Checks if the given request is allowed to open files on the server.
The servlet init param must have it enabled, as well as be from an allowed IP.
504756
public static boolean isAllowed(ServletContext servletContext, ServletRequest request) {
		return
			Boolean.parseBoolean(servletContext.getInitParameter(ENABLE_INIT_PARAM))
			&& isAllowedAddr(request.getRemoteAddr())
		;
	}
448606
private void checkAllowedNonFileState(StorageState curState, Object name)
      throws IOException {
    switch (curState) {
    case NON_EXISTENT:
    case NOT_FORMATTED:
    case NORMAL:
      break;
    default:
      throwIOException("ImageManager bad state: " + curState + " for: "
          + name.toString());
    }
  }
484638
public static boolean isInternalRequest(HttpServletRequest request){
		//
		if(Boolean.parseBoolean(request.getHeader(WebConstants.HEADER_INTERNAL_REQUEST))){
			return true;
		}

		boolean isInner = IpUtils.isInnerIp(request.getServerName());
		String forwardHost = request.getHeader(WebConstants.HEADER_FORWARDED_HOST);
		//来源于网关
		if(StringUtils.isNotBlank(forwardHost)){
			isInner = IpUtils.isInnerIp(StringUtils.split(forwardHost, ":")[0]);
		}else{			
			if(!isInner){
				isInner = IpUtils.isInnerIp(IpUtils.getinvokerIpAddr(request));
			}
		}
		return isInner;
	}
638544
public static boolean activate(ServletRequest req) throws IOException {
        CompressionServletResponse rsp = (CompressionServletResponse) req.getAttribute(CompressionServletResponse.class.getName());
        if (rsp!=null) {
            rsp.activate();
            return true;
        } else {
            return false;
        }
    }
690450
public static void initServletRequest(ServletRequest servletRequest, URLTemplatesFactory templatesFactory)
    {
        assert servletRequest != null : "The ServletRequest cannot be null.";

        if (servletRequest == null) {
            throw new IllegalArgumentException("The ServletRequest cannot be null.");
        }

        servletRequest.setAttribute(URL_TEMPLATE_FACTORY_ATTR, templatesFactory);
    }
1088562
private void initializePermissions() {
        // Set the default restrictable permissions
        int count = 0;
        if (tc.isDebugEnabled()) {
            if (isServer) {
                Tr.debug(tc, "running on server ");
            } else {
                Tr.debug(tc, "running on client ");
            }
        }
        
        if (isServer) {
            count = DEFAULT_SERVER_RESTRICTABLE_PERMISSIONS.length;
            originationFile = SERVER_XML;
        } else {
            count = DEFAULT_CLIENT_RESTRICTABLE_PERMISSIONS.length;
            originationFile = CLIENT_XML;
        }

        for (int i = 0; i < count; i++) {
            if (isServer) {
                restrictablePermissions.add(DEFAULT_SERVER_RESTRICTABLE_PERMISSIONS[i]);
            } else {
                restrictablePermissions.add(DEFAULT_CLIENT_RESTRICTABLE_PERMISSIONS[i]);
            }
        }

        // Iterate through the configured Permissions.
        if (permissions != null && !permissions.isEmpty()) {
            Iterable<JavaPermissionsConfiguration> javaPermissions = permissions.services();
            if (javaPermissions != null) {
                for (JavaPermissionsConfiguration permission : javaPermissions) {
                    String permissionClass = String.valueOf(permission.get(JavaPermissionsConfiguration.PERMISSION));
                    String target = String.valueOf(permission.get(JavaPermissionsConfiguration.TARGET_NAME));
                    String action = String.valueOf(permission.get(JavaPermissionsConfiguration.ACTIONS));
                    String credential = String.valueOf(permission.get(JavaPermissionsConfiguration.SIGNED_BY));
                    String principalType = String.valueOf(permission.get(JavaPermissionsConfiguration.PRINCIPAL_TYPE));
                    String principalName = String.valueOf(permission.get(JavaPermissionsConfiguration.PRINCIPAL_NAME));
                    String codebase = normalize(String.valueOf(permission.get(JavaPermissionsConfiguration.CODE_BASE)));

                    // Create the permission object
                    Permission perm = createPermissionObject(permissionClass, target, action, credential, principalType, principalName, originationFile);

                    boolean isRestriction = false;
                    // Is this a restriciton or a grant?
                    if (permission.get(JavaPermissionsConfiguration.RESTRICTION) != null) {
                        isRestriction = ((Boolean) permission.get(JavaPermissionsConfiguration.RESTRICTION)).booleanValue();
                    }

                    if (isRestriction) {
                        // If this is a restriction
                        if (perm != null) {
                            restrictablePermissions.add(perm);
                        }
                    } else {
                        // If this is not a restriction, then set is a grant
                        if (perm != null) {
                            // if codebase is present, then set the permission on the shared lib classloader
                            if (codebase != null && !codebase.equalsIgnoreCase("null")) {
                                setCodeBasePermission(codebase, perm);
                            } else {
                                grantedPermissions.add(perm);
                            }
                        }
                    }
                }

                if (tc.isDebugEnabled()) {
                    Tr.debug(tc, "restrictablePermissions : " + restrictablePermissions);
                    Tr.debug(tc, "grantedPermissions : " + grantedPermissions);
                }
            }
        }

        setSharedLibraryPermission();
    }
2898
def fromOpenIDRequest(cls, request):
        
        self = cls()
        args = request.message.getArgs(self.ns_uri)
        is_openid1 = request.message.isOpenID1()

        if args == {}:
            return None

        self.parseExtensionArgs(args, is_openid1)
        return self
379095
private synchronized static void allowPatchRequestsIfNeeded() throws GeneralException {
        if (isPatchRequestAllowed) {
            // Don't do anything if we've run this method before. We're in a
            // synchronized block, so return ASAP.
            return;
        }

        try {
            // Ensure we can access the fields we need to set.
            Field methodsField = HttpURLConnection.class.getDeclaredField("methods");
            methodsField.setAccessible(true);

            Field modifiersField = Field.class.getDeclaredField("modifiers");
            modifiersField.setAccessible(true);
            modifiersField.setInt(methodsField, methodsField.getModifiers() & ~Modifier.FINAL);

            Object noInstanceBecauseStaticField = null;

            // Determine what methods should be allowed.
            String[] existingMethods = (String[]) methodsField.get(noInstanceBecauseStaticField);
            String[] allowedMethods = getAllowedMethods(existingMethods);

            // Override the actual field to allow PATCH.
            methodsField.set(noInstanceBecauseStaticField, allowedMethods);

            // Set flag so we only have to run this once.
            isPatchRequestAllowed = true;
        } catch (IllegalAccessException | NoSuchFieldException e) {
            throw new GeneralException(CAN_NOT_ALLOW_PATCH);
        }
    }
436764
private boolean checkAndRespond(Request request) {
        if (!URIBean.checkUri(request.getUrl())) {
            ServerResponseBean responseBean = new ServerResponseBean();
            responseBean.setMsgId(request.getMsgId());
            responseBean.setHttpContentType(HttpContentType.APPLICATION_JSON);
            responseBean.setResponseBody(UnitResponse.createError(Group.CODE_BAD_REQUEST, null, String.format("URI %s is illegal.", request.getUrl()))
                    .toVoJSONString());
            IServerResponder.singleton.response(responseBean);
            return false;
        }
        return true;
    }
485536
def check_path_allowed(path):
    

    config = Config.instance().get_section_config("Server")

    project_directory = get_default_project_directory()
    if len(os.path.commonprefix([project_directory, path])) == len(project_directory):
        return

    if "local" in config and config.getboolean("local") is False:
        raise aiohttp.web.HTTPForbidden(text="The path is not allowed")
1315264
private boolean isRequestForbidden(StringBuffer path)
	{
			
		boolean requestIsForbidden = false;
			
		String matchString = path.toString();
		//PM82876 Start
		// The fileName or dirName can have .. , check and fail for ".." in path only which can allow to serve from different location.
		if(WCCustomProperties.ALLOW_DOTS_IN_NAME){

		    if (matchString.indexOf("..") > -1) {
		        if( (matchString.indexOf("/../") > -1) || (matchString.indexOf("\\..\\") > -1) || 
		                        matchString.startsWith("../") || matchString.endsWith("/..") || 
		                        matchString.startsWith("..\\")|| matchString.endsWith("\\..")) 
		        {

		            requestIsForbidden = true;
		            if (com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled() && logger.isLoggable(Level.FINE))
		                logger.logp(Level.FINE, CLASS_NAME, "isRequestForbidden", "bad path :" + matchString);                        
		        }
		    }

		    if ((!requestIsForbidden && (matchString.endsWith("\\") || matchString.endsWith(".") || matchString.endsWith("/")))) {
		        requestIsForbidden = true;                        
		    }

		}
		else{  //PM82876 End
		    /**
		     * Do not allow ".." to appear in a path as it allows one to serve files from anywhere within
		     * the file system.
		     * Also check to see if the path or URI ends with '/', '\', or '.' .
		     * PQ44346 - Allow files on DFS to be served.
		     */

		    if ((matchString.lastIndexOf("..") != -1 && (!matchString.startsWith("/...")))
		                    || matchString.endsWith("\\")
		                    // PK23475 use matchString instead of RequestURI because RequestURI is not decoded
		                    //      || req.getRequestURI().endsWith(".")
		                    || matchString.endsWith(".")
		                    // PK22928
		                    //      || req.getRequestURI().endsWith("/")){
		                    || matchString.endsWith("/"))
		        //PK22928
		    {
		        requestIsForbidden = true;
		    }

		}
		if (com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled()&&logger.isLoggable (Level.FINE))
			logger.logp(Level.FINE, CLASS_NAME,"isRequestForbidden","returning :" + requestIsForbidden + ", matchstring :" + matchString);
			
		return requestIsForbidden;
	}
221836
async def check_permission(request, permission, context=None):
    

    await check_authorized(request)
    allowed = await permits(request, permission, context)
    if not allowed:
        raise web.HTTPForbidden()
377447
@Override
  public void service(RequestWeb req)
  {
    init();
    
    String pathInfo = req.pathInfo();
    
    if (pathInfo.isEmpty() || pathInfo.equals("/")) {
      pathInfo = _config.get("server.index", "index.html");
    } else {
      pathInfo = pathInfo.substring(1);
    }

    Path path = _root.resolve(pathInfo);
    //PathImpl path = Vfs.lookup(root).lookup("./" + pathInfo);
    
    if (Files.isDirectory(path)) {
      path = path.resolve(_config.get("server.index", "index.html"));
    }
    
    long len;
    
    try {
      len = Files.size(path);
    } catch (IOException e) {
      
      req.fail(new FileNotFoundException("file not found: " + req.uri()));
      return;
    }
    
    try (InputStream is = Files.newInputStream(path)) {
      if (is == null) {
        req.fail(new FileNotFoundException(pathInfo));
        return;
      }

      String mimeType = mimeType(pathInfo);
      
      if (mimeType != null) {
        req.header("content-type", mimeType);
      }
      else {
        req.header("content-type", "text/plain; charset=utf-8");
      }
      
      // XXX:
      if (len > 0) {
        req.length(len);
      }
      
      TempBuffer tBuf = TempBuffer.create();
      byte []buffer = tBuf.buffer();
      
      int sublen;
      
      while ((sublen = is.read(buffer, 0, buffer.length)) > 0) {
        req.write(buffer, 0, sublen);
      }
      
      tBuf.free();
    } catch (IOException e) {
      req.fail(e);
    }
    
    req.ok();
  }
648621
public boolean actionInternalUse(HttpServletRequest request) {

        String internal = request.getParameter(PARAM_INTERNAL);

        CmsResource resource;
        boolean internalValue = false;
        if (internal != null) {
            internalValue = true;
        }
        try {
            resource = getCms().readResource(getParamResource(), CmsResourceFilter.ALL);

            int flags = resource.getFlags();

            if (internalValue) {
                flags |= CmsResource.FLAG_INTERNAL;
            } else {
                flags &= ~CmsResource.FLAG_INTERNAL;
            }

            getCms().lockResource(getParamResource());
            getCms().chflags(getParamResource(), flags);

        } catch (CmsException e) {
            m_errorMessages.add(key(Messages.ERR_MODIFY_INTERNAL_FLAG_0));
            if (LOG.isErrorEnabled()) {
                LOG.error(e.getLocalizedMessage(), e);
            }
            return false;
        }
        return true;
    }
821017
public static Map<String, FileItem[]> getRequestFileItems(final HttpServletRequest request) {
		if (request.getAttribute(REQUEST_PROCESSED_KEY) == null) {
			setupRequestParameters(request);
		}
		return (Map<String, FileItem[]>) request.getAttribute(REQUEST_FILES_KEY);
	}
1212030
public static boolean isSourceMapRequest(HttpServletRequest request) {
		String pathInfo = request.getPathInfo();
		boolean result = false;
		if (pathInfo != null && isSourceMapsEnabled(request)) {
			if (pathInfo.endsWith(ILayer.SOURCEMAP_RESOURCE_PATH)) {
				result = true;
			}
		}
		return result;
	}
47615
def check_method_allowed(cls, request):
        
        if not request.method in cls._meta.allowed_methods:
            raise HttpError(
                'Method \'%s\' not allowed on this resource.' % request.method,
                status=status.HTTP_405_METHOD_NOT_ALLOWED)