HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
String fullUrl = getFullUrl(httpRequest);
RpcRequest requestType = RpcRequest.fromName(httpRequest.getParameter("req"));
if (requestType == null) {
httpResponse.sendError(HttpServletResponse.SC_NOT_IMPLEMENTED);
return;
}
boolean adminRequest = requestType.exceeds(RpcRequest.LIST_SETTINGS);
// conditionally reject all rpc requests
if (!settings.getBoolean(Keys.web.enableRpcServlet, true)) {
logger.warn(Keys.web.enableRpcServlet + " must be set TRUE for rpc requests.");
httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
return;
}
boolean authenticateView = settings.getBoolean(Keys.web.authenticateViewPages, false);
boolean authenticateAdmin = settings.getBoolean(Keys.web.authenticateAdminPages, true);
// Wrap the HttpServletRequest with the RpcServletRequest which
// overrides the servlet container user principal methods.
AuthenticatedRequest authenticatedRequest = new AuthenticatedRequest(httpRequest);
UserModel user = getUser(httpRequest);
if (user != null) {
authenticatedRequest.setUser(user);
}
// conditionally reject rpc management/administration requests
if (adminRequest && !settings.getBoolean(Keys.web.enableRpcManagement, false)) {
logger.warn(MessageFormat.format("{0} must be set TRUE for {1} rpc requests.",
Keys.web.enableRpcManagement, requestType.toString()));
httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
return;
}
// BASIC authentication challenge and response processing