if (uri == null) {
log.warning(L.l("FormLogin: session has timed out for session '{0}'",
req.getSession().getId()));
RequestDispatcher disp = request.getRequestDispatcher("/");
if (disp != null) {
disp.forward(request, response);
return;
}
else {
throw new ServletException(L.l("Session has timed out for form authentication, no forwarding URI is available. Either the login form must specify j_uri or the session must have a saved URI."));
}
}
if (uri.indexOf('\n') >= 0 || uri.indexOf('\r') >= 0)
throw new ServletException(L.l("Forwarding URI '{0}' is invalid.",
uri));
String uriPwd = req.getRequestURI();
int p = uriPwd.indexOf("/j_security_check");
if (p >= 0)
uriPwd = uriPwd.substring(0, p + 1);
if (uri.length() == 0) {
}
else if (uri.charAt(0) == '/')
uri = req.getContextPath() + uri;
else if (uri.indexOf(':') >= 0 &&
(uri.indexOf(':') < uri.indexOf('/') ||
uri.indexOf('/') < 0)) {
}
else {
uri = uriPwd + uri;
}
// The spec says that a successful login uses a redirect. Resin
// adds a configuration option to allow an internal forward
// if the URL is in the same directory.
// Logins to POST pages need to use an internal forward.
// Most GETs will want a redirect.
boolean useInternalForward = login.getInternalForward();
if (useInternalForward
&& uri.startsWith(uriPwd)
&& uri.indexOf('/', uriPwd.length() + 1) < 0) {
WebApp newApp = (WebApp) webApp.getContext(uri);
String suffix = uri.substring(newApp.getContextPath().length());
// force authorization of the page because the normal forward()
// bypasses authorization
RequestDispatcher disp = newApp.getLoginDispatcher(suffix);
if (disp != null) {
disp.forward(req, res);
return;
}
}
res.sendRedirect(res.encodeRedirectURL(uri));