Ticket Reference handling #1048

Paul Martin

2016-04-27 c2188a840bc4153ae92112b04b2e06a90d3944aa

 src/main/java/com/gitblit/servlet/AccessRestrictionFilter.java

@@ -133,10 +133,11 @@
   /**

    * Allows authentication header to be altered based on the action requested

    * Default is WWW-Authenticate

    * @param httpRequest

    * @param action

    * @return authentication type header

    */

   protected String getAuthenticationHeader(String action) {

   protected String getAuthenticationHeader(HttpServletRequest httpRequest, String action) {

      return "WWW-Authenticate";

   }

   

@@ -192,7 +193,7 @@
                  logger.info(MessageFormat.format("ARF: CREATE CHALLENGE {0}", fullUrl));

               }

               

               httpResponse.setHeader(getAuthenticationHeader(urlRequestType), CHALLENGE);

               httpResponse.setHeader(getAuthenticationHeader(httpRequest, urlRequestType), CHALLENGE);

               httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);

               return;

            } else {

@@ -239,7 +240,7 @@
            if (runtimeManager.isDebugMode()) {

               logger.info(MessageFormat.format("ARF: CHALLENGE {0}", fullUrl));

            }

            httpResponse.setHeader(getAuthenticationHeader(urlRequestType), CHALLENGE);

            httpResponse.setHeader(getAuthenticationHeader(httpRequest, urlRequestType), CHALLENGE);

            httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);

            return;

         } else {

@@ -248,8 +249,8 @@
               // authenticated request permitted.

               // pass processing to the restricted servlet.

               newSession(authenticatedRequest, httpResponse);

               logger.info(MessageFormat.format("ARF: {0} ({1}) authenticated", fullUrl,

                     HttpServletResponse.SC_CONTINUE));

               logger.info(MessageFormat.format("ARF: authenticated {0} to {1} ({2})", user.username,

                     fullUrl, HttpServletResponse.SC_CONTINUE));

               chain.doFilter(authenticatedRequest, httpResponse);

               return;

            }