publicstatic String checkLogin(HttpServletRequest request, HttpServletResponse response) { GenericValueuserLogin= checkLogout(request, response); // have to reget this because the old session object will be invalid HttpSessionsession= request.getSession();
// in this condition log them in if not already; if not logged in or can't log in, save parameters and return error if (username == null || (password == null && token == null) || "error".equals(login(request, response))) {
// make sure this attribute is not in the request; this avoids infinite recursion when a login by less stringent criteria (like not checkout the hasLoggedOut field) passes; this is not a normal circumstance but can happen with custom code or in funny error situations when the userLogin service gets the userLogin object but runs into another problem and fails to return an error request.removeAttribute("_LOGIN_PASSED_");
// keep the previous request name in the session session.setAttribute("_PREVIOUS_REQUEST_", request.getPathInfo());
// NOTE: not using the old _PREVIOUS_PARAMS_ attribute at all because it was a security hole as it was used to put data in the URL (never encrypted) that was originally in a form field that may have been encrypted // keep 2 maps: one for URL parameters and one for form parameters Map<String, Object> urlParams = UtilHttp.getUrlOnlyParameterMap(request); if (UtilValidate.isNotEmpty(urlParams)) { session.setAttribute("_PREVIOUS_PARAM_MAP_URL_", urlParams); } Map<String, Object> formParams = UtilHttp.getParameterMap(request, urlParams.keySet(), false); if (UtilValidate.isNotEmpty(formParams)) { session.setAttribute("_PREVIOUS_PARAM_MAP_FORM_", formParams); }
//Allow loggingOut when impersonated booleanisLoggingOut="logout".equals(RequestHandler.getRequestUri(request.getPathInfo())); //Check if the user has an impersonation in process booleanauthoriseLoginDuringImpersonate= EntityUtilProperties.propertyValueEquals("security", "security.login.authorised.during.impersonate", "true"); if (!isLoggingOut && !authoriseLoginDuringImpersonate && checkImpersonationInProcess(request, response) != null) { //remove error message that will be displayed in impersonated status screen request.removeAttribute("_ERROR_MESSAGE_LIST_"); return"impersonated"; }
if (!parameters.groovyProgram) { groovyProgram = ''' // Use the List variable recordValues to fill it with GenericValue maps. // full groovy syntaxt is available import org.apache.ofbiz.entity.util.EntityFindOptions // example: // find the first three record in the product entity (if any) EntityFindOptions findOptions = new EntityFindOptions() findOptions.setMaxRows(3) List products = delegator.findList("Product", null, null, null, findOptions, false) if (products != null) { recordValues.addAll(products) } ''' parameters.groovyProgram = groovyProgram } else { groovyProgram = parameters.groovyProgram }
// Add imports for script. defimportCustomizer=newImportCustomizer() importCustomizer.addImport("org.apache.ofbiz.entity.GenericValue") importCustomizer.addImport("org.apache.ofbiz.entity.model.ModelEntity") defconfiguration=newCompilerConfiguration() configuration.addCompilationCustomizers(importCustomizer)
if (UtilValidate.isNotEmpty(groovyProgram)) { try { // Check if a webshell is not uploaded but allow "import" if (!SecuredUpload.isValidText(groovyProgram, ["import"])) { logError("================== Not executed for security reason ==================") request.setAttribute("_ERROR_MESSAGE_", "Not executed for security reason") return } shell.parse(groovyProgram) shell.evaluate(groovyProgram)
获取groovyparam然后执行。
About this Post
This post is written by Boogipop, licensed under CC BY-NC 4.0.