Bug fixes

pborissow · pborissow · commit 7e7e90f65f12 · 2024-01-20T13:29:33.000-05:00
diff --git a/src/javaxt/express/Authenticator.java b/src/javaxt/express/Authenticator.java
@@ -257,16 +257,17 @@ protected User getUser(){
             //if (username.equals("logout") && password.equals("logout")) return;
 
 
-
-            Object[] arr = cache.get(username);
-            if (arr!=null){
-                long lastUpdate = (long) arr[1];
-                if (System.currentTimeMillis()-lastUpdate<cacheExpiration){
-                    user = (User) arr[0];
-                }
-                else{
-                    cache.remove(username);
-                    cache.notifyAll();
+            synchronized(cache){
+                Object[] arr = cache.get(username);
+                if (arr!=null){
+                    long lastUpdate = (long) arr[1];
+                    if (System.currentTimeMillis()-lastUpdate<cacheExpiration){
+                        user = (User) arr[0];
+                    }
+                    else{
+                        cache.remove(username);
+                        cache.notifyAll();
+                    }
                 }
             }
         }
diff --git a/src/javaxt/express/WebService.java b/src/javaxt/express/WebService.java
@@ -319,7 +319,11 @@ else if (method.startsWith("delete")){
    *  support CRUD operations. This is a protected method that extending
    *  classes can override to apply custom filters or add constraints when
    *  retrieving objects from the database. This method is called whenever an
-   *  HTTP GET, POST, or DELETE request is made for a Model.
+   *  HTTP GET, POST, or DELETE request is made for a Model. It is perfectly
+   *  acceptable to throw exceptions when overriding this method. When
+   *  throwing exceptions, an IllegalArgumentException will return a HTTP 400
+   *  error to the client and a SecurityException will return a 403 error. All
+   *  other exceptions will return a 500 error.
    *  @param op Operation that is requesting the Recordset. Options include
    *  "list, "get", "save", and "delete".
    *  @param c The Model (Java class) associated with the request.
@@ -646,7 +650,7 @@ private ServiceResponse save(Class c, ServiceRequest request, Database database)
 
 
 
-          //Reparse json
+          //Reparse json (json may have changed in getRecordset)
             json = request.getJson();
             id = json.get("id").toLong();
             isNew = id==null;
@@ -701,15 +705,21 @@ private ServiceResponse delete(Class c, ServiceRequest request, Database databas
         try (Connection conn = database.getConnection()){
 
           //Apply filter
-            Long id = null;
+            Long id = request.getID();
             try (Recordset rs = getRecordset(request, "delete", c,
                 "select id from " + getTableName(c.newInstance()) +
-                " where id=" + request.getID(), conn)){
-                if (!rs.EOF) id = rs.getValue(0).toLong();
+                " where id=" + id, conn)){
+                if (rs.EOF) id = null;
+                else id = rs.getValue("id").toLong();
             }
             if (id==null) return new ServiceResponse(404);
 
 
+          //Reparse request to get ID (id may have changed in getRecordset)
+            Long newID = request.getParameter("id").toLong();
+            if (newID!=null) id = newID;
+
+
           //Create new instance of the class
             Object obj = newInstance(c, id);
 
@@ -890,7 +900,9 @@ private String getWhere(ServiceRequest request, HashMap<String, Object> tablesAn
                         String v = item.getValue().toString();
 
                         if (v!=null && stringFields.contains(fieldName)){
-                            v = "'" + v.replace("'","''") + "'";
+                            if (!(v.startsWith("'") && v.endsWith("'"))){
+                                v = "'" + v.replace("'","''") + "'";
+                            }
                         }
 
                         arr.add("(" + tableName + "." + columnName + " " + op + " " + v + ")");
@@ -922,6 +934,9 @@ private ServiceResponse getServiceResponse(Exception e){
         else if (e instanceof SecurityException){
             return new ServiceResponse(403, "Not Authorized");
         }
+        else if (e instanceof IllegalArgumentException){
+            return new ServiceResponse(400, e.getMessage());
+        }
         else{
             return new ServiceResponse(e);
         }
