portals-jetspeed-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From sg...@apache.org
Subject cvs commit: jakarta-jetspeed/src/java/org/apache/jetspeed/services/portletfactory JetspeedPortletFactoryService.java
Date Mon, 28 Jan 2002 11:10:48 GMT
sgala       02/01/28 03:10:48

  Modified:    src/java/org/apache/jetspeed/services/portletfactory
                        JetspeedPortletFactoryService.java
  Log:
  Change calls in PortletFactory to return wrapped portlets for security checks.
  
  Revision  Changes    Path
  1.6       +15 -3     jakarta-jetspeed/src/java/org/apache/jetspeed/services/portletfactory/JetspeedPortletFactoryService.java
  
  Index: JetspeedPortletFactoryService.java
  ===================================================================
  RCS file: /home/cvs/jakarta-jetspeed/src/java/org/apache/jetspeed/services/portletfactory/JetspeedPortletFactoryService.java,v
  retrieving revision 1.5
  retrieving revision 1.6
  diff -u -r1.5 -r1.6
  --- JetspeedPortletFactoryService.java	17 Jan 2002 11:02:29 -0000	1.5
  +++ JetspeedPortletFactoryService.java	28 Jan 2002 11:10:48 -0000	1.6
  @@ -59,6 +59,9 @@
   import org.apache.jetspeed.portal.PortletConfig;
   import org.apache.jetspeed.portal.PortletException;
   import org.apache.jetspeed.portal.BasePortletConfig;
  +
  +import org.apache.jetspeed.portal.security.portlets.PortletWrapper;
  +
   import org.apache.jetspeed.xml.api.portletmarkup.Entry;
   import org.apache.jetspeed.xml.api.portletmarkup.Parameter;
   import org.apache.jetspeed.xml.api.portletmarkup.Metainfo;
  @@ -87,7 +90,7 @@
    * Simple implementation of the PortalFactoryService.
    * 
    * @author <a href="mailto:raphael@apache.org">RaphaŽl Luta</a>
  - * @version $Id: JetspeedPortletFactoryService.java,v 1.5 2002/01/17 11:02:29 sgala Exp
$
  + * @version $Id: JetspeedPortletFactoryService.java,v 1.6 2002/01/28 11:10:48 sgala Exp
$
    */
   public class JetspeedPortletFactoryService extends TurbineBaseService
       implements PortletFactoryService
  @@ -229,6 +232,7 @@
                   {
                       Log.info( "The portlet (" + handle + ") is expired" );
                       PortletCache.removeCacheable(handle);
  +                    Log.debug( "After removal of object(" + handle + ")." );
                       portlet = null;
                   }
               }
  @@ -266,7 +270,14 @@
                   }
                       
                   conf.setPortletSkin( pc.getPortletSkin() );
  -                return portlet;
  +
  +                //FIXME: Notice here we are putting the portlet without wrapper
  +                //in the cache, and we must wrap it on return.
  +                //Security implications: the portletcache should not be
  +                //publicly accessible.
  +                //Alternative: we could wrap the portlet before putting
  +                //it in the cache.
  +                return PortletWrapper.wrap( portlet );
                   
               }
   
  @@ -331,7 +342,8 @@
   
           Log.debug( "PortletFactory.getPortlet(): took a total of " + milliseconds + " millisecond(s)
-> " + handle );
   
  -        return portlet;
  +        return PortletWrapper.wrap( portlet );
  +
       }
   
       /**
  
  
  

--
To unsubscribe, e-mail:   <mailto:jetspeed-dev-unsubscribe@jakarta.apache.org>
For additional commands, e-mail: <mailto:jetspeed-dev-help@jakarta.apache.org>


Mime
View raw message