org.broadleafcommerce.openadmin.security

Class ClassNameRequestParamValidationServiceImpl

java.lang.Object

org.broadleafcommerce.openadmin.security.ClassNameRequestParamValidationServiceImpl

All Implemented Interfaces:

EventListener, ClassNameRequestParamValidationService, org.springframework.context.ApplicationListener<org.springframework.context.event.ContextRefreshedEvent>

@Service(value="blClassNameRequestParamValidationService")
public class ClassNameRequestParamValidationServiceImpl
extends Object
implements ClassNameRequestParamValidationService, org.springframework.context.ApplicationListener<org.springframework.context.event.ContextRefreshedEvent>

Author:

Jeff Fischer

See Also:

ClassNameRequestParamValidationService

Field Summary

Fields

Modifier and Type	Field and Description
protected AdminNavigationService	adminNavigationService
protected javax.persistence.EntityManagerFactory	factory
protected DynamicDaoHelper	helper

Constructor Summary

Constructors

Constructor and Description
ClassNameRequestParamValidationServiceImpl()

Method Summary

Modifier and Type	Method and Description
String	getClassNameForSection(String sectionKey, String persistenceUnitName) Retrieve a fully qualified classname using a sectionKey.
List<SectionCrumb>	getSectionCrumbs(String crumbList, String persistenceUnitName) Retrieve a list of section crumbs given a delimited string (usually harvested from the "sectionCrumbs" param on a Http request).
void	onApplicationEvent(org.springframework.context.event.ContextRefreshedEvent event)
boolean	validateClassNameParams(Map<String,String> requestParamToClassName, String persistenceUnitName) Compare a map of request params to fully qualified classname values against the whitelist.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

factory

protected javax.persistence.EntityManagerFactory factory

adminNavigationService

protected AdminNavigationService adminNavigationService

helper

protected DynamicDaoHelper helper

Constructor Detail

ClassNameRequestParamValidationServiceImpl

public ClassNameRequestParamValidationServiceImpl()

Method Detail

onApplicationEvent

public void onApplicationEvent(org.springframework.context.event.ContextRefreshedEvent event)

Specified by:

onApplicationEvent in interface org.springframework.context.ApplicationListener<org.springframework.context.event.ContextRefreshedEvent>

validateClassNameParams

public boolean validateClassNameParams(Map<String,String> requestParamToClassName,
                                       String persistenceUnitName)

Description copied from interface: ClassNameRequestParamValidationService

Compare a map of request params to fully qualified classname values against the whitelist.

Specified by:

validateClassNameParams in interface ClassNameRequestParamValidationService

Parameters:

requestParamToClassName - a map of request params and associated fully qualified classnames to confirm against the whitelist

persistenceUnitName - the persistence unit the white list is generated from

Returns:

whether or not the map of values is valid

getClassNameForSection

public String getClassNameForSection(String sectionKey,
                                     String persistenceUnitName)

Description copied from interface: ClassNameRequestParamValidationService

Retrieve a fully qualified classname using a sectionKey. Will return the passed in sectionKey if not classname is registered for it in the datastore. Since it's possible for no classname to be registered and for the key to be a fully qualified classname itself, any unmatched sectionKey is confirmed against the whitelist. If found to be not valid, a SectionKeyValidationException instance is thrown. If thrown from within a Spring MVC controller, this exception will result in an Http 404 status code back to the requester.

Specified by:

getClassNameForSection in interface ClassNameRequestParamValidationService

Parameters:

sectionKey - the sectionKey used to retrieve the fully qualified classname

persistenceUnitName - the persistence unit the white list is generated from

Returns:

the fully qualified classname associated with the sectionKey, or the sectionKey itself if no match is found

getSectionCrumbs

public List<SectionCrumb> getSectionCrumbs(String crumbList,
                                           String persistenceUnitName)

Description copied from interface: ClassNameRequestParamValidationService

Retrieve a list of section crumbs given a delimited string (usually harvested from the "sectionCrumbs" param on a Http request). The SectionCrumb instances contains sectionKey information, and are therefore susceptible to the same validation requirements as ClassNameRequestParamValidationService.getClassNameForSection(String, String). If a sectionKey is found to be not valid, a SectionKeyValidationException instance is thrown. If thrown from within a Spring MVC controller, this exception will result in an Http 404 status code back to the requester.

Specified by:

getSectionCrumbs in interface ClassNameRequestParamValidationService

Parameters:

crumbList - the delimited string (related to the "sectionCrumbs" param in an Http request)

persistenceUnitName - the persistence unit the white list is generated from

Returns:

the list of section crumbs representing the currently active admin sections for a given request