encoding sendRedirect

"WONG, KENG (AIT)" <[email protected]> Mon, 16 Dec 2002 15:32:12 -0500

Newsgroups	gmane.comp.java.securityfilter.user
Message-ID	<6EB57C3FF1F5A74E8B2C2D176AB545458B9BA6@ilnort1msgusr10.itservices.sbc.com>

Here's the SecurityFilter.java patch to include session encoding before
redirecting.
Since SecurityFilter requires Servlet 2.3 spec, I guess it didn't matter to
check use of the deprecated encodeRedirectUrl().

Thanks.
-keng wong

patch.txt (text/plain, 840 B)

--- SecurityFilter.java.org	Mon Dec 16 11:45:45 2002
+++ SecurityFilter.java	Mon Dec 16 14:28:02 2002
@@ -298,7 +298,7 @@
       // save this request
       saveRequestInformation(request);
       // redirect to login page
-      response.sendRedirect(request.getContextPath() + loginPage);
+      response.sendRedirect(response.encodeRedirectURL(request.getContextPath() + loginPage));
    }
 
    /**
@@ -320,7 +320,7 @@
          // login successful
          request.setUserPrincipal(principal);
          String continueToURL = getContinueToURL(request);
-         response.sendRedirect(continueToURL);
+         response.sendRedirect(response.encodeRedirectURL(continueToURL));
       } else {
          // login failed, set response status and forward to error page
          response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);