Properly logs unauthorized access in admin servlet

Author: alexrobin

sensorhub-webui-core/src/main/java/org/sensorhub/ui/AdminUIModule.java

@@ -156,7 +156,7 @@ public void start() throws SensorHubException
         // reset java util logging config so we don't get annoying atmosphere logs
         LogManager.getLogManager().reset();//.getLogger("org.atmosphere").setLevel(Level.OFF);
 
-        vaadinServlet = new AdminUIServlet(securityHandler);
+        vaadinServlet = new AdminUIServlet(securityHandler, getLogger());
         Map<String, String> initParams = new HashMap<String, String>();
         initParams.put(SERVLET_PARAM_UI_CLASS, AdminUI.class.getCanonicalName());
         initParams.put(SERVLET_PARAM_MODULE_ID, getLocalID());

sensorhub-webui-core/src/main/java/org/sensorhub/ui/AdminUIServlet.java

@@ -19,17 +19,21 @@
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import org.slf4j.Logger;
+import org.vast.ows.OWSUtils;
 import com.vaadin.server.VaadinServlet;
 
 
 @SuppressWarnings("serial")
 public class AdminUIServlet extends VaadinServlet
 {
+    final transient Logger log;
     final transient AdminUISecurity securityHandler;
 
 
-    AdminUIServlet(AdminUISecurity securityHandler)
+    AdminUIServlet(AdminUISecurity securityHandler, Logger log)
     {
+        this.log = log;
         this.securityHandler = securityHandler;
     }
 
@@ -46,10 +50,29 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
             securityHandler.checkPermission(securityHandler.admin_access);            
             super.service(request, response);
         }
+        catch (SecurityException e)
+        {
+            log.info("Access Forbidden: {}", e.getMessage());
+            sendError(response, HttpServletResponse.SC_FORBIDDEN, e.getMessage());
+        }
         finally
         {
             securityHandler.clearCurrentUser();
         }
     }
+    
+    
+    protected void sendError(HttpServletResponse resp, int errorCode, String errorMsg)
+    {
+        try
+        {
+            resp.sendError(errorCode, errorMsg);
+        }
+        catch (IOException e)
+        {
+            if (!OWSUtils.isClientDisconnectError(e) && log.isDebugEnabled())
+                log.error("Cannot send error", e);
+        } 
+    }
 
 }