/**
 * Copyright  2003 The JA-SIG Collaborative.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the JA-SIG Collaborative
 *    (http://www.jasig.org/)."
 *
 * THIS SOFTWARE IS PROVIDED BY THE JA-SIG COLLABORATIVE "AS IS" AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE JA-SIG COLLABORATIVE OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */
package org.jasig.portal;

import java.io.*;
import java.net.*;

import javax.servlet.*;
import javax.servlet.http.*;
import org.jasig.portal.services.LogService;

/**
 * Proxy embedded content such as images for portal sessions.
 * When portal is running over ssl, HttpProxyServlet can be used
 * to deliver insecure content such as images over ssl to avoid 
 * mixed content in the browser window.
 * 
 * @author Drew Mazurek (drew.mazurek@yale.edu)
 * @author Susan Bramhall (susan.bramhall@yale.edu)
 * @version 1.0
 * @since uPortal 2.2
 */
public class HttpProxyServlet extends HttpServlet {

/**
 * Returns content retreived from location following context (Path Info)
 * If no content found returns 404
 */
    public void doGet(HttpServletRequest request, HttpServletResponse response)
	throws ServletException, IOException {

	// check referrer property - return 404 if incorrect.
	final String checkReferer = PropertiesManager.getProperty(HttpProxyServlet.class.getName()
		+ ".checkReferer");

	String target;
	
	// if checking referer then only supply proxied content for specific referer
	// Ensures requests come from pages in the portal
	if (null!=checkReferer){
		String referer = request.getHeader("Referer");
		LogService.log(LogService.DEBUG,"HttpProxyServlet: HTTP Referer: " + referer);
		if (null!=referer && !referer.startsWith(checkReferer)) {
			// log referrer 
			LogService.log(LogService.WARN,"HttpProxyServlet: bad Referer: " + referer);
			response.setStatus(404);
			return;
		}
	}
	
	if (request.getSession(false)==null) {
		// log referrer in debugging mode
		LogService.log(LogService.WARN,"HttpProxyServlet: no session");
		response.setStatus(404);
		return;		
	}
	
	// pathinfo is "/host/url"
	if(request.getPathInfo() != null && !request.getPathInfo().equals("")) {
	    target = "http:/" + request.getPathInfo();
	} else {
		response.setStatus(404);
	    return;
	}

    InputStream is;
    
    try {
        URL url = new URL(target);
        URLConnection uc = url.openConnection();
        
        response.setContentType(uc.getContentType());
        
        is = uc.getInputStream();
    } catch (MalformedURLException e) {
		response.setStatus(404);
		return;
    } catch (IOException e) {
		response.setStatus(404);
		return;
    }
	ServletOutputStream out = response.getOutputStream();

	byte[] buf = new byte[4096];
	int bytesRead;
	while ((bytesRead = is.read(buf)) != -1) {
	    out.write(buf, 0, bytesRead);
	}
    }
}

@@ -3499,20 +3499,17 @@
 rn;%0A%09%7D%0A%0A
-    
+%09
 InputStr
@@ -3514,16 +3514,59 @@
 tream is
+ = null;%0A    ServletOutputStream out = null
 ;%0A    %0A 
@@ -3760,24 +3760,197 @@
 utStream();%0A
+    %0A%09    out = response.getOutputStream();%0A%0A%09byte%5B%5D buf = new byte%5B4096%5D;%0A%09int bytesRead;%0A%09while ((bytesRead = is.read(buf)) != -1) %7B%0A%09    out.write(buf, 0, bytesRead);%0A%09%7D%0A
     %7D catch 
@@ -4002,31 +4002,24 @@
 tus(404);%0A%09%09
-return;
 %0A    %7D catch
@@ -4070,204 +4070,117 @@
 ;%0A%09%09
-return;%0A    %7D%0A%09ServletOutputStream out = response.getOutputStream();%0A%0A%09byte%5B%5D buf = new byte%5B4096%5D;%0A%09int bytesRead;%0A%09while ((bytesRead = is.read(buf)) != -1) %7B%0A%09    out.write(buf, 0, bytesRead);%0A%09
+%0A    %7D finally %7B%0A        if(is != null)%0A        is.close();%0A        if(out != null)%0A        out.close();%0A    
 %7D%0A  

Fix for Bug#: 1557 For details please check following link http://mis105.mis.udel.edu/bugzilla/show_bug.cgi?id=1557