Index: /main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/URLFilter.java
===================================================================
--- /main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/URLFilter.java	(revision 34102)
+++ /main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/URLFilter.java	(revision 34103)
@@ -93,6 +93,12 @@
   protected Hashtable<String, UserTimer> verifiedUserMap = null;
     // timeouts are in millisecs
+    // this is for if we have verify=once set in collectionConfig - the user will stay
+    // verified for 24 hours
   protected static final int verifiedUserTimeout = 24 * 60 * 60 * 1000;
-    protected static final int tempUserTimeout = 5 * 1000;
+    // this is a per document timeout - Chrome may make several requests to fetch a fastview pdf,
+    // plus another one if the user clicks download. Need to keep a record for a verified document
+    // so it can be fuly viewed and downloaded - get a network error if end up back at verification page.
+    // the user stays verified for the document for 2 hours.
+    protected static final int tempUserTimeout = 2 * 60 * 60 * 1000;
   
   public void init(FilterConfig filterConfig) throws ServletException
@@ -125,5 +131,5 @@
     // this is the part before the ?
     String url = hRequest.getRequestURI().toString();
-    if (isURLRestricted(url)) {
+     if (isURLRestricted(url)) {
       
       // TODO - should we make this a proper HTML page?
@@ -131,5 +137,6 @@
       return;
     }
-     
+
+
     // Run security checks on files requested from a collection's index/assoc folder
     if (url.contains(ASSOCIATED_FILE_PATH)) {
@@ -427,5 +434,5 @@
 	String session_id = session.getId();
 	ServletContext context = session.getServletContext();
-	logger.info("securityCheck, session id = "+session_id+", url = "+url);
+
     	// now we need to get library name from the path, which is like
 	// /greenstone3/library/sites/localsite/collect/collname/index/assoc/...
@@ -442,5 +449,5 @@
 				
 	if (gsRouter == null) {  
-	  logger.error("Receptionist is null, stopping filter");
+	  logger.error("MR is null, stopping filter");
 	  return;
 	}
@@ -536,5 +543,8 @@
 	Element metadata_list = (Element)meta_response.getElementsByTagName(GSXML.METADATA_ELEM+GSXML.LIST_MODIFIER).item(0);
 	String srcdoc = GSXML.getMetadataValue(metadata_list, "srclinkFile");
-	if (!srcdoc.equals(file_name)) {
+	//logger.debug("srcdoc="+srcdoc+", filename="+file_name+", %20 decoded filename="+file_name.replaceAll("\\%20|\\+", " "));
+	// If file_name is the main file for the document, then it will == srcdoc. Both of these are URL encoded, with the exception of spaces. Spaces will be encoded in file_name, but are not encoded in srcdoc. So need to decode those and check again.
+	// srcdoc.equals(java.net.URLDecoder.decode(file_name, "UTF-8")) - this didn't work as both are URLEncoded except for spaces 
+	if (!srcdoc.equals(file_name) && !srcdoc.equals(file_name.replaceAll("\\%20|\\+", " "))){
 	  // the specified file is just a supporting file, not the main file.
 	  // eg an image in an html doc.
@@ -573,4 +583,6 @@
 	  // we are asking for the main document, and we have been asked to verify the user 
 	  // have we done the test previously?
+	      String verify_map_key = session_id + ":"+collection;
+	      String verify_map_doc_key = verify_map_key + ":" + file_name; 
 	  boolean already_verified = false;
 	  String hmvf_response = request.getParameter(GSParams.VERIFIED);
@@ -578,5 +590,5 @@
 	      // manually force the t&c (user has added hmvf=0 to url)
 	      // whether we have previously verified or not
-	  } else if (verifiedUserMap.containsKey(session_id)) {
+	  } else if (verifiedUserMap.containsKey(verify_map_key) || verifiedUserMap.containsKey(verify_map_doc_key)) {
 	      already_verified = true;
 	  }
@@ -592,5 +604,4 @@
 		  if (result == Authentication.NO_ERROR) {
 		    already_verified = true;
-		    
 		  } else {
 		    logger.error("something went wrong with recaptcha, error="+result);
@@ -601,23 +612,26 @@
 		    return;
 		  }
-		    
-		    
-		  
 		}
 		already_verified = true;
 		// set up a timer for this verification - standard 24hour if
-		// verify==once, 5 sec otherwise (browsers seem to be trying to
+		// verify==once, short, doc specific one otherwise (browsers seem to be trying to
 		// download prfs twice. Chrome gets stuck if the second time
-		// doesn't get verified)
+		// doesn't get verified. Also Chrome sends a second request if the
+		// user tries to download the document after viewing it. )
 		int delay;
+		String this_key;
 		if (verify.equals("once")) {
 		    delay = verifiedUserTimeout;
+		    this_key = verify_map_key;
 		} else {
 		    delay = tempUserTimeout;
+		    this_key = verify_map_doc_key;
 		}
-		UserTimer timer = new UserTimer(delay, session_id);
-		verifiedUserMap.put(session_id, timer);
+		UserTimer timer = new UserTimer(delay, this_key);
+		verifiedUserMap.put(this_key, timer);
 		timer.start();
-		
+		// For the verify page, we just return back to the browser, as we have called this
+		// using ajax.
+		return;
 	      
 	      } // hmvf = 1
@@ -628,6 +642,6 @@
 	    // or we have been asked to force the T&C
 	    // we need to display the verify page
-	      logger.info("displaying verify page for url " + url);
-	    String new_url = context.getContextPath()+"/"+ library_name+"?a=p&sa=verify&c="+collection+"&url="+url;			    
+	      //Lets encode the url parameter as we need it encoded in the page.
+	      String new_url = context.getContextPath()+"/"+ library_name+"?a=p&sa=verify&c="+collection+"&url="+java.net.URLEncoder.encode(url, "UTF-8");
 	    ((HttpServletResponse)response).sendRedirect(new_url);
 	    return;
@@ -636,5 +650,4 @@
 	}// end if verifiable file 
     
-	logger.info("have passed security checks");		
 	// if we got here, we have passed all security checks and just want to view the file.
 	// However, we need to remove the library_name from the URL. As can't change the
@@ -645,5 +658,5 @@
 	url = url.replaceFirst(context.getContextPath(), "");
 	url = url.replaceFirst("/"+library_name, "");
-	logger.info("forwarding to url "+url);
+	//logger.info("forwarding to "+url);
 	request.getRequestDispatcher(url).forward(request, response);
 
