-
Notifications
You must be signed in to change notification settings - Fork 134
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Revert "Removed deprecated code since 1.3"
This reverts commit ac0e9b9.
- Loading branch information
Showing
35 changed files
with
312 additions
and
47 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
59 changes: 59 additions & 0 deletions
59
.../main/java/com/gwtplatform/dispatch/rpc/server/guice/HttpSessionSecurityCookieFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| /* | ||
| * Copyright 2011 ArcBees Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); you may not | ||
| * use this file except in compliance with the License. You may obtain a copy of | ||
| * the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations under | ||
| * the License. | ||
| */ | ||
|
|
||
| package com.gwtplatform.dispatch.rpc.server.guice; | ||
|
|
||
| import javax.inject.Inject; | ||
| import javax.inject.Provider; | ||
| import javax.inject.Singleton; | ||
| import javax.servlet.http.HttpSession; | ||
|
|
||
| import com.gwtplatform.dispatch.rpc.server.AbstractHttpSessionSecurityCookieFilter; | ||
| import com.gwtplatform.dispatch.shared.SecurityCookie; | ||
|
|
||
| /** | ||
| * This filter will automatically inject a security cookie inside the request the first time the page is loaded. This | ||
| * security cookie is based on the {@link HttpSession} and will only work if the session is enabled. To setup this | ||
| * filter, add the following line at before any other {@code serve} call in your own | ||
| * {@link com.google.inject.servlet.ServletModule#configureServlets}: | ||
| * <p/> | ||
| * <pre> | ||
| * filter("*.jsp").through(HttpSessionSecurityCookieFilter.class); | ||
| * </pre> | ||
| * <p/> | ||
| * You also have to use a {@code .jsp} file instead of a {@code .html} as your main GWT file. | ||
| * | ||
| * @deprecated Please use {@link com.gwtplatform.dispatch.rpc.server.guice.RandomSecurityCookieFilter}. | ||
| * Using the JSESSIONID like this might let an XSS attacker hijack a session. See GitHub issue #484 | ||
| */ | ||
| @Deprecated | ||
| @Singleton | ||
| public class HttpSessionSecurityCookieFilter extends AbstractHttpSessionSecurityCookieFilter { | ||
|
|
||
| private final Provider<HttpSession> session; | ||
|
|
||
| @Inject | ||
| HttpSessionSecurityCookieFilter(@SecurityCookie String securityCookieName, Provider<HttpSession> session) { | ||
| super(securityCookieName); | ||
| this.session = session; | ||
| } | ||
|
|
||
| @Override | ||
| protected HttpSession getSession() { | ||
| return session.get(); | ||
| } | ||
|
|
||
| } |
40 changes: 40 additions & 0 deletions
40
...main/java/com/gwtplatform/dispatch/rpc/server/spring/HttpSessionSecurityCookieFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| /* | ||
| * Copyright 2011 ArcBees Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); you may not | ||
| * use this file except in compliance with the License. You may obtain a copy of | ||
| * the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations under | ||
| * the License. | ||
| */ | ||
|
|
||
| package com.gwtplatform.dispatch.rpc.server.spring; | ||
|
|
||
| import javax.servlet.http.HttpSession; | ||
|
|
||
| import org.springframework.web.context.request.RequestContextHolder; | ||
| import org.springframework.web.context.request.ServletRequestAttributes; | ||
|
|
||
| import com.gwtplatform.dispatch.rpc.server.AbstractHttpSessionSecurityCookieFilter; | ||
|
|
||
| /** | ||
| * @deprecated Please use {@link com.gwtplatform.dispatch.rpc.server.spring.RandomSecurityCookieFilter}. | ||
| * Using the JSESSIONID like this might let an XSS attacker hijack a session. See GitHub issue #484 | ||
| */ | ||
| @Deprecated | ||
| public class HttpSessionSecurityCookieFilter extends AbstractHttpSessionSecurityCookieFilter { | ||
| public HttpSessionSecurityCookieFilter(String securityCookieName) { | ||
| super(securityCookieName); | ||
| } | ||
|
|
||
| @Override | ||
| protected HttpSession getSession() { | ||
| return ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest().getSession(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
76 changes: 76 additions & 0 deletions
76
...ain/java/com/gwtplatform/dispatch/rpc/server/AbstractHttpSessionSecurityCookieFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| /* | ||
| * Copyright 2011 ArcBees Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); you may not | ||
| * use this file except in compliance with the License. You may obtain a copy of | ||
| * the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations under | ||
| * the License. | ||
| */ | ||
|
|
||
| package com.gwtplatform.dispatch.rpc.server; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| import javax.servlet.Filter; | ||
| import javax.servlet.FilterChain; | ||
| import javax.servlet.FilterConfig; | ||
| import javax.servlet.ServletException; | ||
| import javax.servlet.ServletRequest; | ||
| import javax.servlet.ServletResponse; | ||
| import javax.servlet.http.Cookie; | ||
| import javax.servlet.http.HttpServletRequest; | ||
| import javax.servlet.http.HttpServletResponse; | ||
| import javax.servlet.http.HttpSession; | ||
|
|
||
| /** | ||
| * This filter will automatically inject a security cookie inside the request the first time the page is loaded. This | ||
| * security cookie is based on the {@link HttpSession} and will only work if the session is enabled. To setup this | ||
| * filter, add the following line at before any other {@code serve} call in your own | ||
| * {@link com.google.inject.servlet.ServletModule#configureServlets}: | ||
| * <p/> | ||
| * <pre> | ||
| * filter("*.jsp").through(HttpSessionSecurityCookieFilter.class); | ||
| * </pre> | ||
| * <p/> | ||
| * You also have to use a {@code .jsp} file instead of a {@code .html} as your main GWT file. | ||
| * | ||
| * @deprecated Please use {@link com.gwtplatform.dispatch.rpc.server.AbstractRandomSecurityCookieFilter}. | ||
| * Using the JSESSIONID like this might let an XSS attacker hijack a session. See GitHub issue #484 | ||
| */ | ||
| @Deprecated | ||
| public abstract class AbstractHttpSessionSecurityCookieFilter implements Filter { | ||
|
|
||
| private final String securityCookieName; | ||
|
|
||
| protected AbstractHttpSessionSecurityCookieFilter(String securityCookieName) { | ||
| this.securityCookieName = securityCookieName; | ||
| } | ||
|
|
||
| public void destroy() { | ||
| } | ||
|
|
||
| protected abstract HttpSession getSession(); | ||
|
|
||
| public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, | ||
| ServletException { | ||
|
|
||
| if (request instanceof HttpServletRequest) { | ||
| HttpServletResponse httpResponse = (HttpServletResponse) response; | ||
| Cookie securityCookie = new Cookie(securityCookieName, getSession().getId()); | ||
| securityCookie.setMaxAge(-1); | ||
| securityCookie.setPath("/"); | ||
| httpResponse.addCookie(securityCookie); | ||
| } | ||
| chain.doFilter(request, response); | ||
| } | ||
|
|
||
| public void init(FilterConfig filterConfig) throws ServletException { | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.