Is there a suitable hook for intercepting all POSTs to an OpenACS/AOLServer system?

Question

I'd like to disable all POSTs to an OpenACS/AOLServer installation. Is there an good singular place – a request-hook or wrapper/middleware – to do this?

(Bonus points if the intercept can let a few URI patterns or logged-in users through.)

Answer 1

Yes, this is straight forward to do. You have a choice here: you can register a proc to run instead of all POSTs, or can you register a filter to run before the POST and filter out certain users or whatever. I think the filter is a better choice.

To do this you register your proc or filter using ns_register_proc or ns_register_filter (with preauth). Put the following code in a .tcl file under the tcl folder of an OpenACS package or under the main AOLserver /web/servername/tcl directory.

Filter example:

ns_register_filter preauth POST / filter_posts
proc filter_posts {} {
    set user_id [ad_verify_and_get_user_id]
    set list_of_allowed_user_ids [21 567 8999] 
    if {[lsearch -exact $list_of_allowed_user_ids $user_id] == -1 } {
      #this user isn't allowed - so redirect them
      ns_returnredirect "/register/"
      # tell AOLserver to abort this thread
      return filter_return
    } else {
      # this user is allowed, tell AOLserver to continue
      return filter_ok
    }
}

Proc example:

 ns_register_proc POST / handle_posts
    proc handle_posts {} {
        ns_returnredirect "http://someotherwebsite.com"
    }