{path = path.substring(0, p);}
path = getServletContext().getRealPath(path);
}
//second, perform descriptor actions
final Descriptor descriptor = Descriptor.getDescriptorSingleton();
if(descriptor != null && !descriptor.requestsFiltered()) {
//logs the request if specified in the descriptor
descriptor.doLogRequestInReplayLog(request);
//map's the path if a mapping is specified in the descriptor
path = descriptor.mapPath(path);
}
// if (request.getCharacterEncoding() == null)
// try {
// request.setCharacterEncoding(formEncoding);
// } catch (IllegalStateException e) {
// }
final ServletOutputStream sout = response.getOutputStream();
final PrintWriter output = new PrintWriter(new OutputStreamWriter(sout, getFormEncoding()));
// response.setContentType(contentType + "; charset=" + formEncoding);
response.addHeader( "pragma", "no-cache" );
response.addHeader( "Cache-Control", "no-cache" );
String requestPath = request.getRequestURI();
final int p = requestPath.lastIndexOf("/");
if(p != Constants.STRING_NOT_FOUND)
{requestPath = requestPath.substring(0, p);}
String moduleLoadPath;
final Object loadPathAttrib = request.getAttribute(ATTR_MODULE_LOAD_PATH);
if (loadPathAttrib != null)
{moduleLoadPath = getValue(loadPathAttrib);}
else
{moduleLoadPath = getServletContext().getRealPath(requestPath.substring(request.getContextPath().length()));}
Subject user = getDefaultUser();
// to determine the user, first check the request attribute "xquery.user", then
// the current session attribute "user"
final Object userAttrib = request.getAttribute(ATTR_XQUERY_USER);
final HttpSession session = request.getSession( false );
if(userAttrib != null || (session != null && request.isRequestedSessionIdValid())) {
final Object passwdAttrib = request.getAttribute(ATTR_XQUERY_PASSWORD);
String username;
String password;
if (userAttrib != null) {
username = getValue(userAttrib);
password = getValue(passwdAttrib);
} else {
username = getSessionAttribute(session, "user");
password = getSessionAttribute(session, "password");
}
//TODO authentication should use super.authenticate(...) !!!
try {
if( username != null && password != null ) {
Subject newUser = getPool().getSecurityManager().authenticate(username, password);
if (newUser != null && newUser.isAuthenticated())
{user = newUser;}
}
} catch (final AuthenticationException e) {
getLog().error("User can not be authenticated ("+username+").");
}
}
if (user == getDefaultUser()) {
Subject requestUser = HttpAccount.getUserFromServletRequest(request);
if (requestUser != null) {
user = requestUser;
} else {
requestUser = getAuthenticator().authenticate(request, response, false);
if (requestUser != null)
{user = requestUser;}
}
}
Source source = null;
final Object sourceAttrib = request.getAttribute(ATTR_XQUERY_SOURCE);
final Object urlAttrib = request.getAttribute(ATTR_XQUERY_URL);
if (sourceAttrib != null) {
String s;
if (sourceAttrib instanceof Item)
try {
s = ((Item) sourceAttrib).getStringValue();
} catch (final XPathException e) {
throw new ServletException("Failed to read XQuery source string from " +
"request attribute '" + ATTR_XQUERY_SOURCE + "': " + e.getMessage(), e);
}
else
{s = sourceAttrib.toString();}
source = new StringSource(s);
} else if (urlAttrib != null) {
DBBroker broker = null;
try {
broker = getPool().get(user);
source = SourceFactory.getSource(broker, moduleLoadPath, urlAttrib.toString(), true);
} catch (final Exception e) {
getLog().error(e.getMessage(), e);
response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
sendError(output, "Error", e.getMessage());
} finally {
getPool().release(broker);
}
} else {
final File f = new File(path);
if(!f.canRead()) {
response.setStatus(HttpServletResponse.SC_NOT_FOUND);
sendError(output, "Cannot read source file", path);
return;
}
source = new FileSource(f, encoding, true);
}
if (source == null) {
response.setStatus(HttpServletResponse.SC_NOT_FOUND);
sendError(output, "Source not found", path);
}
boolean reportErrors = false;
final String errorOpt = (String) request.getAttribute(ATTR_XQUERY_REPORT_ERRORS);
if (errorOpt != null)
{reportErrors = errorOpt.equalsIgnoreCase("YES");}
//allow source viewing for GET?
if("GET".equals(request.getMethod().toUpperCase())) {
String option;
boolean allowSource = false;
if((option = request.getParameter("_source")) != null)
allowSource = "yes".equals(option);
//Should we display the source of the XQuery or execute it
if(allowSource && descriptor != null) {
//show the source
//check are we allowed to show the xquery source - descriptor.xml
// System.out.println("path="+path);
if(descriptor.allowSource(path)) {
try {
source.validate(user, Permission.READ);
} catch (final PermissionDeniedException e) {
if (getDefaultUser().equals(user)) {