1 package com.atlassian.activeobjects.servlet;
2
3 import com.atlassian.activeobjects.admin.tables.TablesController;
4 import com.atlassian.sal.api.auth.LoginUriProvider;
5 import com.atlassian.sal.api.user.UserManager;
6 import com.atlassian.sal.api.user.UserProfile;
7 import com.atlassian.sal.api.websudo.WebSudoManager;
8 import com.atlassian.sal.api.websudo.WebSudoSessionException;
9 import com.atlassian.templaterenderer.TemplateRenderer;
10 import com.google.common.base.Strings;
11 import com.google.common.collect.ImmutableMap;
12
13 import javax.servlet.ServletException;
14 import javax.servlet.http.HttpServlet;
15 import javax.servlet.http.HttpServletRequest;
16 import javax.servlet.http.HttpServletResponse;
17 import java.io.IOException;
18 import java.net.URI;
19
20 public class AdminServlet extends HttpServlet {
21
22 private static final String TEMPLATE = "templates/list-tables.vm";
23
24 private final AdminUi adminUi;
25 private final TemplateRenderer templateRenderer;
26 private final TablesController tablesController;
27 private final UserManager userManager;
28 private WebSudoManager webSudoManager;
29 private final LoginUriProvider loginUriProvider;
30
31 public AdminServlet(AdminUi adminUi, LoginUriProvider loginUriProvider, TablesController tablesController,
32 TemplateRenderer templateRenderer, UserManager userManager, WebSudoManager webSudoManager) {
33 this.adminUi = adminUi;
34 this.loginUriProvider = loginUriProvider;
35 this.tablesController = tablesController;
36 this.templateRenderer = templateRenderer;
37 this.userManager = userManager;
38 this.webSudoManager = webSudoManager;
39 }
40
41 @Override
42 protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
43 String pathInfo = req.getPathInfo();
44 if (Strings.isNullOrEmpty(pathInfo) || !pathInfo.equals("/tables/list")) {
45 resp.sendError(HttpServletResponse.SC_NOT_FOUND);
46 return;
47 }
48
49 try {
50 webSudoManager.willExecuteWebSudoRequest(req);
51
52 UserProfile user = userManager.getRemoteUser(req);
53 if (user == null) {
54 sendRedirectToLogin(req, resp);
55 return;
56 }
57
58 if (!isUserSysAdmin(user)) {
59 resp.sendError(HttpServletResponse.SC_FORBIDDEN);
60 return;
61 }
62
63 if (!adminUi.isEnabled()) {
64 if (AdminUi.isDevModeEnabled()) {
65 resp.sendError(HttpServletResponse.SC_NOT_FOUND,
66 "The Active Objects admin UI is disabled, see the logs for more information.");
67 } else {
68 resp.sendError(HttpServletResponse.SC_NOT_FOUND);
69 }
70 }
71 resp.setContentType("text/html;charset=UTF-8");
72 templateRenderer.render(TEMPLATE,
73 ImmutableMap.of("tables", tablesController.list()),
74 resp.getWriter());
75 } catch(WebSudoSessionException ignored) {
76 webSudoManager.enforceWebSudoProtection(req, resp);
77 }
78 }
79
80 private boolean isUserSysAdmin(UserProfile user) {
81 return user != null && userManager.isSystemAdmin(user.getUserKey());
82 }
83
84 private void sendRedirectToLogin(HttpServletRequest req, HttpServletResponse resp) throws IOException {
85 String requestUri = req.getRequestURI();
86 String contextPath = req.getContextPath();
87 if (!Strings.isNullOrEmpty(contextPath)) {
88 requestUri = requestUri.substring(contextPath.length());
89 }
90 resp.sendRedirect(loginUriProvider.getLoginUri(URI.create(requestUri)).toString());
91 }
92 }