package org.apache.turbine.modules.actions.sessionvalidator;

 import org.apache.turbine.TurbineConstants;

 import org.apache.turbine.annotation.TurbineConfiguration;

 import org.apache.turbine.annotation.TurbineService;

 /*

  * Licensed to the Apache Software Foundation (ASF) under one

  * or more contributor license agreements.  See the NOTICE file

  * distributed with this work for additional information

  * regarding copyright ownership.  The ASF licenses this file

  * to you under the Apache License, Version 2.0 (the

  * "License"); you may not use this file except in compliance

  * with the License.  You may obtain a copy of the License at

  *

  *   http://www.apache.org/licenses/LICENSE-2.0

  *

  * Unless required by applicable law or agreed to in writing,

  * software distributed under the License is distributed on an

  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

  * KIND, either express or implied.  See the License for the

  * specific language governing permissions and limitations

  * under the License.

  */

 import org.apache.turbine.modules.Action;

 import org.apache.turbine.services.security.SecurityService;

 import org.apache.turbine.util.RunData;

 /**

  * The SessionValidator attempts to retrieve the User object from the

  * Servlet API session that is associated with the request.  If the

  * data cannot be retrieved, it is handled here.  If the user has not

  * been marked as being logged into the system, the user is rejected

  * and the screen is set to the screen.homepage value in

  * TurbineResources.properties.

  *

  * <p>

  * Other systems generally have a database table which stores this

  * information, but we take advantage of the Servlet API here to save

  * a hit to the database for each and every connection that a user

  * makes.

  * </p>

  *

  * <p>

  * This action is special in that it should only be executed by the

  * Turbine servlet.

  * </p>

  *

  * @author <a href="mailto:mbryson@mont.mindspring.com">Dave Bryson</a>

  * @version $Id: SessionValidator.java 1854786 2019-03-04 18:29:18Z tv $

  */

 public abstract class SessionValidator implements Action

 {

     @TurbineService

     protected SecurityService security;

     @TurbineConfiguration( TurbineConstants.TEMPLATE_HOMEPAGE )

     protected String templateHomepage;

     @TurbineConfiguration( TurbineConstants.SCREEN_HOMEPAGE )

     protected String screenHomepage;

     @TurbineConfiguration( TurbineConstants.TEMPLATE_INVALID_STATE )

     protected String templateInvalidState;

     @TurbineConfiguration( TurbineConstants.SCREEN_INVALID_STATE )

     protected String screenInvalidState;

     // the session_access_counter can be placed as a hidden field in

     // forms.  This can be used to prevent a user from using the

     // browsers back button and submitting stale data.

     /**

      *

      * @param data RunData object

      * @param screenOnly {@link DefaultSessionValidator}

      */

     protected void handleFormCounterToken( RunData data, boolean screenOnly )

     {

         if (data.getParameters().containsKey("_session_access_counter"))

         {

             if (screenOnly) {

                 // See comments in screens.error.InvalidState.

                 if (data.getParameters().getInt("_session_access_counter")

                         < (((Integer) data.getUser().getTemp(

                         "_session_access_counter")).intValue() - 1))

                 {

                     data.getUser().setTemp("prev_screen", data.getScreen());

                     data.getUser().setTemp("prev_parameters", data.getParameters());

                     data.setScreen(screenInvalidState);

                     data.setAction("");

                 }

             } else {

                 if (!security.isAnonymousUser(data.getUser()))

                 {

                     // See comments in screens.error.InvalidState.

                     if (data.getParameters().getInt("_session_access_counter")

                             < (((Integer) data.getUser().getTemp(

                             "_session_access_counter")).intValue() - 1))

                     {

                         if (data.getTemplateInfo().getScreenTemplate() != null)

                         {

                             data.getUser().setTemp("prev_template",

                                     data.getTemplateInfo().getScreenTemplate()

                                     .replace('/', ','));

                             data.getTemplateInfo().setScreenTemplate(templateInvalidState);

                         }

                         else

                         {

                             data.getUser().setTemp("prev_screen",

                                                    data.getScreen().replace('/', ','));

                             data.setScreen(screenInvalidState);

                         }

                         data.getUser().setTemp("prev_parameters", data.getParameters());

                         data.setAction("");

                     }

                 }

             }

         }

     }

     // empty

 }