/**
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.activemq.web.handler;

import java.util.Arrays;
import java.util.UUID;

import javax.servlet.http.HttpServletRequest;

import org.apache.activemq.web.DestinationFacade;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.ServletRequestDataBinder;
import org.springframework.web.servlet.handler.BeanNameUrlHandlerMapping;
import org.springframework.web.servlet.HandlerExecutionChain;

/**
 * 
 */
public class BindingBeanNameUrlHandlerMapping extends BeanNameUrlHandlerMapping {
    private static final transient Logger LOG = LoggerFactory.getLogger(BindingBeanNameUrlHandlerMapping.class);

    protected Object getHandlerInternal(HttpServletRequest request) throws Exception {
        Object object = super.getHandlerInternal(request);

        if (object instanceof String) {
            String handlerName = (String) object;
            object = getApplicationContext().getBean(handlerName);
        }
        if (object instanceof HandlerExecutionChain) {
            HandlerExecutionChain handlerExecutionChain = (HandlerExecutionChain) object;
            object = handlerExecutionChain.getHandler();
        }
        
        if (object != null) {
        	// prevent CSRF attacks
        	if (object instanceof DestinationFacade) {
        		// check supported methods
        		if (!Arrays.asList(((DestinationFacade)object).getSupportedHttpMethods()).contains(request.getMethod())) {
        			throw new UnsupportedOperationException("Unsupported method " + request.getMethod() + " for path " + request.getRequestURI());
        		}
        		// check the 'secret'
        		if (!request.getSession().getAttribute("secret").equals(request.getParameter("secret"))) {
        			throw new UnsupportedOperationException("Possible CSRF attack");
        		}
        	}
        	
        	
            ServletRequestDataBinder binder = new ServletRequestDataBinder(object, "request");
            try {
                binder.bind(request);
                binder.setIgnoreUnknownFields(true);
                if (LOG.isDebugEnabled()) {
                    LOG.debug("Bound POJO is now: " + object);
                }
            }
            catch (Exception e) {
                LOG.warn("Caught: " + e, e);
                throw e;
            }
        }
        
        return object;
    }
}

@@ -867,31 +867,8 @@
 ays;
-%0Aimport java.util.UUID;
 %0A%0Aim
@@ -1124,41 +1124,29 @@
 let.
-h
+H
 andler
-.BeanNameUrlHandlerMapp
+ExecutionCha
 in
-g
 ;%0Aim
@@ -1182,37 +1182,49 @@
 servlet.
-H
+h
 andler
-ExecutionCha
+.BeanNameUrlHandlerMapp
 in
+g
 ;%0A%0A/**%0A 
@@ -1224,17 +1224,16 @@
 %0A%0A/**%0A *
- 
 %0A */%0Apub
@@ -1421,24 +1421,38 @@
 ng.class);%0A%0A
+    @Override%0A
     protecte
@@ -1961,32 +1961,24 @@
 ;%0A        %7D%0A
-        
 %0A        if 
@@ -2004,17 +2004,20 @@
         
-%09
+    
 // preve
@@ -2040,17 +2040,20 @@
         
-%09
+    
 if (obje
@@ -2087,34 +2087,40 @@
 cade) %7B%0A        
+  
-%09%09
+      
 // check support
@@ -2134,26 +2134,32 @@
 ods%0A        
+   
-%09%09
+     
 if (!Arrays.
@@ -2253,35 +2253,44 @@
 d())) %7B%0A        
-%09%09%09
+            
 throw new Unsupp
@@ -2408,28 +2408,36 @@
         
-%09%09%7D%0A
+        %7D%0A  
         
 %09%09// che
@@ -2428,18 +2428,22 @@
         
-%09%09
+      
 // check
@@ -2468,14 +2468,95 @@
     
+   
-%09%09if (
+     if (request.getSession().getAttribute(%22secret%22) == null %7C%7C%0A                    
 !req
@@ -2650,11 +2650,20 @@
     
-%09%09%09
+            
 thro
@@ -2735,20 +2735,16 @@
     
-%09%09%7D%0A
         
 %09%7D%0A 
@@ -2739,17 +2739,16 @@
         
-%09
 %7D%0A      
@@ -2753,19 +2753,14 @@
     
-%09%0A
     
-    %09
+%7D%0A
 %0A   
@@ -3227,24 +3227,16 @@
       %7D%0A
-        
 %0A       

fix for: https://issues.apache.org/jira/browse/AMQ-2740