsoCode", input); - if (list != null && list.size() > 0) { + List list = LanguageUtil.getService().findByProperty(SupportedLocale.class, "languageIsoCode", input); + if ((list != null) && (list.size() > 0)) { return (SupportedLocale) list.get(0); } else { - list = getService().findByProperty(SupportedLocale.class, "countryIsoCode", input); - if (list != null && list.size() > 0) { + list = LanguageUtil.getService().findByProperty(SupportedLocale.class, "countryIsoCode", input); + if ((list != null) && (list.size() > 0)) { return (SupportedLocale) list.get(0); } } - return getDefaultLocale(); + return LanguageUtil.getDefaultLocale(); } /** - * Finds a locale based on language and/or country, use server locale if - * invalid. + * Finds a locale based on language and/or country, use server locale if invalid. */ public static SupportedLocale getSupportedLocale(String langIsoCode, String countryIsoCode) { SupportedLocale locale = null; - locale = getSupportedLocaleOrNull(langIsoCode, countryIsoCode); + locale = LanguageUtil.getSupportedLocaleOrNull(langIsoCode, countryIsoCode); if (locale == null) { - locale = getDefaultLocale(); + locale = LanguageUtil.getDefaultLocale(); } return locale; @@ -188,8 +190,8 @@ return null; } - List list = getService().findByProperties(SupportedLocale.class, properties); - if (list != null && list.size() > 0) { + List list = LanguageUtil.getService().findByProperties(SupportedLocale.class, properties); + if ((list != null) && (list.size() > 0)) { Collections.sort(list); locale = (SupportedLocale) list.get(0); } else { Index: lams_common/src/java/org/lamsfoundation/lams/web/session/SessionManager.java =================================================================== diff -u -r0c0cbdac26679e47d5c48e045c30e5496e1f809b -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_common/src/java/org/lamsfoundation/lams/web/session/SessionManager.java (.../SessionManager.java) (revision 0c0cbdac26679e47d5c48e045c30e5496e1f809b) +++ lams_common/src/java/org/lamsfoundation/lams/web/session/SessionManager.java (.../SessionManager.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -30,6 +30,8 @@ import javax.servlet.http.HttpSession; public class SessionManager { + public static final String SYS_SESSION_COOKIE = "JSESSIONID"; + // singleton private static SessionManager sessionManager; private static final Map sessionContainer = new ConcurrentHashMap(); Index: lams_common/src/java/org/lamsfoundation/lams/web/session/SystemSessionFilter.java =================================================================== diff -u -r0c0cbdac26679e47d5c48e045c30e5496e1f809b -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_common/src/java/org/lamsfoundation/lams/web/session/SystemSessionFilter.java (.../SystemSessionFilter.java) (revision 0c0cbdac26679e47d5c48e045c30e5496e1f809b) +++ lams_common/src/java/org/lamsfoundation/lams/web/session/SystemSessionFilter.java (.../SystemSessionFilter.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -35,19 +35,12 @@ import javax.servlet.http.HttpServletResponse; /** + * This filter must set before org.lamsfoundation.lams.web.filter.LocaleFilter in web.xml + * because LocaleFilter need get value from SystemSession. * - * @author Steve.Ni Create and manage system wide (across multiple webapps in JBOSS) session. - * - *

- * NOTICE: This filter must set before org.lamsfoundation.lams.web.filter.LocaleFilter in web.xml - * because LocaleFilter need get value from SystemSession . - * - * @version $Revision$ + * @author Steve.Ni */ public class SystemSessionFilter implements Filter { - // The session cookie name to trace shared session - public static final String SYS_SESSION_COOKIE = "JSESSIONID"; - public void init(FilterConfig config) throws ServletException { } Index: lams_common/src/java/org/lamsfoundation/lams/web/util/HttpSessionManager.java =================================================================== diff -u -r0c0cbdac26679e47d5c48e045c30e5496e1f809b -r6cea41c13ae7d7ef330284fa195209b9c201e5d2 --- lams_common/src/java/org/lamsfoundation/lams/web/util/HttpSessionManager.java (.../HttpSessionManager.java) (revision 0c0cbdac26679e47d5c48e045c30e5496e1f809b) +++ lams_common/src/java/org/lamsfoundation/lams/web/util/HttpSessionManager.java (.../HttpSessionManager.java) (revision 6cea41c13ae7d7ef330284fa195209b9c201e5d2) @@ -23,13 +23,8 @@ /* $$Id$$ */ package org.lamsfoundation.lams.web.util; -import java.util.Collections; -import java.util.Enumeration; -import java.util.HashMap; import java.util.Locale; -import java.util.Map; -import javax.servlet.ServletContext; import javax.servlet.http.HttpSession; import javax.servlet.http.HttpSessionEvent; import javax.servlet.jsp.jstl.core.Config; @@ -39,106 +34,26 @@ import org.lamsfoundation.lams.web.filter.LocaleFilter; /** - * It is used to manage HttpSession according to lams configuration (in lams.xml file). There are 2 configuration items - * related to it. One is AllowMultipleLogin, the other is UserInactiveTimeout - *

- * When running with the test harness, need to set a configuration parameter allowMultipleLogins=true This disables the - * invalidation of older duplicated sessions - so that the poll and application test threads will run together. It - * shouldn't be run with this set to true in production as not all the sessions are tracked properly - only one session - * is tracked for each user. - *

- * Why isn't this class a servlet rather than a singleton? Because it doesn't directly serve data back to a webpage - - * its primary function is to return data to the controller. Yet it is in the "web" part of the system, so there is some - * argument for it being a servlet. An advantage of it being a servlet would be that we could probably make it directly - * a listener (rather than having a listener which calls this class), and we wouldn't need the test servlet - * ReportHttpSessionDataServlet to dump the current status to a webpage. - * - * @author Fei Yang - * + * Sets inactive timeout and locale in shared session. Also serves as a container for servlet context. */ public class HttpSessionManager { - private static HttpSessionManager instance = null; - private static ServletContext context = null; //for UniversalLoginModule to use + private static int timeout; //in seconds - private Map httpSessionsByLogin = null; // allows checking for two sessions - private int timeout;//in seconds - private boolean allowMultipleLogin; // must only be true for the test harness. - - private HttpSessionManager() { - httpSessionsByLogin = Collections.synchronizedMap(new HashMap()); - timeout = Configuration.getAsInt(ConfigurationKeys.INACTIVE_TIME); - allowMultipleLogin = Configuration.getAsBoolean(ConfigurationKeys.ALLOW_MULTIPLE_LOGIN); + static { + HttpSessionManager.timeout = Configuration.getAsInt(ConfigurationKeys.INACTIVE_TIME); } - public static HttpSessionManager getInstance() { - if (HttpSessionManager.instance == null) { - HttpSessionManager.instance = new HttpSessionManager(); - } - return HttpSessionManager.instance; - } - /** - * Get the user http session. - */ - public HttpSession getHttpSessionByLogin(String login) { - return httpSessionsByLogin.get(login); - } - - /** - * Update the user record - */ - public void updateHttpSessionByLogin(HttpSession session, String login) { - if (!allowMultipleLogin) { - if ((login == null) || (session == null)) { - return; - } - HttpSession oldSession = httpSessionsByLogin.get(login); - if (oldSession != null) { - if (oldSession.getId().equals(session.getId())) { - return; - } - try { - copySessionAttributes(oldSession, session); - oldSession.invalidate(); - } catch (IllegalStateException e) { - //it's already invalidated - //do nothing - } - } - httpSessionsByLogin.put(login, session); - } - } - - private void copySessionAttributes(HttpSession oldSession, HttpSession session) { - Enumeration enu = oldSession.getAttributeNames(); - while (enu.hasMoreElements()) { - String name = enu.nextElement(); - session.setAttribute(name, oldSession.getAttribute(name)); - } - } - - public ServletContext getServletContext() { - return HttpSessionManager.context; - } - - public void setServletContext(ServletContext context) { - if (HttpSessionManager.context == null) { - HttpSessionManager.context = context; - } - } - - /** * Matches sessionCreated in SessionListener, which implements the HttpSessionListener interface. SessionListener * passes the session event to here. Can't be accessed directly (ie defined in web.xml) in this class as this class * is a singleton and the creation method is private. */ - public void sessionCreated(HttpSessionEvent sessionEvent) { + public static void sessionCreated(HttpSessionEvent sessionEvent) { if (sessionEvent == null) { return; } HttpSession session = sessionEvent.getSession(); - session.setMaxInactiveInterval(timeout); - setServletContext(session.getServletContext()); + session.setMaxInactiveInterval(HttpSessionManager.timeout); //set server default locale for STURTS and JSTL. This value should be overwrite //LocaleFilter class. But this part code can cope with login.jsp Locale.