package controllers;

import java.net.HttpURLConnection;

import models.User;
import play.Logger;
import play.data.validation.Validation;
import play.mvc.Before;
import play.mvc.Controller;
import play.mvc.results.Error;
import play.mvc.results.Status;

public class MyController extends Controller {
	
    @Before
    static void before(){
        Logger.info("[%s] %s %s", Security.connected(), request.method, request.path);
    }
	
    protected static boolean validationFailed() {
        if(Validation.hasErrors()) {
            prepareForErrorRedirect();
            return true;
        }
        return false;
	}

    protected static void prepareForErrorRedirect() {
		params.flash(); // add http parameters to the flash scope
		Validation.keep(); // keep the errors for the next request
	}

    protected static User getUser() {
		return (User) renderArgs.get("user");
	}
    
	protected static void created() {
		throw new Status(HttpURLConnection.HTTP_CREATED);
	}

	protected static void noContent() {
		throw new Status(HttpURLConnection.HTTP_NO_CONTENT);
	}

    protected static void badRequest(String error) {
        throw new Error(HttpURLConnection.HTTP_BAD_REQUEST, error);
    }
}

@@ -51,16 +51,61 @@
 ction;%0A%0A
+import org.apache.commons.lang.StringUtils;%0A%0A
 import m
@@ -466,16 +466,405 @@
 .path);%0A
+        // Make sure there's no CSRF for website forms%0A        if(request.method.equals(%22POST%22)%0A           %7C%7C request.method.equals(%22PUT%22)%0A           // Don't check that for the REST API which requires user basic auth%0A           // This should work since web users can't use basic auth in theory%0A           && StringUtils.isEmpty(request.user))%7B%0A            checkAuthenticity();%0A        %7D%0A
     %7D%0A%09%0A

add CSRF checks for #99