1   /**
2    * Copyright (c) 2000-2009 Liferay, Inc. All rights reserved.
3    *
4    * Permission is hereby granted, free of charge, to any person obtaining a copy
5    * of this software and associated documentation files (the "Software"), to deal
6    * in the Software without restriction, including without limitation the rights
7    * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
8    * copies of the Software, and to permit persons to whom the Software is
9    * furnished to do so, subject to the following conditions:
10   *
11   * The above copyright notice and this permission notice shall be included in
12   * all copies or substantial portions of the Software.
13   *
14   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
18   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
19   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
20   * SOFTWARE.
21   */
22  
23  package com.liferay.portal.struts;
24  
25  import com.liferay.portal.LayoutPermissionException;
26  import com.liferay.portal.PortletActiveException;
27  import com.liferay.portal.RequiredRoleException;
28  import com.liferay.portal.UserActiveException;
29  import com.liferay.portal.kernel.log.Log;
30  import com.liferay.portal.kernel.log.LogFactoryUtil;
31  import com.liferay.portal.kernel.portlet.FriendlyURLMapper;
32  import com.liferay.portal.kernel.servlet.HttpMethods;
33  import com.liferay.portal.kernel.servlet.SessionErrors;
34  import com.liferay.portal.kernel.util.HttpUtil;
35  import com.liferay.portal.kernel.util.JavaConstants;
36  import com.liferay.portal.kernel.util.ParamUtil;
37  import com.liferay.portal.kernel.util.StringPool;
38  import com.liferay.portal.kernel.util.Validator;
39  import com.liferay.portal.liveusers.LiveUsers;
40  import com.liferay.portal.model.Layout;
41  import com.liferay.portal.model.LayoutConstants;
42  import com.liferay.portal.model.Portlet;
43  import com.liferay.portal.model.PortletPreferencesIds;
44  import com.liferay.portal.model.User;
45  import com.liferay.portal.model.UserTracker;
46  import com.liferay.portal.model.UserTrackerPath;
47  import com.liferay.portal.security.auth.PrincipalException;
48  import com.liferay.portal.security.permission.ActionKeys;
49  import com.liferay.portal.security.permission.PermissionChecker;
50  import com.liferay.portal.service.LayoutLocalServiceUtil;
51  import com.liferay.portal.service.PortletLocalServiceUtil;
52  import com.liferay.portal.service.PortletPreferencesLocalServiceUtil;
53  import com.liferay.portal.service.permission.PortletPermissionUtil;
54  import com.liferay.portal.service.persistence.UserTrackerPathUtil;
55  import com.liferay.portal.theme.ThemeDisplay;
56  import com.liferay.portal.util.PortalUtil;
57  import com.liferay.portal.util.PropsKeys;
58  import com.liferay.portal.util.PropsUtil;
59  import com.liferay.portal.util.PropsValues;
60  import com.liferay.portal.util.WebKeys;
61  import com.liferay.portlet.InvokerPortlet;
62  import com.liferay.portlet.PortletConfigFactory;
63  import com.liferay.portlet.PortletInstanceFactoryUtil;
64  import com.liferay.portlet.PortletPreferencesFactoryUtil;
65  import com.liferay.portlet.PortletURLImpl;
66  import com.liferay.portlet.RenderRequestFactory;
67  import com.liferay.portlet.RenderRequestImpl;
68  import com.liferay.portlet.RenderResponseFactory;
69  import com.liferay.portlet.RenderResponseImpl;
70  
71  import java.io.IOException;
72  
73  import java.util.Date;
74  import java.util.HashSet;
75  import java.util.Iterator;
76  import java.util.Map.Entry;
77  import java.util.Map;
78  import java.util.Set;
79  
80  import javax.portlet.PortletConfig;
81  import javax.portlet.PortletContext;
82  import javax.portlet.PortletMode;
83  import javax.portlet.PortletPreferences;
84  import javax.portlet.PortletRequest;
85  import javax.portlet.WindowState;
86  
87  import javax.servlet.ServletContext;
88  import javax.servlet.ServletException;
89  import javax.servlet.http.HttpServletRequest;
90  import javax.servlet.http.HttpServletResponse;
91  import javax.servlet.http.HttpSession;
92  import javax.servlet.jsp.PageContext;
93  
94  import org.apache.struts.action.ActionMapping;
95  import org.apache.struts.config.ForwardConfig;
96  import org.apache.struts.tiles.TilesRequestProcessor;
97  
98  /**
99   * <a href="PortalRequestProcessor.java.html"><b><i>View Source</i></b></a>
100  *
101  * @author Brian Wing Shun Chan
102  * @author Jorge Ferrer
103  *
104  */
105 public class PortalRequestProcessor extends TilesRequestProcessor {
106 
107     public PortalRequestProcessor() {
108 
109         // auth.forward.last.path.
110 
111         _lastPaths = new HashSet<String>();
112 
113         _lastPaths.add(_PATH_PORTAL_LAYOUT);
114 
115         addPaths(_lastPaths, PropsKeys.AUTH_FORWARD_LAST_PATHS);
116 
117         // auth.public.path.
118 
119         _publicPaths = new HashSet<String>();
120 
121         _publicPaths.add(_PATH_C);
122         _publicPaths.add(_PATH_PORTAL_FLASH);
123         _publicPaths.add(_PATH_PORTAL_J_LOGIN);
124         _publicPaths.add(_PATH_PORTAL_LAYOUT);
125         _publicPaths.add(_PATH_PORTAL_LOGIN);
126         _publicPaths.add(_PATH_PORTAL_RENDER_PORTLET);
127         _publicPaths.add(_PATH_PORTAL_TCK);
128 
129         addPaths(_publicPaths, PropsKeys.AUTH_PUBLIC_PATHS);
130 
131         _trackerIgnorePaths = new HashSet<String>();
132 
133         addPaths(_trackerIgnorePaths, PropsKeys.SESSION_TRACKER_IGNORE_PATHS);
134     }
135 
136     public void process(
137             HttpServletRequest request, HttpServletResponse response)
138         throws IOException, ServletException {
139 
140         String path = super.processPath(request, response);
141 
142         ActionMapping mapping = (ActionMapping)moduleConfig.findActionConfig(
143             path);
144 
145         if ((mapping == null) && !path.startsWith(_PATH_WSRP)) {
146             String lastPath = getLastPath(request);
147 
148             if (_log.isDebugEnabled()) {
149                 _log.debug("Last path " + lastPath);
150             }
151 
152             response.sendRedirect(lastPath);
153 
154             return;
155         }
156 
157         super.process(request, response);
158 
159         try {
160             if (isPortletPath(path)) {
161                 cleanUp(request);
162             }
163         }
164         catch (Exception e) {
165             _log.error(e, e);
166         }
167     }
168 
169     protected void addPaths(Set<String> paths, String propsKey) {
170         String[] pathsArray = PropsUtil.getArray(propsKey);
171 
172         for (String path : pathsArray) {
173             paths.add(path);
174         }
175     }
176 
177     protected void callParentDoForward(
178             String uri, HttpServletRequest request,
179             HttpServletResponse response)
180         throws IOException, ServletException {
181 
182         super.doForward(uri, request, response);
183     }
184 
185     protected HttpServletRequest callParentProcessMultipart(
186         HttpServletRequest request) {
187 
188         return super.processMultipart(request);
189     }
190 
191     protected String callParentProcessPath(
192             HttpServletRequest request, HttpServletResponse response)
193         throws IOException {
194 
195         return super.processPath(request, response);
196     }
197 
198     protected boolean callParentProcessRoles(
199             HttpServletRequest request, HttpServletResponse response,
200             ActionMapping mapping)
201         throws IOException, ServletException {
202 
203         return super.processRoles(request, response, mapping);
204     }
205 
206     protected void cleanUp(HttpServletRequest request) throws Exception {
207 
208         // Clean up portlet objects that may have been created by defineObjects
209         // for portlets that are called directly from a Struts path
210 
211         RenderRequestImpl renderRequestImpl =
212             (RenderRequestImpl)request.getAttribute(
213                 JavaConstants.JAVAX_PORTLET_REQUEST);
214 
215         if (renderRequestImpl != null) {
216             renderRequestImpl.cleanUp();
217         }
218     }
219 
220     protected void defineObjects(
221             HttpServletRequest request, HttpServletResponse response,
222             Portlet portlet)
223         throws Exception {
224 
225         String portletId = portlet.getPortletId();
226 
227         ServletContext servletContext = (ServletContext)request.getAttribute(
228             WebKeys.CTX);
229 
230         InvokerPortlet invokerPortlet = PortletInstanceFactoryUtil.create(
231             portlet, servletContext);
232 
233         PortletPreferencesIds portletPreferencesIds =
234             PortletPreferencesFactoryUtil.getPortletPreferencesIds(
235                 request, portletId);
236 
237         PortletPreferences portletPreferences =
238             PortletPreferencesLocalServiceUtil.getPreferences(
239                 portletPreferencesIds);
240 
241         PortletConfig portletConfig = PortletConfigFactory.create(
242             portlet, servletContext);
243         PortletContext portletContext = portletConfig.getPortletContext();
244 
245         RenderRequestImpl renderRequestImpl = RenderRequestFactory.create(
246             request, portlet, invokerPortlet, portletContext,
247             WindowState.MAXIMIZED, PortletMode.VIEW, portletPreferences);
248 
249         RenderResponseImpl renderResponseImpl = RenderResponseFactory.create(
250             renderRequestImpl, response, portletId, portlet.getCompanyId());
251 
252         renderRequestImpl.defineObjects(portletConfig, renderResponseImpl);
253 
254         request.setAttribute(WebKeys.PORTLET_STRUTS_EXECUTE, Boolean.TRUE);
255     }
256 
257     protected void doForward(
258             String uri, HttpServletRequest request,
259             HttpServletResponse response)
260         throws ServletException {
261 
262         StrutsUtil.forward(uri, getServletContext(), request, response);
263     }
264 
265     protected void doInclude(
266             String uri, HttpServletRequest request,
267             HttpServletResponse response)
268         throws ServletException {
269 
270         StrutsUtil.include(uri, getServletContext(), request, response);
271     }
272 
273     protected StringBuilder getFriendlyTrackerPath(
274             String path, ThemeDisplay themeDisplay, HttpServletRequest request)
275         throws Exception {
276 
277         if (!path.equals(_PATH_PORTAL_LAYOUT)) {
278             return null;
279         }
280 
281         long plid = ParamUtil.getLong(request, "p_l_id");
282 
283         if (plid == 0) {
284             return null;
285         }
286 
287         Layout layout = LayoutLocalServiceUtil.getLayout(plid);
288 
289         String layoutFriendlyURL = PortalUtil.getLayoutFriendlyURL(
290             layout, themeDisplay);
291 
292         StringBuilder sb = new StringBuilder();
293 
294         sb.append(layoutFriendlyURL);
295 
296         String portletId = ParamUtil.getString(request, "p_p_id");
297 
298         if (Validator.isNull(portletId)) {
299             return sb;
300         }
301 
302         long companyId = PortalUtil.getCompanyId(request);
303 
304         Portlet portlet = PortletLocalServiceUtil.getPortletById(
305             companyId, portletId);
306 
307         if (portlet == null) {
308             String strutsPath = path.substring(
309                 1, path.lastIndexOf(StringPool.SLASH));
310 
311             portlet = PortletLocalServiceUtil.getPortletByStrutsPath(
312                 companyId, strutsPath);
313         }
314 
315         if ((portlet == null) || !portlet.isActive()) {
316             sb.append(StringPool.QUESTION);
317             sb.append(request.getQueryString());
318 
319             return sb;
320         }
321 
322         String namespace = PortalUtil.getPortletNamespace(portletId);
323 
324         FriendlyURLMapper friendlyURLMapper =
325             portlet.getFriendlyURLMapperInstance();
326 
327         if (friendlyURLMapper == null) {
328             sb.append(StringPool.QUESTION);
329             sb.append(request.getQueryString());
330 
331             return sb;
332         }
333 
334         PortletURLImpl portletURL = new PortletURLImpl(
335             request, portletId, plid, PortletRequest.RENDER_PHASE);
336 
337         Iterator<Map.Entry<String, String[]>> itr =
338             request.getParameterMap().entrySet().iterator();
339 
340         while (itr.hasNext()) {
341             Entry<String, String[]> entry = itr.next();
342 
343             String key = entry.getKey();
344 
345             if (key.startsWith(namespace)) {
346                 key = key.substring(namespace.length());
347 
348                 portletURL.setParameter(key, entry.getValue());
349             }
350         }
351 
352         String portletFriendlyURL = friendlyURLMapper.buildPath(portletURL);
353 
354         if (portletFriendlyURL != null) {
355             sb.append(portletFriendlyURL);
356         }
357         else {
358             sb.append(StringPool.QUESTION);
359             sb.append(request.getQueryString());
360         }
361 
362         return sb;
363     }
364 
365     protected String getLastPath(HttpServletRequest request) {
366         HttpSession session = request.getSession();
367 
368         ThemeDisplay themeDisplay = (ThemeDisplay)request.getAttribute(
369             WebKeys.THEME_DISPLAY);
370 
371         Boolean httpsInitial = (Boolean)session.getAttribute(
372             WebKeys.HTTPS_INITIAL);
373 
374         String portalURL = null;
375 
376         if ((PropsValues.COMPANY_SECURITY_AUTH_REQUIRES_HTTPS) &&
377             (httpsInitial != null) && (!httpsInitial.booleanValue())) {
378 
379             portalURL = PortalUtil.getPortalURL(request, false);
380         }
381         else {
382             portalURL = PortalUtil.getPortalURL(request);
383         }
384 
385         StringBuilder sb = new StringBuilder();
386 
387         sb.append(portalURL);
388         sb.append(themeDisplay.getPathMain());
389         sb.append(_PATH_PORTAL_LAYOUT);
390 
391         if (!PropsValues.AUTH_FORWARD_BY_LAST_PATH) {
392             if (request.getRemoteUser() != null) {
393 
394                 // If we do not forward by last path and the user is logged in,
395                 // forward to the user's default layout to prevent a lagging
396                 // loop
397 
398                 sb.append(StringPool.QUESTION);
399                 sb.append("p_l_id");
400                 sb.append(StringPool.EQUAL);
401                 sb.append(LayoutConstants.DEFAULT_PLID);
402             }
403 
404             return sb.toString();
405         }
406 
407         LastPath lastPath = (LastPath)session.getAttribute(WebKeys.LAST_PATH);
408 
409         if (lastPath == null) {
410             return sb.toString();
411         }
412 
413         Map<String, String[]> parameterMap = lastPath.getParameterMap();
414 
415         // Only test for existing mappings for last paths that were set when the
416         // user accessed a layout directly instead of through its friendly URL
417 
418         if (lastPath.getContextPath().equals(themeDisplay.getPathMain())) {
419             ActionMapping mapping =
420                 (ActionMapping)moduleConfig.findActionConfig(
421                     lastPath.getPath());
422 
423             if ((mapping == null) || (parameterMap == null)) {
424                 return sb.toString();
425             }
426         }
427 
428         StringBuilder lastPathSB = new StringBuilder();
429 
430         lastPathSB.append(portalURL);
431         lastPathSB.append(lastPath.getContextPath());
432         lastPathSB.append(lastPath.getPath());
433         lastPathSB.append(HttpUtil.parameterMapToString(parameterMap));
434 
435         return lastPathSB.toString();
436     }
437 
438     protected boolean isPortletPath(String path) {
439         if ((path != null) &&
440             (!path.equals(_PATH_C)) &&
441             (!path.startsWith(_PATH_COMMON)) &&
442             (path.indexOf(_PATH_J_SECURITY_CHECK) == -1) &&
443             (!path.startsWith(_PATH_PORTAL)) &&
444             (!path.startsWith(_PATH_WSRP))) {
445 
446             return true;
447         }
448         else {
449             return false;
450         }
451     }
452 
453     protected boolean isPublicPath(String path) {
454         if ((path != null) &&
455             (_publicPaths.contains(path)) ||
456             (path.startsWith(_PATH_COMMON)) ||
457             (path.startsWith(_PATH_WSRP))) {
458 
459             return true;
460         }
461         else {
462             return false;
463         }
464     }
465 
466     protected ActionMapping processMapping(
467             HttpServletRequest request, HttpServletResponse response,
468             String path)
469         throws IOException {
470 
471         if (path == null) {
472             return null;
473         }
474 
475         ActionMapping mapping = super.processMapping(request, response, path);
476 
477         if (mapping == null) {
478             String msg = getInternal().getMessage("processInvalid");
479 
480             _log.error("User ID " + request.getRemoteUser());
481             _log.error("Current URL " + PortalUtil.getCurrentURL(request));
482             _log.error("Referer " + request.getHeader("Referer"));
483             _log.error("Remote address " + request.getRemoteAddr());
484 
485             _log.error(msg + " " + path);
486         }
487 
488         return mapping;
489     }
490 
491     protected HttpServletRequest processMultipart(HttpServletRequest request) {
492 
493         // Disable Struts from automatically wrapping a multipart request
494 
495         return request;
496     }
497 
498     protected String processPath(
499             HttpServletRequest request, HttpServletResponse response)
500         throws IOException {
501 
502         String path = super.processPath(request, response);
503 
504         HttpSession session = request.getSession();
505 
506         ThemeDisplay themeDisplay = (ThemeDisplay)request.getAttribute(
507             WebKeys.THEME_DISPLAY);
508 
509         // Current users
510 
511         UserTracker userTracker = LiveUsers.getUserTracker(
512             themeDisplay.getCompanyId(), session.getId());
513 
514         if ((userTracker != null) && (path != null) &&
515             (!path.equals(_PATH_C)) &&
516             (path.indexOf(_PATH_J_SECURITY_CHECK) == -1) &&
517             (path.indexOf(_PATH_PORTAL_PROTECTED) == -1) &&
518             (!_trackerIgnorePaths.contains(path))) {
519 
520             StringBuilder sb = null;
521 
522             try {
523                 if (PropsValues.SESSION_TRACKER_FRIENDLY_PATHS_ENABLED) {
524                     sb = getFriendlyTrackerPath(path, themeDisplay, request);
525                 }
526             }
527             catch (Exception e) {
528                 _log.error(e, e);
529             }
530 
531             if (sb == null) {
532                 sb = new StringBuilder();
533 
534                 sb.append(path);
535                 sb.append(StringPool.QUESTION);
536                 sb.append(request.getQueryString());
537             }
538 
539             UserTrackerPath userTrackerPath = UserTrackerPathUtil.create(0);
540 
541             userTrackerPath.setUserTrackerId(userTracker.getUserTrackerId());
542             userTrackerPath.setPath(sb.toString());
543             userTrackerPath.setPathDate(new Date());
544 
545             userTracker.addPath(userTrackerPath);
546         }
547 
548         String remoteUser = request.getRemoteUser();
549 
550         User user = null;
551 
552         try {
553             user = PortalUtil.getUser(request);
554         }
555         catch (Exception e) {
556         }
557 
558         // Last path
559 
560         if ((path != null) && (_lastPaths.contains(path)) &&
561             (!_trackerIgnorePaths.contains(path))) {
562 
563             boolean saveLastPath = ParamUtil.getBoolean(
564                 request, "saveLastPath", true);
565 
566             if (themeDisplay.isLifecycleResource() ||
567                 themeDisplay.isStateExclusive() ||
568                 themeDisplay.isStatePopUp() ||
569                 !request.getMethod().equalsIgnoreCase(HttpMethods.GET)) {
570 
571                 saveLastPath = false;
572             }
573 
574             // Save last path
575 
576             if (saveLastPath) {
577 
578                 // Was a last path set by another servlet that dispatched to
579                 // the MainServlet? If so, use that last path instead.
580 
581                 LastPath lastPath = (LastPath)request.getAttribute(
582                     WebKeys.LAST_PATH);
583 
584                 if (lastPath == null) {
585                     lastPath = new LastPath(
586                         themeDisplay.getPathMain(), path,
587                         request.getParameterMap());
588                 }
589 
590                 session.setAttribute(WebKeys.LAST_PATH, lastPath);
591             }
592         }
593 
594         // Authenticated users can always log out
595 
596         if (((remoteUser != null) || (user != null)) && (path != null) &&
597             (path.equals(_PATH_PORTAL_LOGOUT))) {
598 
599             return path;
600         }
601 
602         // Authenticated users can always extend or confirm their session
603 
604         if (((remoteUser != null) || (user != null)) && (path != null) &&
605             (path.equals(_PATH_PORTAL_EXPIRE_SESSION) ||
606              path.equals(_PATH_PORTAL_EXTEND_SESSION))) {
607 
608             return path;
609         }
610 
611         // Authenticated users can always agree to terms of use
612 
613         if (((remoteUser != null) || (user != null)) && (path != null) &&
614             (path.equals(_PATH_PORTAL_UPDATE_TERMS_OF_USE))) {
615 
616             return path;
617         }
618 
619         // Authenticated users must still exist in the system
620 
621         if ((remoteUser != null) && (user == null)) {
622             return _PATH_PORTAL_LOGOUT;
623         }
624 
625         // Authenticated users should agree to Terms of Use
626 
627         if ((user != null) && !user.isAgreedToTermsOfUse()) {
628             if (PropsValues.TERMS_OF_USE_REQUIRED) {
629                 return _PATH_PORTAL_TERMS_OF_USE;
630             }
631         }
632 
633         // Authenticated users must be active
634 
635         if ((user != null) && !user.isActive()) {
636             SessionErrors.add(request, UserActiveException.class.getName());
637 
638             return _PATH_PORTAL_ERROR;
639         }
640 
641         // Authenticated users must have a current password
642 
643         if ((user != null) && user.isPasswordReset()) {
644             return _PATH_PORTAL_UPDATE_PASSWORD;
645         }
646 
647         // Authenticated users must have an email address
648 
649         if ((user != null) && Validator.isNull(user.getEmailAddress())) {
650             return _PATH_PORTAL_UPDATE_EMAIL_ADDRESS;
651         }
652 
653         // Authenticated users should have a reminder query
654 
655         if ((user != null) &&
656             (Validator.isNull(user.getReminderQueryQuestion()) ||
657              Validator.isNull(user.getReminderQueryAnswer()))) {
658 
659             if (PropsValues.USERS_REMINDER_QUERIES_ENABLED) {
660                 return _PATH_PORTAL_UPDATE_REMINDER_QUERY;
661             }
662         }
663 
664         // Authenticated users must have at least one personalized page
665 
666         /*if (user != null) {
667             List<Layout> layouts = themeDisplay.getLayouts();
668 
669             if ((layouts == null) || (layouts.size() == 0)) {
670                 SessionErrors.add(
671                     request, RequiredLayoutException.class.getName());
672 
673                 return _PATH_PORTAL_ERROR;
674             }
675         }*/
676 
677         // Users must sign in
678 
679         if (!isPublicPath(path)) {
680             if (user == null) {
681                 SessionErrors.add(request, PrincipalException.class.getName());
682 
683                 return _PATH_PORTAL_LOGIN;
684             }
685         }
686 
687         ActionMapping mapping =
688             (ActionMapping)moduleConfig.findActionConfig(path);
689 
690         if (path.startsWith(_PATH_WSRP)) {
691             path = _PATH_WSRP;
692         }
693         else {
694             path = mapping.getPath();
695         }
696 
697         // Authenticated users must have at least one role
698 
699         if (user != null) {
700             try {
701 
702                 // FIX ME
703 
704                 if (false) {
705                     SessionErrors.add(
706                         request, RequiredRoleException.class.getName());
707 
708                     return _PATH_PORTAL_ERROR;
709                 }
710             }
711             catch (Exception e) {
712                 e.printStackTrace();
713             }
714         }
715 
716         // Define the portlet objects
717 
718         if (isPortletPath(path)) {
719             try {
720                 Portlet portlet = null;
721 
722                 long companyId = PortalUtil.getCompanyId(request);
723                 String portletId = ParamUtil.getString(request, "p_p_id");
724 
725                 if (Validator.isNotNull(portletId)) {
726                     portlet = PortletLocalServiceUtil.getPortletById(
727                         companyId, portletId);
728                 }
729 
730                 if (portlet == null) {
731                     String strutsPath = path.substring(
732                         1, path.lastIndexOf(StringPool.SLASH));
733 
734                     portlet = PortletLocalServiceUtil.getPortletByStrutsPath(
735                         companyId, strutsPath);
736                 }
737 
738                 if ((portlet != null) && portlet.isActive()) {
739                     defineObjects(request, response, portlet);
740                 }
741             }
742             catch (Exception e) {
743                 request.setAttribute(PageContext.EXCEPTION, e);
744 
745                 path = _PATH_COMMON_ERROR;
746             }
747         }
748 
749         // Authenticated users must have access to at least one layout
750 
751         if (SessionErrors.contains(
752                 request, LayoutPermissionException.class.getName())) {
753 
754             return _PATH_PORTAL_ERROR;
755         }
756 
757         return path;
758     }
759 
760     protected boolean processRoles(
761             HttpServletRequest request, HttpServletResponse response,
762             ActionMapping mapping)
763         throws IOException, ServletException {
764 
765         String path = mapping.getPath();
766 
767         if (isPublicPath(path)) {
768             return true;
769         }
770 
771         boolean authorized = true;
772 
773         User user = null;
774 
775         try {
776             user = PortalUtil.getUser(request);
777         }
778         catch (Exception e) {
779         }
780 
781         if ((user != null) && isPortletPath(path)) {
782             try {
783 
784                 // Authenticated users can always log out
785 
786                 if (path.equals(_PATH_PORTAL_LOGOUT)) {
787                     return true;
788                 }
789 
790                 Portlet portlet = null;
791 
792                 String portletId = ParamUtil.getString(request, "p_p_id");
793 
794                 if (Validator.isNotNull(portletId)) {
795                     portlet = PortletLocalServiceUtil.getPortletById(
796                         user.getCompanyId(), portletId);
797                 }
798 
799                 String strutsPath = path.substring(
800                     1, path.lastIndexOf(StringPool.SLASH));
801 
802                 if (portlet != null) {
803                     if (!strutsPath.equals(portlet.getStrutsPath())) {
804                         throw new PrincipalException();
805                     }
806                 }
807                 else {
808                     portlet = PortletLocalServiceUtil.getPortletByStrutsPath(
809                         user.getCompanyId(), strutsPath);
810                 }
811 
812                 if ((portlet != null) && portlet.isActive()) {
813                     ThemeDisplay themeDisplay =
814                         (ThemeDisplay)request.getAttribute(
815                             WebKeys.THEME_DISPLAY);
816 
817                     Layout layout = themeDisplay.getLayout();
818                     PermissionChecker permissionChecker =
819                         themeDisplay.getPermissionChecker();
820 
821                     if (!PortletPermissionUtil.contains(
822                             permissionChecker, layout.getPlid(), portlet,
823                             ActionKeys.VIEW)) {
824 
825                         throw new PrincipalException();
826                     }
827                 }
828                 else if (portlet != null && !portlet.isActive()) {
829                     SessionErrors.add(
830                         request, PortletActiveException.class.getName());
831 
832                     authorized = false;
833                 }
834             }
835             catch (Exception e) {
836                 SessionErrors.add(request, PrincipalException.class.getName());
837 
838                 authorized = false;
839             }
840         }
841 
842         if (!authorized) {
843             ForwardConfig forwardConfig =
844                 mapping.findForward(_PATH_PORTAL_ERROR);
845 
846             processForwardConfig(request, response, forwardConfig);
847 
848             return false;
849         }
850         else {
851             return true;
852         }
853     }
854 
855     private static String _PATH_C = "/c";
856 
857     private static String _PATH_COMMON = "/common";
858 
859     private static String _PATH_COMMON_ERROR = "/common/error";
860 
861     private static String _PATH_J_SECURITY_CHECK = "/j_security_check";
862 
863     private static String _PATH_PORTAL = "/portal";
864 
865     private static String _PATH_PORTAL_ERROR = "/portal/error";
866 
867     private static String _PATH_PORTAL_EXPIRE_SESSION =
868         "/portal/expire_session";
869 
870     private static String _PATH_PORTAL_EXTEND_SESSION =
871         "/portal/extend_session";
872 
873     private static String _PATH_PORTAL_FLASH = "/portal/flash";
874 
875     private static String _PATH_PORTAL_J_LOGIN = "/portal/j_login";
876 
877     private static String _PATH_PORTAL_LAYOUT = "/portal/layout";
878 
879     private static String _PATH_PORTAL_LOGIN = "/portal/login";
880 
881     private static String _PATH_PORTAL_LOGOUT = "/portal/logout";
882 
883     private static String _PATH_PORTAL_PROTECTED = "/portal/protected";
884 
885     private static String _PATH_PORTAL_RENDER_PORTLET =
886         "/portal/render_portlet";
887 
888     private static String _PATH_PORTAL_TCK = "/portal/tck";
889 
890     private static String _PATH_PORTAL_TERMS_OF_USE = "/portal/terms_of_use";
891 
892     private static String _PATH_PORTAL_UPDATE_EMAIL_ADDRESS =
893         "/portal/update_email_address";
894 
895     private static String _PATH_PORTAL_UPDATE_PASSWORD =
896         "/portal/update_password";
897 
898     private static String _PATH_PORTAL_UPDATE_REMINDER_QUERY =
899         "/portal/update_reminder_query";
900 
901     private static String _PATH_PORTAL_UPDATE_TERMS_OF_USE =
902         "/portal/update_terms_of_use";
903 
904     private static String _PATH_WSRP = "/wsrp";
905 
906     private static Log _log =
907          LogFactoryUtil.getLog(PortalRequestProcessor.class);
908 
909     private Set<String> _lastPaths;
910     private Set<String> _publicPaths;
911     private Set<String> _trackerIgnorePaths;
912 
913 }