RE: [Webmacro-devel] Input wanted!

[<kea...@na...>]

Marc,

I don't have a clear picture of what exactly you want or what the problem
is, but there are various ways to get the different parts of the Request
URL.  For instance, 

HttpServletRequest.getRequestURI():

http://java.sun.com/products/servlet/2.2/javadoc/javax/servlet/http/HttpServ
letRequest.html#getRequestURI()

or HttpUtil.getRequestURL():

http://java.sun.com/products/servlet/2.2/javadoc/javax/servlet/http/HttpUtil
s.html#getRequestURL(javax.servlet.http.HttpServletRequest)

By default templates can be loaded from the Webapp context root.  This could
be a security concern in some environments, as you've indicated, which is
why there are various ways to configure this.

Probably the best way, imho, is to use the delegating template provider to
restrict templates to a special template directory under WEB-INF.

Hope this helps.

Keats

> -----Original Message-----
> From: Marc Palmer [mailto:ma...@an...]
> Sent: Friday, March 21, 2003 1:06 PM
> To: web...@li...
> Subject: [Webmacro-devel] Input wanted!
> 
> 
> 
> Hi guys,
> 
> I'd appreciate it if I could get a bit of input from anybody 
> interested in 
> this webapp I am writing which has the potential (if people agree) to 
> become a core WM project.
> 
> The issue I'm currently wrestling with is using a servlet 
> mapping to tie 
> the webapp's servlet to a file type, i.e. 
> <servlet-mapping>*.wmt</servlet- 
> mapping>, so that templates in the webapp root (not WEB-INF) can be 
> returned without referencing the servlet name. i.e. a URI like:
> 
> http://yourserver/wmwebapp/mypage.wmt
> 
> (wmwebapp is the context path)
> 
> Now I'm questioning how useful this is - because I have already 
> implemented, because it is required, URIs of the form:
> 
> http://yourserver/wmwebapp/ignition/mypage.wmt
> 
> (where ignition is the name of the servlet mapping i.e. /ignition/*)
> 
> ...with the difference that in this case the template comes 
> from the normal 
> template location mechanisms - i.e. from the classpath etc.
> 
> There is also (nearly implemented) the ability to define 
> "modules" which 
> are segregated mini-apps (each has its own set of actions, helpers, 
> templates etc) which means that you would not need to have 
> all templates on 
> the normal webapp classpath - the plan is that each module 
> can have its own 
> WebMacro.properties and therefore can use explicit template paths / 
> alternative template provider schemes. A page served from a 
> specific module 
> would have a URI like:
> 
> http://yourserver/wmwebapp/ignition/mymodule1/mypage.wmt
> 
> Anything
> Now, back to the first scenario - templates served from the 
> webapp root - 
> if implemented - will have a couple of problems:
> 
> 1. Where do they get their included templates from? A custom template 
> provider could be used to load templates from the context 
> root (not under 
> WEB-INF) if not already supported by WM. It would seem odd to 
> allow pages 
> to be served from the context root but not allow them to be 
> included from 
> that location also.
> 
> 2. Having templates in the context/webapp root is a security 
> risk. The 
> nature of this webapp is such that people will likely to a 
> bit more than 
> the usual MVC work in templates and as such sensitive info might be 
> available in templates, and if the web.xml is fouled or the servlet 
> container freaks out, it could return raw template files instead of 
> processing them.
> 
> 3. How do I know reliably how the servlet is being called? I need 
> HttpServletRequest.getServletPath() to work so that I can 
> automatically 
> formulate correct URIs from my helper placed into the web 
> context. Using a 
> /ignition/* servlet mapping means this works - getServletPath returns 
> things like "/ignition" and getPathInfo() returns the 
> template requested 
> i.e. "mymodule1/mypage.wmt". However if using a *.wmt servlet 
> mapping, 
> getServletPath returns "mymodule1/mypage.wmt" and getPathInfo 
> returns null! 
> Also getPathInfo() can return null under normal operation 
> (/ignition/* 
> mapping) if there is no template name as part of the URI (not 
> forced by the 
> webapp) - so I am not sure how I can tell whether the servlet 
> was called as 
> a result of a "/ignition/mymodule1" URI or a 
> "/mywebappsubdir/mypage.wmt" 
> URI, both of which would have null PathInfo.
> 
> Basically I don't like the way this all feels so I am thinking of not 
> supporting *.wmt mappings of the servlet, and using the 
> module mechanism 
> described throughout. We can of course change the web.xml so 
> that we have 
> slightly nicer URIs - i.e. 
> http://myserver/ignition/execute/mymodule1/mypage.wmt - but 
> even that is 
> somewhat lengthy for me. If I use a /* mapping for the 
> servlet then we stop 
> people being able to efficiently serve resource files like 
> images from the 
> webapp.
> 
> I suppose I can call getPathTranslated when using a *.wmt 
> mapping and then 
> call File.exists() on it to see if there is a resource with 
> that name, and 
> if so parse that and return it... and if not then I can try 
> to see if I can 
> pass a valid module out of it - but the same thing applies here... my 
> helper object placed into the templates needs to know the 
> base URI of the 
> servlet (including context path) to produce URIs for the 
> designer without 
> them having to hardcode it. Currently it works like this:
> 
> #set $action1 = $Ignition.newAction( "sendEmail")
> #set $action1.ToAddress = "ma...@an..."
> #set $action1.FromAddress = "server@localhost"
> #set $action1.BodyTemplate = "emailtemplate.wmt"
> #set $action2 = $Ignition.newAction( "viewTemplate")
> #set $action2.Template = "thankyouforemail.wmt"
> 
> <a href="$Ignition.execute( [$action1, $action2])">Send the email</a>
> 
> ...so you never deal with URIs or the syntax needed to munge 
> and namespace 
> the params for each action. Sorry probably very confusing all 
> this because 
> I haven't explained much about the webapp yet...
> 
> I am very keen however that it is as easy as possible to 
> return templated 
> pages - I would love it to be as simple as 
> http://myserver/ignition/myshop/mytemplate.wmt but I can't 
> see how I can do 
> that without using a "/*" mapping and all the performance 
> problems with 
> doing that if non-template files are also served from the app.
> 
> Maybe I'm being dumb. Any ideas / encouragement welcome :-)
> 
> 
> -- 
> Marc Palmer
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by:Crypto Challenge is now open! 
> Get cracking and register here for some mind boggling fun and 
> the chance of winning an Apple iPod:
> http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
> _______________________________________________
> Webmacro-devel mailing list
> Web...@li...
> https://lists.sourceforge.net/lists/listinfo/webmacro-devel
>