/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.springframework.security.ui;

import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;

import javax.servlet.http.HttpServletRequest;

import org.springframework.security.Authentication;
import org.springframework.security.ui.savedrequest.SavedRequest;
import org.springframework.util.StringUtils;

/**
 * Default implementation for {@link TargetUrlResolver}
 * <p>
 * Returns a target URL based from the contents of the configured <tt>targetUrlParameter</tt> if present on 
 * the current request. Failing that, the SavedRequest in the session will be used. 
 * 
 * @author Martino Piccinato
 * @author Luke Taylor
 * @version $Id$
 * @since 2.0
 *
 */
public class TargetUrlResolverImpl implements TargetUrlResolver {
    public static String DEFAULT_TARGET_PARAMETER = "redirect";
    
    /* SEC-213 */
    private String targetUrlParameter;
	
	/**
	 * If <code>true</code>, will only use <code>SavedRequest</code> to determine the target URL on successful
     * authentication if the request that caused the authentication request was a GET.
     * It will return null for a POST/PUT request.
	 * In most cases it's meaningless to redirect to a URL generated by a POST/PUT request.
     * Defaults to true.
	 */
	private boolean justUseSavedRequestOnGet = true;

    /* (non-Javadoc)
	 * @see org.acegisecurity.ui.TargetUrlResolver#determineTargetUrl(org.acegisecurity.ui.savedrequest.SavedRequest, javax.servlet.http.HttpServletRequest, org.acegisecurity.Authentication)
	 */
	public String determineTargetUrl(SavedRequest savedRequest, HttpServletRequest currentRequest,
            Authentication auth) {
			
        String targetUrl = null;
        
        if (targetUrlParameter != null) {
            targetUrl = currentRequest.getParameter(targetUrlParameter);
            
            if (StringUtils.hasText(targetUrl)) {
                try {
                    return URLDecoder.decode(targetUrl, "UTF-8");
                } catch (UnsupportedEncodingException e) {
                    throw new IllegalStateException("UTF-8 not supported. Shouldn't be possible");
                }
            }            
        }

        if (savedRequest != null) {
            if (!justUseSavedRequestOnGet || savedRequest.getMethod().equals("GET")) {
                targetUrl = savedRequest.getFullRequestUrl();
            }
        }

        return targetUrl;
	}

	/**
	 * @return <code>true</code> if just GET request will be used
	 * to determine target URLs, <code>false</code> otherwise.
	 */
	protected boolean isJustUseSavedRequestOnGet() {
		return justUseSavedRequestOnGet;
	}

	/**
	 * @param justUseSavedRequestOnGet set to <code>true</code> if 
	 * just GET request will be used to determine target URLs, 
	 * <code>false</code> otherwise.
	 */
	public void setJustUseSavedRequestOnGet(boolean justUseSavedRequestOnGet) {
		this.justUseSavedRequestOnGet = justUseSavedRequestOnGet;
	}

    
	/**
	 * Before checking the SavedRequest, the current request will be checked for this parameter
	 * and the value used as the target URL if resent.
	 * 
	 *  @param targetUrlParameter the name of the parameter containing the encoded target URL. Defaults
	 *  to "redirect".
	 */
	public void setTargetUrlParameter(String targetUrlParameter) {
        this.targetUrlParameter = targetUrlParameter;
    }


	
}

@@ -896,16 +896,56 @@
 equest;%0A
+import org.springframework.util.Assert;%0A
 import o
@@ -1456,16 +1456,32 @@
 ETER = %22
+spring-security-
 redirect
@@ -1543,16 +1543,43 @@
 arameter
+ = DEFAULT_TARGET_PARAMETER
 ;%0A%09%0A%09/**
@@ -2344,11 +2344,8 @@
 ) %7B%0A
-%09%09%09
 %0A   
@@ -2371,89 +2371,8 @@
 rl =
- null;%0A        %0A        if (targetUrlParameter != null) %7B%0A            targetUrl =
  cur
@@ -2421,33 +2421,25 @@
 r);%0A        
-   
- %0A    
+%0A
         if (
@@ -2468,28 +2468,24 @@
 rgetUrl)) %7B%0A
-    
             
@@ -2502,28 +2502,24 @@
             
-    
 return URLDe
@@ -2548,28 +2548,24 @@
 , %22UTF-8%22);%0A
-    
             
@@ -2623,20 +2623,16 @@
         
-    
 throw ne
@@ -2718,39 +2718,9 @@
     
-    %7D%0A            %7D            
+%7D
 %0A   
@@ -3846,24 +3846,89 @@
 arameter) %7B%0A
+%09    Assert.hasText(%22targetUrlParamete canot be null or empty%22);%0A
         this
@@ -3979,10 +3979,6 @@
   %7D%0A
-%0A%0A%09%0A
 %7D%0A

Make TargetUrlResolverImpl parameter non-optional http://jira.springframework.org/browse/SEC-699