Examples with ServiceException org.broadleafcommerce.common.exception.ServiceException used on opensource projects

Example 56 with ServiceException

use of org.broadleafcommerce.common.exception.ServiceException in project BroadleafCommerce by BroadleafCommerce.

the class IndexFieldCustomPersistenceHandler method remove.

@Override
public void remove(PersistencePackage persistencePackage, DynamicEntityDao dynamicEntityDao, RecordHelper helper) throws ServiceException {
    Entity entity = persistencePackage.getEntity();
    try {
        PersistencePerspective persistencePerspective = persistencePackage.getPersistencePerspective();
        Map<String, FieldMetadata> adminProperties = helper.getSimpleMergedProperties(IndexField.class.getName(), persistencePerspective);
        Object primaryKey = helper.getPrimaryKey(entity, adminProperties);
        Serializable instance = dynamicEntityDao.retrieve(Class.forName(entity.getType()[0]), primaryKey);
        if (instance instanceof Status) {
            ((Status) instance).setArchived('Y');
            dynamicEntityDao.merge(instance);
            return;
        }
    } catch (Exception ex) {
        throw new ServiceException("Unable to perform remove for entity: " + entity.getType()[0], ex);
    }
    super.remove(persistencePackage, dynamicEntityDao, helper);
}

Example 57 with ServiceException

use of org.broadleafcommerce.common.exception.ServiceException in project BroadleafCommerce by BroadleafCommerce.

the class IndexFieldCustomPersistenceHandler method add.

@Override
public Entity add(PersistencePackage persistencePackage, DynamicEntityDao dynamicEntityDao, RecordHelper helper) throws ServiceException {
    Entity entity = persistencePackage.getEntity();
    try {
        PersistencePerspective persistencePerspective = persistencePackage.getPersistencePerspective();
        IndexField adminInstance = (IndexField) Class.forName(entity.getType()[0]).newInstance();
        Map<String, FieldMetadata> adminProperties = helper.getSimpleMergedProperties(IndexField.class.getName(), persistencePerspective);
        return getEntity(persistencePackage, dynamicEntityDao, helper, entity, adminProperties, adminInstance);
    } catch (Exception e) {
        throw new ServiceException("Unable to perform add for entity: " + IndexField.class.getName(), e);
    }
}

Example 58 with ServiceException

use of org.broadleafcommerce.common.exception.ServiceException in project BroadleafCommerce by BroadleafCommerce.

the class FormBuilderServiceImpl method setReadOnlyState.

/**
 * The given <b>entityForm</b> is marked as readonly for the following cases:
 * <ol>
 *  <li>All of the properties from <b>cmd</b> are readonly</b></li>
 *  <li>The user does not have the security to {@link EntityOperationType#UPDATE} the given class name represented by
 *  the <b>entityForm</b> (determined by {@link #getSecurityClassname(EntityForm, ClassMetadata)})</li>
 *  <li>The user does not have the security necessary to modify the given <b>entity</b> according to the
 *  {@link RowLevelSecurityService#canUpdate(AdminUser, Entity)}</li>
 * </ol>
 *
 * @param entityForm the form being generated
 * @param cmd the metatadata used to build the <b>entityForm</b> for the <b>entity</b>
 * @param entity the entity being edited
 * @see {@link SecurityVerifier#securityCheck(String, EntityOperationType)}
 * @see {@link #getSecurityClassname(EntityForm, ClassMetadata)}
 * @see {@link RowLevelSecurityService#canUpdate(AdminUser, Entity)}
 */
protected void setReadOnlyState(EntityForm entityForm, ClassMetadata cmd, Entity entity) {
    boolean readOnly = true;
    // If all of the fields are read only, we'll mark the form as such
    for (Property property : cmd.getProperties()) {
        FieldMetadata fieldMetadata = property.getMetadata();
        if (fieldMetadata instanceof BasicFieldMetadata) {
            readOnly = ((BasicFieldMetadata) fieldMetadata).getReadOnly() != null && ((BasicFieldMetadata) fieldMetadata).getReadOnly();
            if (!readOnly) {
                break;
            }
        } else {
            readOnly = ((CollectionMetadata) fieldMetadata).isMutable();
            if (!readOnly) {
                break;
            }
        }
    }
    if (!readOnly) {
        // If the user does not have edit permissions, we will go ahead and make the form read only to prevent confusion
        try {
            String securityEntityClassname = getSecurityClassname(entityForm, cmd);
            adminRemoteSecurityService.securityCheck(securityEntityClassname, EntityOperationType.UPDATE);
        } catch (ServiceException e) {
            if (e instanceof SecurityServiceException) {
                readOnly = true;
            }
        }
    }
    // are not readonly, then check the row-level security
    if (!readOnly) {
        readOnly = !rowLevelSecurityService.canUpdate(adminRemoteSecurityService.getPersistentAdminUser(), entity);
    }
    if (readOnly) {
        entityForm.setReadOnly();
        // If someone has replaced RowLevelSecurityService, check here to make sure the replacement implements the expected interface
        if (rowLevelSecurityService instanceof ExceptionAwareRowLevelSecurityProvider) {
            EntityFormModifierConfiguration entityFormModifierConfiguration = ((ExceptionAwareRowLevelSecurityProvider) rowLevelSecurityService).getUpdateDenialExceptions();
            for (EntityFormModifierData<EntityFormModifierDataPoint> data : entityFormModifierConfiguration.getData()) {
                for (EntityFormModifier modifier : entityFormModifierConfiguration.getModifier()) {
                    if (modifier.isQualified(data.getModifierType())) {
                        modifier.modifyEntityForm(new EntityFormModifierRequest().withEntityForm(entityForm).withConfiguration(data).withCurrentUser(adminRemoteSecurityService.getPersistentAdminUser()).withEntity(entity).withRowLevelSecurityService(rowLevelSecurityService));
                    }
                }
            }
        }
    }
}

Example 59 with ServiceException

use of org.broadleafcommerce.common.exception.ServiceException in project BroadleafCommerce by BroadleafCommerce.

the class AdminSecurityFilter method doFilter.

@Override
public void doFilter(ServletRequest baseRequest, ServletResponse baseResponse, FilterChain chain) throws IOException, ServletException {
    try {
        super.doFilter(baseRequest, baseResponse, chain);
    } catch (ServletException e) {
        if (e.getCause() instanceof StaleStateServiceException) {
            LOG.debug("Stale state detected", e);
            ((HttpServletResponse) baseResponse).setStatus(HttpServletResponse.SC_CONFLICT);
            baseResponse.getWriter().write("Stale State Detected\n");
            baseResponse.getWriter().write(e.getMessage() + "\n");
        } else if (e.getCause() instanceof ServiceException) {
            HttpServletRequest baseHttpRequest = (HttpServletRequest) baseRequest;
            // if authentication is null and CSRF token is invalid, must be session time out
            if (SecurityContextHolder.getContext().getAuthentication() == null && failureHandler != null) {
                baseHttpRequest.setAttribute("sessionTimeout", true);
                failureHandler.onAuthenticationFailure((HttpServletRequest) baseRequest, (HttpServletResponse) baseResponse, new SessionAuthenticationException("Session Time Out"));
            } else {
                throw e;
            }
        } else {
            throw e;
        }
    }
}

Example 60 with ServiceException

use of org.broadleafcommerce.common.exception.ServiceException in project BroadleafCommerce by BroadleafCommerce.

the class CsrfFilter method doFilter.

@Override
public void doFilter(ServletRequest baseRequest, ServletResponse baseResponse, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) baseRequest;
    HttpServletResponse response = (HttpServletResponse) baseResponse;
    boolean excludedRequestFound = false;
    if (excludedRequestPatterns != null && excludedRequestPatterns.size() > 0) {
        for (String pattern : excludedRequestPatterns) {
            RequestMatcher matcher = new AntPathRequestMatcher(pattern);
            if (matcher.matches(request)) {
                excludedRequestFound = true;
                break;
            }
        }
    }
    // We only validate CSRF tokens on POST
    if (request.getMethod().equals("POST") && !excludedRequestFound) {
        String requestToken = request.getParameter(exploitProtectionService.getCsrfTokenParameter());
        try {
            exploitProtectionService.compareToken(requestToken);
        } catch (ServiceException e) {
            throw new ServletException(e);
        }
    }
    chain.doFilter(request, response);
}