diff --git a/applications/content/webapp/content/WEB-INF/controller.xml b/applications/content/webapp/content/WEB-INF/controller.xml
index 1667d087b00..87e72b564e8 100644
--- a/applications/content/webapp/content/WEB-INF/controller.xml
+++ b/applications/content/webapp/content/WEB-INF/controller.xml
@@ -1851,7 +1851,7 @@ under the License.
-
+
diff --git a/framework/webapp/dtd/site-conf.xsd b/framework/webapp/dtd/site-conf.xsd
index 8f3bf3732c1..cf6c63b9779 100644
--- a/framework/webapp/dtd/site-conf.xsd
+++ b/framework/webapp/dtd/site-conf.xsd
@@ -776,6 +776,25 @@ under the License.
+
+
+
+ This attribute determines whether direct rendering of the view is allowed when using the override view functionality.
+ If set to true,
+ the system permits the view to be rendered directly using the override view functionality.
+ If false or not specified,
+ direct rendering is not allowed, and system throws Unknown request exception.
+
+
+
+
+
+
+ If direct-view-rendering-with-auth=true, direct rendering of the view is only allowed with an active login when using the override view functionality.
+ If direct-view-rendering-with-auth=false, no active login is required.
+
+
+
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java
index 1ed0a0a8cd3..9cb1aa616fb 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java
@@ -1044,6 +1044,8 @@ public static class ViewMap {
private String strictTransportSecurity;
private String description;
private boolean noCache = false;
+ private boolean allowDirectViewRendering = false;
+ private boolean directViewRenderingWithAuth = false;
/**
* Gets name.
@@ -1120,6 +1122,24 @@ public String getContentType() {
return contentType;
}
+ /**
+ * allow direct view rendering boolean
+ *
+ * @return the boolean
+ */
+ public boolean isAllowDirectViewRendering() {
+ return this.allowDirectViewRendering;
+ }
+
+ /**
+ * direct view rendering with authentication boolean
+ *
+ * @return the boolean
+ */
+ public boolean isDirectViewRenderingWithAuth() {
+ return this.directViewRenderingWithAuth;
+ }
+
/**
* Gets encoding.
* @return the encoding
@@ -1135,6 +1155,8 @@ public ViewMap(Element viewMapElement) {
this.info = viewMapElement.getAttribute("info");
this.contentType = viewMapElement.getAttribute("content-type");
this.noCache = "true".equals(viewMapElement.getAttribute("no-cache"));
+ this.allowDirectViewRendering = "true".equals(viewMapElement.getAttribute("allow-direct-view-rendering"));
+ this.directViewRenderingWithAuth = "true".equals(viewMapElement.getAttribute("direct-view-rendering-with-auth"));
this.encoding = viewMapElement.getAttribute("encoding");
this.xFrameOption = viewMapElement.getAttribute("x-frame-options");
this.strictTransportSecurity = viewMapElement.getAttribute("strict-transport-security");
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
index 1e6f110c2b2..e3cb6ce8bc6 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
@@ -129,14 +129,18 @@ static Collection resolveURI(ControllerConfig ccfg, HttpServletReque
Map> requestMapMap = ccfg.getRequestMapMultiMap();
Collection rmaps = resolveTemplateURI(requestMapMap, req);
if (rmaps.isEmpty()) {
- Map viewMapMap = ccfg.getViewMapMap();
String defaultRequest = ccfg.getDefaultRequest();
String path = req.getPathInfo();
String requestUri = getRequestUri(path);
String overrideViewUri = getOverrideViewUri(path);
+ boolean allowDirectViewRendering = false;
+ // Ensure that overridden view exists and direct view rendering is allowed.
+ if (UtilValidate.isNotEmpty(overrideViewUri)) {
+ ConfigXMLReader.ViewMap overrideViewMap = ccfg.getViewMapMap().get(overrideViewUri);
+ allowDirectViewRendering = (overrideViewMap != null && overrideViewMap.isAllowDirectViewRendering());
+ }
if (requestMapMap.containsKey(requestUri)
- // Ensure that overridden view exists.
- && (overrideViewUri == null || viewMapMap.containsKey(overrideViewUri)
+ && (allowDirectViewRendering
|| ("SOAPService".equals(requestUri) && "wsdl".equalsIgnoreCase(req.getQueryString())))) {
rmaps = requestMapMap.get(requestUri);
req.setAttribute("overriddenView", overrideViewUri);
@@ -606,7 +610,13 @@ public void doRequest(HttpServletRequest request, HttpServletResponse response,
}
// Perform security check.
- if (requestMap.isSecurityAuth()) {
+ boolean directViewRenderingWithAuth = false;
+ // Check if direct view rendering requires authentication.
+ if (UtilValidate.isNotEmpty(overrideViewUri)) {
+ ConfigXMLReader.ViewMap overrideViewMap = ccfg.getViewMapMap().get(overrideViewUri);
+ directViewRenderingWithAuth = (overrideViewMap != null && overrideViewMap.isDirectViewRenderingWithAuth());
+ }
+ if (requestMap.isSecurityAuth() || directViewRenderingWithAuth) {
// Invoke the security handler
// catch exceptions and throw RequestHandlerException if failed.
if (Debug.verboseOn()) {
@@ -629,6 +639,8 @@ public void doRequest(HttpServletRequest request, HttpServletResponse response,
} else {
requestMap = ccfg.getRequestMapMap().get("ajaxCheckLogin");
}
+ // overrideViewUri needs to be deleted, as there is no authentication
+ overrideViewUri = null;
}
} else if (requestUri != null) {
String[] loginUris = EntityUtilProperties.getPropertyValue("security", "login.uris", delegator).split(",");
diff --git a/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java b/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java
index 9ba9ecab589..384cffbbec3 100644
--- a/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java
+++ b/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java
@@ -46,6 +46,7 @@
import org.junit.Before;
import org.junit.Test;
import org.w3c.dom.Element;
+import org.mockito.Mockito;
public class RequestHandlerTests {
public static class ResolveURITests {
@@ -190,10 +191,12 @@ public void resolveURIBasicOverrideView() throws Exception {
reqMaps.putSingle("foo", foo);
reqMaps.putSingle("bar", bar);
- viewMaps.put("baz", new ViewMap(dummyElement));
+ //viewMaps.put("baz", new ViewMap(dummyElement));
+ viewMaps.put("baz", Mockito.mock(ViewMap.class)); // Mock the ViewMap
when(req.getPathInfo()).thenReturn("/foo/baz");
when(ccfg.getDefaultRequest()).thenReturn("bar");
+ when(viewMaps.get("baz").isAllowDirectViewRendering()).thenReturn(true);
assertThat(RequestHandler.resolveURI(ccfg, req), hasItem(foo));
}