# HG changeset patch # User Asier Lostalé # Date 1358938488 -3600 # Node ID cbca8284b9b09d902c0ba8e98107da0fa0dca324 # Parent 445835932ea426b23796ad928d7190e0c16b101b fixed issue 22866: Implement a mechanism to log all HTTP Requests RequestLogFilter filters all HTTP requests and if it is enabled, logs them diff -r 445835932ea4 -r cbca8284b9b0 modules/org.openbravo.client.application/src/org/openbravo/client/application/event/UsageAuditHandler.java --- a/modules/org.openbravo.client.application/src/org/openbravo/client/application/event/UsageAuditHandler.java Mon Jan 21 11:45:27 2013 +0100 +++ b/modules/org.openbravo.client.application/src/org/openbravo/client/application/event/UsageAuditHandler.java Wed Jan 23 11:54:48 2013 +0100 @@ -11,7 +11,7 @@ * under the License. * The Original Code is Openbravo ERP. * The Initial Developer of the Original Code is Openbravo SLU - * All portions are Copyright (C) 2012 Openbravo SLU + * All portions are Copyright (C) 2012-2013 Openbravo SLU * All Rights Reserved. * Contributor(s): ______________________________________. ************************************************************************ @@ -42,6 +42,8 @@ SYSTEM_INFO_TABLE_ID) }; private static final Property usageAuditProperty = entities[0] .getProperty(SystemInformation.PROPERTY_ISUSAGEAUDITENABLED); + private static final Property requestLogProperty = entities[0] + .getProperty(SystemInformation.PROPERTY_REQUESTLOGENABLED); private static final Logger log = Logger.getLogger(UsageAuditHandler.class); public void onUpdate(@Observes EntityUpdateEvent event) { @@ -50,6 +52,7 @@ } try { SessionInfo.setUsageAuditActive((Boolean) event.getCurrentState(usageAuditProperty)); + SessionInfo.setRequestLogActive((Boolean) event.getCurrentState(requestLogProperty)); } catch (Exception e) { log.error("Error setting usage audit", e); } diff -r 445835932ea4 -r cbca8284b9b0 src-core/src/org/openbravo/database/SessionInfo.java --- a/src-core/src/org/openbravo/database/SessionInfo.java Mon Jan 21 11:45:27 2013 +0100 +++ b/src-core/src/org/openbravo/database/SessionInfo.java Wed Jan 23 11:54:48 2013 +0100 @@ -11,7 +11,7 @@ * under the License. * The Original Code is Openbravo ERP. * The Initial Developer of the Original Code is Openbravo SLU - * All portions are Copyright (C) 2009-2012 Openbravo SLU + * All portions are Copyright (C) 2009-2013 Openbravo SLU * All Rights Reserved. * Contributor(s): ______________________________________. ************************************************************************ @@ -38,6 +38,7 @@ */ private static boolean isAuditActive = false; private static boolean usageAuditActive = false; + private static boolean requestLogActive = false; /* * The following variables track per thread the information about the current 'user' of the thread @@ -335,4 +336,12 @@ public static void setUsageAuditActive(boolean usageAuditActive) { SessionInfo.usageAuditActive = usageAuditActive; } + + public static boolean isRequestLogActive() { + return requestLogActive; + } + + public static void setRequestLogActive(boolean requestDebugActive) { + SessionInfo.requestLogActive = requestDebugActive; + } } diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/model/tables/AD_SESSION_REQUEST_LOG.xml --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/src-db/database/model/tables/AD_SESSION_REQUEST_LOG.xml Wed Jan 23 11:54:48 2013 +0100 @@ -0,0 +1,70 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

+ diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/model/tables/AD_SYSTEM_INFO.xml --- a/src-db/database/model/tables/AD_SYSTEM_INFO.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/model/tables/AD_SYSTEM_INFO.xml Wed Jan 23 11:54:48 2013 +0100 @@ -189,6 +189,10 @@ + + + + @@ -216,6 +220,7 @@ + diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/sourcedata/AD_COLUMN.xml --- a/src-db/database/sourcedata/AD_COLUMN.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/sourcedata/AD_COLUMN.xml Wed Jan 23 11:54:48 2013 +0100 @@ -220662,6 +220662,43 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -223870,6 +223907,39 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -226617,6 +226687,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -229635,6 +229740,42 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -230164,6 +230305,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -248396,6 +248572,42 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -249887,6 +250099,44 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -255653,6 +255903,42 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -273931,6 +274217,40 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -283486,6 +283806,40 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -293445,6 +293799,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -297771,6 +298160,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -305033,6 +305457,42 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -307165,6 +307625,39 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/sourcedata/AD_ELEMENT.xml --- a/src-db/database/sourcedata/AD_ELEMENT.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/sourcedata/AD_ELEMENT.xml Wed Jan 23 11:54:48 2013 +0100 @@ -21872,6 +21872,19 @@ + + + + + + + + + + + + + @@ -22061,6 +22074,21 @@ + + + + + + + + + + + + + + @@ -23352,6 +23380,18 @@ + + + + + + + + + + + + @@ -28652,6 +28692,19 @@ + + + + + + + + + + + + + @@ -30539,6 +30592,18 @@ + + + + + + + + + + + + diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/sourcedata/AD_FIELD.xml --- a/src-db/database/sourcedata/AD_FIELD.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/sourcedata/AD_FIELD.xml Wed Jan 23 11:54:48 2013 +0100 @@ -177201,6 +177201,32 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -180564,6 +180590,33 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -180905,6 +180958,33 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -186229,6 +186309,33 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -186976,6 +187083,36 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -215115,6 +215252,35 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -222524,6 +222690,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -224535,6 +224729,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + @@ -251056,6 +251275,35 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -257786,6 +258034,33 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/sourcedata/AD_MODEL_OBJECT.xml --- a/src-db/database/sourcedata/AD_MODEL_OBJECT.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/sourcedata/AD_MODEL_OBJECT.xml Wed Jan 23 11:54:48 2013 +0100 @@ -3283,6 +3283,20 @@ + + + + + + + + + + + + + + diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/sourcedata/AD_MODEL_OBJECT_MAPPING.xml --- a/src-db/database/sourcedata/AD_MODEL_OBJECT_MAPPING.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/sourcedata/AD_MODEL_OBJECT_MAPPING.xml Wed Jan 23 11:54:48 2013 +0100 @@ -4420,6 +4420,16 @@ + + + + + + + + + + diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/sourcedata/AD_TAB.xml --- a/src-db/database/sourcedata/AD_TAB.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/sourcedata/AD_TAB.xml Wed Jan 23 11:54:48 2013 +0100 @@ -12478,6 +12478,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff -r 445835932ea4 -r cbca8284b9b0 src-db/database/sourcedata/AD_TABLE.xml --- a/src-db/database/sourcedata/AD_TABLE.xml Mon Jan 21 11:45:27 2013 +0100 +++ b/src-db/database/sourcedata/AD_TABLE.xml Wed Jan 23 11:54:48 2013 +0100 @@ -8106,6 +8106,27 @@ + + + + + + + + + + + + + + + + + + + + + diff -r 445835932ea4 -r cbca8284b9b0 src/org/openbravo/erpCommon/security/RequestLogFilter.java --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/src/org/openbravo/erpCommon/security/RequestLogFilter.java Wed Jan 23 11:54:48 2013 +0100 @@ -0,0 +1,174 @@ +/* + ************************************************************************* + * The contents of this file are subject to the Openbravo Public License + * Version 1.1 (the "License"), being the Mozilla Public License + * Version 1.1 with a permitted attribution clause; you may not use this + * file except in compliance with the License. You may obtain a copy of + * the License at http://www.openbravo.com/legal/license.html + * Software distributed under the License is distributed on an "AS IS" + * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the + * License for the specific language governing rights and limitations + * under the License. + * The Original Code is Openbravo ERP. + * The Initial Developer of the Original Code is Openbravo SLU + * All portions are Copyright (C) 2013 Openbravo SLU + * All Rights Reserved. + * Contributor(s): ______________________________________. + ************************************************************************ + */ + +package org.openbravo.erpCommon.security; + +import java.io.IOException; +import java.sql.Connection; +import java.util.Enumeration; +import java.util.regex.Pattern; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpSession; + +import org.apache.log4j.Logger; +import org.openbravo.database.ConnectionProvider; +import org.openbravo.database.SessionInfo; +import org.openbravo.erpCommon.utility.SequenceIdData; + +/** + * Filters all HTTP requests to log them. + * + * There are two different levels of logging, both can be activated independently: + *

Logger: By enabling {@link Logger} for this class, all requests will be logged in log + * file. + *
Database: Requests are logged in database (in + * {@link org.openbravo.model.ad.utility.RequestLog} entity) when "Request Log Enabled" field in + * "System Info" window is checked. + *

+ * + * The information logged per request is: + *

URI + *
Method + *
OB Session ID + *
User ID + *
Request parameters + *

+ * + * @author alostale + * + */ +public class RequestLogFilter implements Filter { + // excluding images + private static final Pattern excludeUrls = Pattern.compile(".*\\.(png|gif)"); + private static final Logger log = Logger.getLogger(RequestLogFilter.class); + private ConnectionProvider pool; + + @Override + public void destroy() { + } + + @Override + public void init(FilterConfig fConfig) throws ServletException { + pool = (ConnectionProvider) fConfig.getServletContext().getAttribute("openbravoPool"); + } + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) + throws IOException, ServletException { + if (!SessionInfo.isRequestLogActive() && !log.isDebugEnabled()) { + // don't log request + chain.doFilter(request, response); + } else { + long t = System.currentTimeMillis(); + String requestId = logRequest((HttpServletRequest) request); + chain.doFilter(request, response); + updateTime(requestId, t); + } + } + + private String logRequest(HttpServletRequest request) { + try { + long overheadTime = System.currentTimeMillis(); + String requestId = SequenceIdData.getUUID(); + String uri = request.getRequestURI(); + if (excludeUrls.matcher(uri).matches()) { + if (log.isDebugEnabled()) { + log.debug("Request URI (not saved in DB):" + uri); + } + return null; + } + + HttpSession session = request.getSession(false); + String sessionId = ""; + String userId = null; + if (session != null) { + sessionId = (String) session.getAttribute("#AD_SESSION_ID"); + userId = (String) session.getAttribute("#AD_USER_ID"); + } + + if (userId == null || userId.isEmpty()) { + userId = "100"; + } + + StringBuilder parameters = new StringBuilder(); + @SuppressWarnings("unchecked") + Enumeration paramNames = request.getParameterNames(); + while (paramNames.hasMoreElements()) { + String paramName = paramNames.nextElement(); + parameters.append(paramName + ":" + request.getParameter(paramName) + "\n"); + } + + if (SessionInfo.isRequestLogActive()) { + Connection con = pool.getTransactionConnection(); + SessionLoginData.insertRequestLog(con, pool, requestId, userId, sessionId, uri, + request.getMethod(), parameters.toString()); + pool.releaseCommitConnection(con); + } + + if (log.isDebugEnabled()) { + StringBuilder debug = new StringBuilder(); + debug.append("Request URI: ").append(uri).append("\n"); + debug.append(" request ID: ").append(requestId).append("\n"); + debug.append(" method : ").append(request.getMethod()).append("\n"); + debug.append(" session : ").append(sessionId).append("\n"); + debug.append(" user : ").append(userId).append("\n"); + debug.append(" parameters:\n" + parameters.toString()); + log.debug(debug.toString()); + + log.debug("Log overhead time: " + (System.currentTimeMillis() - overheadTime)); + } + + return requestId; + } catch (Throwable th) { + log.error("Error debugging request", th); + return null; + } + } + + private void updateTime(String requestId, long t) { + if (requestId == null) { + return; + } + long timeStaringUpdate = System.currentTimeMillis(); + long processTime = timeStaringUpdate - t; + try { + if (SessionInfo.isRequestLogActive()) { + Connection con = pool.getTransactionConnection(); + SessionLoginData.updateRequestTime(con, pool, Long.toString(processTime), requestId); + pool.releaseCommitConnection(con); + } + + if (log.isDebugEnabled()) { + log.debug("Request ID:" + requestId + " time:" + processTime + " - log overhead " + + (System.currentTimeMillis() - timeStaringUpdate) + "\n-----------------"); + } + } catch (Exception e) { + log.error("Error updating request time", e); + } + } +} diff -r 445835932ea4 -r cbca8284b9b0 src/org/openbravo/erpCommon/security/SessionListener.java --- a/src/org/openbravo/erpCommon/security/SessionListener.java Mon Jan 21 11:45:27 2013 +0100 +++ b/src/org/openbravo/erpCommon/security/SessionListener.java Wed Jan 23 11:54:48 2013 +0100 @@ -11,7 +11,7 @@ * under the License. * The Original Code is Openbravo ERP. * The Initial Developer of the Original Code is Openbravo SLU - * All portions are Copyright (C) 2009-2012 Openbravo SLU + * All portions are Copyright (C) 2009-2013 Openbravo SLU * All Rights Reserved. * Contributor(s): ______________________________________. ************************************************************************ @@ -134,6 +134,14 @@ } catch (Exception e) { log.error("Error activating usage audit", e); } + + try { + SessionInfo.setRequestLogActive(SessionLoginData + .isRequestLogEnabled((ConnectionProvider) SessionListener.context + .getAttribute("openbravoPool"))); + } catch (Exception e) { + log.error("Error activating request debug", e); + } } private boolean checkSessionInRemoteContext(String sessionId, String serverUrl) { diff -r 445835932ea4 -r cbca8284b9b0 src/org/openbravo/erpCommon/security/SessionLogin_data.xsql --- a/src/org/openbravo/erpCommon/security/SessionLogin_data.xsql Mon Jan 21 11:45:27 2013 +0100 +++ b/src/org/openbravo/erpCommon/security/SessionLogin_data.xsql Wed Jan 23 11:54:48 2013 +0100 @@ -12,7 +12,7 @@ * under the License. * The Original Code is Openbravo ERP. * The Initial Developer of the Original Code is Openbravo SLU - * All portions are Copyright (C) 2001-2012 Openbravo SLU + * All portions are Copyright (C) 2001-2013 Openbravo SLU * All Rights Reserved. * Contributor(s): ______________________________________. ************************************************************************ @@ -89,4 +89,41 @@ + + + + + + + + + + + + + + + + + + + + +