1

我正在尝试使用 java/jsp 中的过滤器过滤出名为“原因”的查询参数。

基本上，过滤器已经到位，以确保用户输入了查看页面的“原因”。如果他们没有，它需要将他们重定向到“输入原因”页面。一旦他们输入了一个有效的理由，他们就可以继续访问他们请求的页面。

所以它的基础工作。但是，“原因”是通过查询参数（即 GET 参数）发送的。一旦用户选择了一个原因，原因参数就会被转发到他们想要查看的页面。这是一个问题，因为检查参数是否存在是过滤器确定用户是否可以继续前进的主要方式之一。

我尝试过扩展HttpServletRequestWrapper，并覆盖了一堆方法（即getPameter等），以努力删除“原因”参数。但是，我无法看到该参数被删除。一旦过滤器转发到请求的页面，'reason' 参数总是作为 GET 参数出现在查询字符串（即浏览器 url 栏中的 url）中。

我的过滤器类看起来像：

public final class AccessRequestFilter implements Filter {

    public class FilteredRequest extends HttpServletRequestWrapper {

        public FilteredRequest(ServletRequest request) {
            super((HttpServletRequest)request);
        }

        @Override
        public String getParameter(String paramName) {
            String value = super.getParameter(paramName);

            if ("reason".equals(paramName)) {
                value = null;
            }

            return value;
        }

        @Override
        public String[] getParameterValues(String paramName) {
            String[] values = super.getParameterValues(paramName);

            if ("reason".equals(paramName)) {
                values = null;
            }

            return values;
        }

        @Override
        public Enumeration<String> getParameterNames() {
            return Collections.enumeration(getParameterMap().keySet());
        }

        @Override
        public Map<String, String[]> getParameterMap() {            
            Map<String, String[]> params = new HashMap<String, String[]>();
            Map<String, String[]> originalParams = super.getParameterMap();

            for(Object o : originalParams.entrySet()) {
                Map.Entry<String, String[]> pairs = (Map.Entry<String, String[]>) o;
                params.put(pairs.getKey(), pairs.getValue());
            }

            params.remove("reason");

            return params;
        }

        @Override
        public String getQueryString() {
            String qs = super.getQueryString();

            return qs.replaceAll("reason=", "old_reason=");
        }

        @Override
        public StringBuffer getRequestURL() {
            String qs = super.getRequestURL().toString();

            return new StringBuffer( qs.replaceAll("reason=", "old_reason=") );
        }
    }

    private FilterConfig filterConfig = null;  
    private static final Logger logger = MiscUtils.getLogger();

    public void init(FilterConfig filterConfig) throws ServletException {  
        this.filterConfig = filterConfig;  
    }  

    public void destroy() {  
        this.filterConfig = null;  
    }  

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {  
        logger.debug("Entering AccessRequestFilter.doFilter()");

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        HttpSession session = httpRequest.getSession();

        boolean canView = false;
        long echartAccessTime = 0L;
        String demographicNo = "";
        String reason = "";
        Date current = new Date();

        String user_no = (String) session.getAttribute("user");

        ProgramProviderDAO programProviderDAO = (ProgramProviderDAO)SpringUtils.getBean("programProviderDAO");
        ProgramQueueDao programQueueDao = (ProgramQueueDao)SpringUtils.getBean("programQueueDao");

        // Check to see if user has submitted a reason
        reason = request.getParameter("reason");
        demographicNo = request.getParameter("demographicNo");
        Long demographicNoAsLong = 0L;
        try {
            demographicNoAsLong = Long.parseLong( demographicNo );
        } catch (Exception e) {
            logger.error("Unable to parse demographic number.", e);
        }

        if (reason == null) {
            // If no reason was submitted, see if user still has time remaining on previous submission (if there was one)
            try {
                echartAccessTime = (Long)session.getServletContext().getAttribute("echartAccessTime_" + demographicNo);
            } catch (Exception e) {
                logger.warn("No access time found");
            }

            if (current.getTime() - echartAccessTime < 30000) {
                canView = true;
            }
        } else if (!reason.equals("")) {
            // TODO: validate reason
            canView = true;
            session.getServletContext().setAttribute("echartAccessTime_" + demographicNo, current.getTime());
            String ip = request.getRemoteAddr();
            // Log the access request and the reason given for access
            LogAction.addLog(user_no, "access", "eChart", demographicNo, ip, demographicNo, reason);
        }

        if (!canView) {
            // Check if provider is part of circle of care
            List<Long> programIds = new ArrayList<Long>();

            List<ProgramQueue> programQueues = programQueueDao.getAdmittedProgramQueuesByDemographicId( demographicNoAsLong );
            if (programQueues != null && programQueues.size() > 0) {
                for (ProgramQueue pq : programQueues) {
                    programIds.add( pq.getProgramId() );
                }

                List<ProgramProvider> programProviders = programProviderDAO.getProgramProviderByProviderProgramId(user_no, programIds);

                if (programProviders != null && programProviders.size() > 0) {
                    canView = true;
                }
            }
        }

        String useNewCaseMgmt;
        if((useNewCaseMgmt = request.getParameter("newCaseManagement")) != null ) {     
            session.setAttribute("newCaseManagement", useNewCaseMgmt); 
            ArrayList<String> users = (ArrayList<String>)session.getServletContext().getAttribute("CaseMgmtUsers");
            if( users != null ) {
                users.add(request.getParameter("providerNo"));
                session.getServletContext().setAttribute("CaseMgmtUsers", users);
            }
        }
        else {
            useNewCaseMgmt = (String)session.getAttribute("newCaseManagement");             
        }

        String requestURI = httpRequest.getRequestURI();
        String contextPath = httpRequest.getContextPath();

        if (!canView && !requestURI.startsWith(contextPath + "/casemgmt/accessRequest.jsp")) {
            httpResponse.sendRedirect(contextPath + "/casemgmt/accessRequest.jsp?" + httpRequest.getQueryString());
            return;
        }

        logger.debug("AccessRequestFilter chainning");
        chain.doFilter( new FilteredRequest(request), response);
    }
}

过滤器设置为拦截所有请求并转发进入名为 的子目录casemgmt。web.xml 中的过滤器如下：

<filter>
        <filter-name>AccessRequestFilter</filter-name>
        <filter-class>org.oscarehr.casemgmt.filter.AccessRequestFilter</filter-class>
    </filter>
...
<filter-mapping>
        <filter-name>AccessRequestFilter</filter-name>
        <url-pattern>/casemgmt/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
    </filter-mapping>

任何人都知道如何实际删除“原因”参数？

4

1 回答 1

2

在服务器端包装和操作HttpServletRequest绝对不会神奇地影响您在浏览器地址栏中看到的 URL。该 URL 保持原样，因为它是浏览器用来请求所需资源的 URL。包装的请求只会影响在同一请求的过滤器之后运行的服务器端代码。

如果您想更改浏览器地址栏中的 URL，那么您应该将重定向发送到所需的 URL。

基本上，

if (reasonParameterIsIn(queryString)) {
    response.sendRedirect(requestURL + "?" + removeReasonParameterFrom(queryString));
    return;
}
于 2013-02-15T01:50:18.807 回答