Changeset 34103

Timestamp:

2020-04-16T08:03:25+12:00 (4 years ago)

Author:

kjdon

Message:

a couple small modifications. when comparing srcdoc with filename - to see if the requested file is the main document or a supporting html image, we need to decode %20 to space - the filename coming from the browser will be URL encoded including spaces, but the srcfileLink in collection is url encoded but not the spaces. (why??). secondly, for fast view pdfs, chrome's pdf viewer may make several requests to get the doc for viewing. And then it makes another one for downloading. the verification is now done via ajax, and once that returns, then the page redirects to the pdf file. So we just return if we have successfully verified. We need to keep a short timer for that document so the browser can make more requests and not have to verify it. currently set to 2 hours.

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/URLFilter.java (modified) (13 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/URLFilter.java

@@ -93 +93 @@
   protected Hashtable<String, UserTimer> verifiedUserMap = null;
     // timeouts are in millisecs
+    // this is for if we have verify=once set in collectionConfig - the user will stay
+    // verified for 24 hours
   protected static final int verifiedUserTimeout = 24 * 60 * 60 * 1000;
-    protected static final int tempUserTimeout = 5 * 1000;
+    // this is a per document timeout - Chrome may make several requests to fetch a fastview pdf,
+    // plus another one if the user clicks download. Need to keep a record for a verified document
+    // so it can be fuly viewed and downloaded - get a network error if end up back at verification page.
+    // the user stays verified for the document for 2 hours.
+    protected static final int tempUserTimeout = 2 * 60 * 60 * 1000;
   
   public void init(FilterConfig filterConfig) throws ServletException
@@ -125 +131 @@
     // this is the part before the ?
     String url = hRequest.getRequestURI().toString();
-    if (isURLRestricted(url)) {
+     if (isURLRestricted(url)) {
       
       // TODO - should we make this a proper HTML page?
@@ -131 +137 @@
       return;
     }
-     
+
+
     // Run security checks on files requested from a collection's index/assoc folder
     if (url.contains(ASSOCIATED_FILE_PATH)) {
@@ -427 +434 @@
     String session_id = session.getId();
     ServletContext context = session.getServletContext();
-    logger.info("securityCheck, session id = "+session_id+", url = "+url);
+
         // now we need to get library name from the path, which is like
     // /greenstone3/library/sites/localsite/collect/collname/index/assoc/...
@@ -442 +449 @@
                 
     if (gsRouter == null) {  
-      logger.error("Receptionist is null, stopping filter");
+      logger.error("MR is null, stopping filter");
       return;
     }
@@ -536 +543 @@
     Element metadata_list = (Element)meta_response.getElementsByTagName(GSXML.METADATA_ELEM+GSXML.LIST_MODIFIER).item(0);
     String srcdoc = GSXML.getMetadataValue(metadata_list, "srclinkFile");
-    if (!srcdoc.equals(file_name)) {
+    //logger.debug("srcdoc="+srcdoc+", filename="+file_name+", %20 decoded filename="+file_name.replaceAll("\\%20|\\+", " "));
+    // If file_name is the main file for the document, then it will == srcdoc. Both of these are URL encoded, with the exception of spaces. Spaces will be encoded in file_name, but are not encoded in srcdoc. So need to decode those and check again.
+    // srcdoc.equals(java.net.URLDecoder.decode(file_name, "UTF-8")) - this didn't work as both are URLEncoded except for spaces 
+    if (!srcdoc.equals(file_name) && !srcdoc.equals(file_name.replaceAll("\\%20|\\+", " "))){
       // the specified file is just a supporting file, not the main file.
       // eg an image in an html doc.
@@ -573 +583 @@
       // we are asking for the main document, and we have been asked to verify the user 
       // have we done the test previously?
+          String verify_map_key = session_id + ":"+collection;
+          String verify_map_doc_key = verify_map_key + ":" + file_name; 
       boolean already_verified = false;
       String hmvf_response = request.getParameter(GSParams.VERIFIED);
@@ -578 +590 @@
           // manually force the t&c (user has added hmvf=0 to url)
           // whether we have previously verified or not
-      } else if (verifiedUserMap.containsKey(session_id)) {
+      } else if (verifiedUserMap.containsKey(verify_map_key) || verifiedUserMap.containsKey(verify_map_doc_key)) {
           already_verified = true;
       }
@@ -592 +604 @@
           if (result == Authentication.NO_ERROR) {
             already_verified = true;
-            
           } else {
             logger.error("something went wrong with recaptcha, error="+result);
@@ -601 +612 @@
             return;
           }
-            
-            
-          
         }
         already_verified = true;
         // set up a timer for this verification - standard 24hour if
-        // verify==once, 5 sec otherwise (browsers seem to be trying to
+        // verify==once, short, doc specific one otherwise (browsers seem to be trying to
         // download prfs twice. Chrome gets stuck if the second time
-        // doesn't get verified)
+        // doesn't get verified. Also Chrome sends a second request if the
+        // user tries to download the document after viewing it. )
         int delay;
+        String this_key;
         if (verify.equals("once")) {
             delay = verifiedUserTimeout;
+            this_key = verify_map_key;
         } else {
             delay = tempUserTimeout;
+            this_key = verify_map_doc_key;
         }
-        UserTimer timer = new UserTimer(delay, session_id);
-        verifiedUserMap.put(session_id, timer);
+        UserTimer timer = new UserTimer(delay, this_key);
+        verifiedUserMap.put(this_key, timer);
         timer.start();
-        
+        // For the verify page, we just return back to the browser, as we have called this
+        // using ajax.
+        return;
           
           } // hmvf = 1
@@ -628 +642 @@
         // or we have been asked to force the T&C
         // we need to display the verify page
-          logger.info("displaying verify page for url " + url);
-        String new_url = context.getContextPath()+"/"+ library_name+"?a=p&sa=verify&c="+collection+"&url="+url;             
+          //Lets encode the url parameter as we need it encoded in the page.
+          String new_url = context.getContextPath()+"/"+ library_name+"?a=p&sa=verify&c="+collection+"&url="+java.net.URLEncoder.encode(url, "UTF-8");
         ((HttpServletResponse)response).sendRedirect(new_url);
         return;
@@ -636 +650 @@
     }// end if verifiable file 
     
-    logger.info("have passed security checks");     
     // if we got here, we have passed all security checks and just want to view the file.
     // However, we need to remove the library_name from the URL. As can't change the
@@ -645 +658 @@
     url = url.replaceFirst(context.getContextPath(), "");
     url = url.replaceFirst("/"+library_name, "");
-    logger.info("forwarding to url "+url);
+    //logger.info("forwarding to "+url);
     request.getRequestDispatcher(url).forward(request, response);