@@ -0,0 +1,2503 @@
+// Copyright 2008 Google Inc.%0A//%0A// Licensed under the Apache License, Version 2.0 (the %22License%22);%0A// you may not use this file except in compliance with the License.%0A// You may obtain a copy of the License at%0A//%0A// http://www.apache.org/licenses/LICENSE-2.0%0A//%0A// Unless required by applicable law or agreed to in writing, software%0A// distributed under the License is distributed on an %22AS IS%22 BASIS,%0A// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.%0A// See the License for the specific language governing permissions and%0A// limitations under the License.%0A%0Apackage com.google.gerrit.server;%0A%0Aimport com.google.gerrit.client.Gerrit;%0Aimport com.google.gwtjsonrpc.client.CookieAccess;%0Aimport com.google.gwtjsonrpc.server.ActiveCall;%0Aimport com.google.gwtjsonrpc.server.JsonServlet;%0Aimport com.google.gwtjsonrpc.server.SignedToken;%0Aimport com.google.gwtjsonrpc.server.XsrfException;%0Aimport com.google.gwtorm.client.OrmException;%0A%0Aimport javax.servlet.ServletConfig;%0Aimport javax.servlet.ServletException;%0A%0A/**%0A * Base JSON servlet to ensure the current user is not forged.%0A */%0Apublic abstract class GerritJsonServlet extends JsonServlet %7B%0A  private GerritServer server;%0A%0A  @Override%0A  public void init(final ServletConfig config) throws ServletException %7B%0A    super.init(config);%0A%0A    try %7B%0A      server = GerritServer.getInstance();%0A    %7D catch (OrmException e) %7B%0A      throw new ServletException(%22Cannot configure GerritServer%22, e);%0A    %7D catch (XsrfException e) %7B%0A      throw new ServletException(%22Cannot configure GerritServer%22, e);%0A    %7D%0A  %7D%0A%0A  @Override%0A  protected SignedToken createXsrfSignedToken() throws XsrfException %7B%0A    try %7B%0A      return GerritServer.getInstance().getXsrfToken();%0A    %7D catch (OrmException e) %7B%0A      throw new XsrfException(%22Cannot configure GerritServer%22, e);%0A    %7D%0A  %7D%0A%0A  @Override%0A  protected abstract Object createServiceHandle() throws Exception;%0A%0A  @Override%0A  protected String xsrfUser(final ActiveCall call) %7B%0A    final String idstr = CookieAccess.getTokenText(Gerrit.ACCOUNT_COOKIE);%0A    return idstr != null ? %22account%22 + idstr : %22anonymous%22;%0A  %7D%0A%0A  @Override%0A  protected boolean xsrfValidate(final ActiveCall call) throws XsrfException %7B%0A    final String usertok = CookieAccess.get(Gerrit.ACCOUNT_COOKIE);%0A    if (usertok == null %7C%7C server.getAccountToken().checkToken(usertok, null)) %7B%0A      return super.xsrfValidate(call);%0A    %7D else %7B%0A      LoginServlet.forceLogout(call.getHttpServletResponse());%0A      return false;%0A    %7D%0A  %7D%0A%7D%0A

Define a base servlet for use within Gerrit RPC servers