diff --git a/applications/content/webapp/content/WEB-INF/controller.xml b/applications/content/webapp/content/WEB-INF/controller.xml index 1667d087b00..87e72b564e8 100644 --- a/applications/content/webapp/content/WEB-INF/controller.xml +++ b/applications/content/webapp/content/WEB-INF/controller.xml @@ -1851,7 +1851,7 @@ under the License. - + diff --git a/framework/webapp/dtd/site-conf.xsd b/framework/webapp/dtd/site-conf.xsd index 8f3bf3732c1..cf6c63b9779 100644 --- a/framework/webapp/dtd/site-conf.xsd +++ b/framework/webapp/dtd/site-conf.xsd @@ -776,6 +776,25 @@ under the License. + + + + This attribute determines whether direct rendering of the view is allowed when using the override view functionality. + If set to true, + the system permits the view to be rendered directly using the override view functionality. + If false or not specified, + direct rendering is not allowed, and system throws Unknown request exception. + + + + + + + If direct-view-rendering-with-auth=true, direct rendering of the view is only allowed with an active login when using the override view functionality. + If direct-view-rendering-with-auth=false, no active login is required. + + + diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java index 1ed0a0a8cd3..9cb1aa616fb 100644 --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ConfigXMLReader.java @@ -1044,6 +1044,8 @@ public static class ViewMap { private String strictTransportSecurity; private String description; private boolean noCache = false; + private boolean allowDirectViewRendering = false; + private boolean directViewRenderingWithAuth = false; /** * Gets name. @@ -1120,6 +1122,24 @@ public String getContentType() { return contentType; } + /** + * allow direct view rendering boolean + * + * @return the boolean + */ + public boolean isAllowDirectViewRendering() { + return this.allowDirectViewRendering; + } + + /** + * direct view rendering with authentication boolean + * + * @return the boolean + */ + public boolean isDirectViewRenderingWithAuth() { + return this.directViewRenderingWithAuth; + } + /** * Gets encoding. * @return the encoding @@ -1135,6 +1155,8 @@ public ViewMap(Element viewMapElement) { this.info = viewMapElement.getAttribute("info"); this.contentType = viewMapElement.getAttribute("content-type"); this.noCache = "true".equals(viewMapElement.getAttribute("no-cache")); + this.allowDirectViewRendering = "true".equals(viewMapElement.getAttribute("allow-direct-view-rendering")); + this.directViewRenderingWithAuth = "true".equals(viewMapElement.getAttribute("direct-view-rendering-with-auth")); this.encoding = viewMapElement.getAttribute("encoding"); this.xFrameOption = viewMapElement.getAttribute("x-frame-options"); this.strictTransportSecurity = viewMapElement.getAttribute("strict-transport-security"); diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java index 1e6f110c2b2..e3cb6ce8bc6 100644 --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java @@ -129,14 +129,18 @@ static Collection resolveURI(ControllerConfig ccfg, HttpServletReque Map> requestMapMap = ccfg.getRequestMapMultiMap(); Collection rmaps = resolveTemplateURI(requestMapMap, req); if (rmaps.isEmpty()) { - Map viewMapMap = ccfg.getViewMapMap(); String defaultRequest = ccfg.getDefaultRequest(); String path = req.getPathInfo(); String requestUri = getRequestUri(path); String overrideViewUri = getOverrideViewUri(path); + boolean allowDirectViewRendering = false; + // Ensure that overridden view exists and direct view rendering is allowed. + if (UtilValidate.isNotEmpty(overrideViewUri)) { + ConfigXMLReader.ViewMap overrideViewMap = ccfg.getViewMapMap().get(overrideViewUri); + allowDirectViewRendering = (overrideViewMap != null && overrideViewMap.isAllowDirectViewRendering()); + } if (requestMapMap.containsKey(requestUri) - // Ensure that overridden view exists. - && (overrideViewUri == null || viewMapMap.containsKey(overrideViewUri) + && (allowDirectViewRendering || ("SOAPService".equals(requestUri) && "wsdl".equalsIgnoreCase(req.getQueryString())))) { rmaps = requestMapMap.get(requestUri); req.setAttribute("overriddenView", overrideViewUri); @@ -606,7 +610,13 @@ public void doRequest(HttpServletRequest request, HttpServletResponse response, } // Perform security check. - if (requestMap.isSecurityAuth()) { + boolean directViewRenderingWithAuth = false; + // Check if direct view rendering requires authentication. + if (UtilValidate.isNotEmpty(overrideViewUri)) { + ConfigXMLReader.ViewMap overrideViewMap = ccfg.getViewMapMap().get(overrideViewUri); + directViewRenderingWithAuth = (overrideViewMap != null && overrideViewMap.isDirectViewRenderingWithAuth()); + } + if (requestMap.isSecurityAuth() || directViewRenderingWithAuth) { // Invoke the security handler // catch exceptions and throw RequestHandlerException if failed. if (Debug.verboseOn()) { @@ -629,6 +639,8 @@ public void doRequest(HttpServletRequest request, HttpServletResponse response, } else { requestMap = ccfg.getRequestMapMap().get("ajaxCheckLogin"); } + // overrideViewUri needs to be deleted, as there is no authentication + overrideViewUri = null; } } else if (requestUri != null) { String[] loginUris = EntityUtilProperties.getPropertyValue("security", "login.uris", delegator).split(","); diff --git a/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java b/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java index 9ba9ecab589..384cffbbec3 100644 --- a/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java +++ b/framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/RequestHandlerTests.java @@ -46,6 +46,7 @@ import org.junit.Before; import org.junit.Test; import org.w3c.dom.Element; +import org.mockito.Mockito; public class RequestHandlerTests { public static class ResolveURITests { @@ -190,10 +191,12 @@ public void resolveURIBasicOverrideView() throws Exception { reqMaps.putSingle("foo", foo); reqMaps.putSingle("bar", bar); - viewMaps.put("baz", new ViewMap(dummyElement)); + //viewMaps.put("baz", new ViewMap(dummyElement)); + viewMaps.put("baz", Mockito.mock(ViewMap.class)); // Mock the ViewMap when(req.getPathInfo()).thenReturn("/foo/baz"); when(ccfg.getDefaultRequest()).thenReturn("bar"); + when(viewMaps.get("baz").isAllowDirectViewRendering()).thenReturn(true); assertThat(RequestHandler.resolveURI(ccfg, req), hasItem(foo)); }