Servlet Filter in Liferay 7.2

Liferay 7.2 - Servlet Filter Sample

Overview

This article describes how to create a servlet filter in Liferay 7.2. 

In this sample we'll create a filter for documents, which allows only admins to access the PDF files.

Filter creation

1. Create service Liferay module for the filter class.
2. Define dependencies in build.gradle file:

   dependencies {
       compileOnly group: "com.liferay.portal", name: "com.liferay.portal.kernel"
       compileOnly group: "com.liferay.portal", name: "com.liferay.util.taglib"
       compileOnly group: "javax.portlet", name: "portlet-api"
       compileOnly group: "javax.servlet", name: "javax.servlet-api"
       compileOnly group: "jstl", name: "jstl"
       compileOnly group: "org.osgi", name: "osgi.cmpn"
   }
   

3. Define OSGi metadata in bnd.bnd, sample:

   Bundle-Name: LifeDev Document Servlet Filter
   Bundle-SymbolicName: com.lifedev.documents.servlet.filter
   Bundle-Version: 1.0.0
   

4. Implement filter class, sample:

   @Component(
           immediate = true,
           property = {
                   "servlet-context-name=",
                   "servlet-filter-name=LifeDev Document Filter",
                   "url-pattern=/documents/*"
           },
           service = Filter.class
   )
   public class LifeDevDocumentServletFilter implements Filter {
   
       @Override
       public void init(FilterConfig filterConfig) throws ServletException {
       }
   
       @Override
       public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
           try {
               HttpServletRequest request = (HttpServletRequest) servletRequest;
               HttpServletResponse response = (HttpServletResponse) servletResponse;
               String documentUri = (String)servletRequest.getAttribute(WebKeys.INVOKER_FILTER_URI);
               if (documentUri.contains(".pdf")) {
                   long userId = (Long)servletRequest.getAttribute(WebKeys.USER_ID);
                   User user = _userLocalService.getUser(userId);
                   boolean isAdmin = PortalUtil.isOmniadmin(user);
                   if (!isAdmin) {
                       PortalUtil.sendError(403, new PrincipalException("Access to document denied."), request, response);
                   }
               }
               filterChain.doFilter(servletRequest, servletResponse);
           } catch (Exception e) {
               _log.warn("Failed to check document access.");
               filterChain.doFilter(servletRequest, servletResponse);
           }
       }
   
       @Override
       public void destroy() {
       }
   
       @Reference
       private UserLocalService _userLocalService;
   
       private static final Log _log = LogFactoryUtil.getLog(LifeDevDocumentServletFilter.class);
   }
   

Notes:

url-pattern here defines pattern for URLs to be intercepted by filter.

doFilter is the method, where filter logic should be implemented. In this example filter sends access denied error for not admin users trying to access PDF document (just as sample).

Enjoy 😏