/**
 * Copyright 2005-2016 The Kuali Foundation
 *
 * Licensed under the Educational Community License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.opensource.org/licenses/ecl2.php
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.kuali.rice.kns.util;

import org.apache.commons.lang.StringEscapeUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.log4j.Level;
import org.apache.log4j.Logger;
import org.apache.struts.Globals;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.action.ActionServletWrapper;
import org.apache.struts.upload.CommonsMultipartRequestHandler;
import org.apache.struts.upload.FormFile;
import org.apache.struts.upload.MultipartRequestHandler;
import org.apache.struts.upload.MultipartRequestWrapper;
import org.kuali.rice.core.api.CoreApiServiceLocator;
import org.kuali.rice.core.api.config.property.ConfigContext;
import org.kuali.rice.core.api.config.property.ConfigurationService;
import org.kuali.rice.core.api.util.RiceKeyConstants;
import org.kuali.rice.kew.api.action.ActionRequest;
import org.kuali.rice.kew.api.action.RecipientType;
import org.kuali.rice.kim.api.role.Role;
import org.kuali.rice.kim.api.services.KimApiServiceLocator;
import org.kuali.rice.kns.datadictionary.KNSDocumentEntry;
import org.kuali.rice.kns.datadictionary.MaintenanceDocumentEntry;
import org.kuali.rice.kns.document.authorization.DocumentAuthorizer;
import org.kuali.rice.kns.service.KNSServiceLocator;
import org.kuali.rice.kns.web.struts.action.KualiMultipartRequestHandler;
import org.kuali.rice.kns.web.struts.form.KualiDocumentFormBase;
import org.kuali.rice.kns.web.struts.form.KualiForm;
import org.kuali.rice.kns.web.struts.form.KualiMaintenanceForm;
import org.kuali.rice.kns.web.struts.form.pojo.PojoFormBase;
import org.kuali.rice.kns.web.ui.Field;
import org.kuali.rice.kns.web.ui.Row;
import org.kuali.rice.kns.web.ui.Section;
import org.kuali.rice.krad.datadictionary.AttributeDefinition;
import org.kuali.rice.krad.datadictionary.AttributeSecurity;
import org.kuali.rice.krad.datadictionary.DataDictionary;
import org.kuali.rice.krad.datadictionary.DataDictionaryEntryBase;
import org.kuali.rice.krad.datadictionary.mask.MaskFormatter;
import org.kuali.rice.krad.document.Document;
import org.kuali.rice.krad.exception.ValidationException;
import org.kuali.rice.krad.service.KRADServiceLocatorWeb;
import org.kuali.rice.krad.util.GlobalVariables;
import org.kuali.rice.krad.util.KRADConstants;
import org.kuali.rice.krad.util.MessageMap;
import org.kuali.rice.krad.util.ObjectUtils;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import javax.servlet.jsp.PageContext;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.Arrays;
import java.util.Collection;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.Iterator;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
 * General helper methods for handling requests.
 */
public class WebUtils {
	private static final Logger LOG = Logger.getLogger(WebUtils.class);

	private static final String IMAGE_COORDINATE_CLICKED_X_EXTENSION = ".x";
	private static final String IMAGE_COORDINATE_CLICKED_Y_EXTENSION = ".y";

	private static final String APPLICATION_IMAGE_URL_PROPERTY_PREFIX = "application.custom.image.url";
	private static final String DEFAULT_IMAGE_URL_PROPERTY_NAME = "kr.externalizable.images.url";

    /**
     * Prefixes indicating an absolute url
     */
    private static final String[] SCHEMES = { "http://", "https://" };

	/**
	 * A request attribute name that indicates that a
	 * {@link org.kuali.rice.kns.exception.FileUploadLimitExceededException} has already been thrown for the
	 * request.
	 */
	public static final String FILE_UPLOAD_LIMIT_EXCEEDED_EXCEPTION_ALREADY_THROWN = "fileUploadLimitExceededExceptionAlreadyThrown";

	private static ConfigurationService configurationService;

	/**
	 * Checks for methodToCall parameter, and picks off the value using set dot
	 * notation. Handles the problem of image submits.
	 * 
	 * @param request
	 * @return methodToCall String
	 */
	public static String parseMethodToCall(ActionForm form, HttpServletRequest request) {
		String methodToCall = null;

		// check if is specified cleanly
		if (StringUtils.isNotBlank(request.getParameter(KRADConstants.DISPATCH_REQUEST_PARAMETER))) {
			if (form instanceof KualiForm
					&& !((KualiForm) form).shouldMethodToCallParameterBeUsed(KRADConstants.DISPATCH_REQUEST_PARAMETER,
							request.getParameter(KRADConstants.DISPATCH_REQUEST_PARAMETER), request)) {
				throw new RuntimeException("Cannot verify that the methodToCall should be "
						+ request.getParameter(KRADConstants.DISPATCH_REQUEST_PARAMETER));
			}
			methodToCall = request.getParameter(KRADConstants.DISPATCH_REQUEST_PARAMETER);
			// include .x at the end of the parameter to make it consistent w/
			// other parameters
			request.setAttribute(KRADConstants.METHOD_TO_CALL_ATTRIBUTE, KRADConstants.DISPATCH_REQUEST_PARAMETER + "."
					+ methodToCall + IMAGE_COORDINATE_CLICKED_X_EXTENSION);
		}

		/**
		 * The reason why we are checking for a ".x" at the end of the parameter
		 * name: It is for the image names that in addition to sending the form
		 * data, the web browser sends the x,y coordinate of where the user
		 * clicked on the image. If the image input is not given a name then the
		 * browser sends the x and y coordinates as the "x" and "y" input
		 * fields. If the input image does have a name, the x and y coordinates
		 * are sent using the format name.x and name.y.
		 */
		if (methodToCall == null) {
			// iterate through parameters looking for methodToCall
			for (Enumeration i = request.getParameterNames(); i.hasMoreElements();) {
				String parameterName = (String) i.nextElement();

				// check if the parameter name is a specifying the methodToCall
				if (isMethodToCall(parameterName)) {
					methodToCall = getMethodToCallSettingAttribute(form, request, parameterName);
					break;
				}
				else {
					// KULRICE-1218: Check if the parameter's values match (not
					// just the name)
					for (String value : request.getParameterValues(parameterName)) {
						// adding period to startsWith check - don't want to get
						// confused with methodToCallFoobar
						if (isMethodToCall(value)) {
							methodToCall = getMethodToCallSettingAttribute(form, request, value);
							// why is there not a break outer loop here?
						}
					}
				}
			}
		}

		return methodToCall;
	}

    /**
	 * Checks if a string signifies a methodToCall string
	 * 
	 * @param string
	 *            the string to check
	 * @return true if is a methodToCall
	 */
	private static boolean isMethodToCall(String string) {
		// adding period to startsWith check - don't want to get confused with
		// methodToCallFoobar
		return string.startsWith(KRADConstants.DISPATCH_REQUEST_PARAMETER + ".");
	}

	/**
	 * Parses out the methodToCall command and also sets the request attribute
	 * for the methodToCall.
	 * 
	 * @param form
	 *            the ActionForm
	 * @param request
	 *            the request to set the attribute on
	 * @param string
	 *            the methodToCall string
	 * @return the methodToCall command
	 */
	private static String getMethodToCallSettingAttribute(ActionForm form, HttpServletRequest request, String string) {

		if (form instanceof KualiForm
				&& !((KualiForm) form).shouldMethodToCallParameterBeUsed(string, request.getParameter(string), request)) {
			throw new RuntimeException("Cannot verify that the methodToCall should be " + string);
		}
		// always adding a coordinate even if not an image
		final String attributeValue = endsWithCoordinates(string) ? string : string
				+ IMAGE_COORDINATE_CLICKED_X_EXTENSION;
		final String methodToCall = StringUtils.substringBetween(attributeValue,
				KRADConstants.DISPATCH_REQUEST_PARAMETER + ".", ".");
		request.setAttribute(KRADConstants.METHOD_TO_CALL_ATTRIBUTE, attributeValue);
		return methodToCall;
	}

	/**
	 * Iterates through and logs (at the given level) all attributes and
	 * parameters of the given request onto the given Logger
	 * 
	 * @param request
	 * @param logger
	 */
	public static void logRequestContents(Logger logger, Level level, HttpServletRequest request) {
		if (logger.isEnabledFor(level)) {
			logger.log(level, "--------------------");
			logger.log(level, "HttpRequest attributes:");
			for (Enumeration e = request.getAttributeNames(); e.hasMoreElements();) {
				String attrName = (String) e.nextElement();
				Object attrValue = request.getAttribute(attrName);

				if (attrValue.getClass().isArray()) {
					logCollection(logger, level, attrName, Arrays.asList((Object[]) attrValue));
				}
				else if (attrValue instanceof Collection) {
					logCollection(logger, level, attrName, (Collection) attrValue);
				}
				else if (attrValue instanceof Map) {
					logMap(logger, level, attrName, (Map) attrValue);
				}
				else {
					logObject(logger, level, attrName, attrValue);
				}
			}

			logger.log(level, "--------------------");
			logger.log(level, "HttpRequest parameters:");
			for (Enumeration i = request.getParameterNames(); i.hasMoreElements();) {
				String paramName = (String) i.nextElement();
				String[] paramValues = (String[]) request.getParameterValues(paramName);

				logArray(logger, level, paramName, paramValues);
			}

			logger.log(level, "--------------------");
		}
	}

	private static void logArray(Logger logger, Level level, String arrayName, Object[] array) {
		StringBuffer value = new StringBuffer("[");
		for (int i = 0; i < array.length; ++i) {
			if (i > 0) {
				value.append(",");
			}
			value.append(array[i]);
		}
		value.append("]");

		logThing(logger, level, arrayName, value);
	}

	private static void logCollection(Logger logger, Level level, String collectionName, Collection c) {
		StringBuffer value = new StringBuffer("{");
		for (Iterator i = c.iterator(); i.hasNext();) {
			value.append(i.next());
			if (i.hasNext()) {
				value.append(",");
			}
		}
		value.append("}");

		logThing(logger, level, collectionName, value);
	}

	private static void logMap(Logger logger, Level level, String mapName, Map m) {
		StringBuffer value = new StringBuffer("{");
		for (Iterator i = m.entrySet().iterator(); i.hasNext();) {
			Map.Entry e = (Map.Entry) i.next();
			value.append("('" + e.getKey() + "','" + e.getValue() + "')");
		}
		value.append("}");

		logThing(logger, level, mapName, value);
	}

	private static void logObject(Logger logger, Level level, String objectName, Object o) {
		logThing(logger, level, objectName, "'" + o + "'");
	}

	private static void logThing(Logger logger, Level level, String thingName, Object thing) {
		logger.log(level, "    '" + thingName + "' => " + thing);
	}

	/**
	 * A file that is not of type text/plain or text/html can be output through
	 * the response using this method.
	 * 
	 * @param response
	 * @param contentType
	 * @param byteArrayOutputStream
	 * @param fileName
	 */
	public static void saveMimeOutputStreamAsFile(HttpServletResponse response, String contentType,
			ByteArrayOutputStream byteArrayOutputStream, String fileName) throws IOException {

        // If there are quotes in the name, we should replace them to avoid issues.
        // The filename will be wrapped with quotes below when it is set in the header
        String updateFileName;
        if(fileName.contains("\"")) {
            updateFileName = fileName.replaceAll("\"", "");
        } else {
            updateFileName =  fileName;
        }

		// set response
		response.setContentType(contentType);
        response.setHeader("Content-disposition", "attachment; filename=\"" + updateFileName + "\"");
        response.setHeader("Expires", "0");
		response.setHeader("Cache-Control", "must-revalidate, post-check=0, pre-check=0");
		response.setHeader("Pragma", "public");
		response.setContentLength(byteArrayOutputStream.size());

		// write to output
		OutputStream outputStream = response.getOutputStream();
		byteArrayOutputStream.writeTo(response.getOutputStream());
		outputStream.flush();
		outputStream.close();
	}

	/**
	 * A file that is not of type text/plain or text/html can be output through
	 * the response using this method.
	 * 
	 * @param response
	 * @param contentType
	 * @param inStream
	 * @param fileName
	 */
	public static void saveMimeInputStreamAsFile(HttpServletResponse response, String contentType,
			InputStream inStream, String fileName, int fileSize) throws IOException {

        // If there are quotes in the name, we should replace them to avoid issues.
        // The filename will be wrapped with quotes below when it is set in the header
        String updateFileName;
        if(fileName.contains("\"")) {
            updateFileName = fileName.replaceAll("\"", "");
        } else {
            updateFileName =  fileName;
        }

		// set response
		response.setContentType(contentType);
        response.setHeader("Content-disposition", "attachment; filename=\"" + updateFileName + "\"");
        response.setHeader("Expires", "0");
		response.setHeader("Cache-Control", "must-revalidate, post-check=0, pre-check=0");
		response.setHeader("Pragma", "public");
		response.setContentLength(fileSize);

		// write to output
		OutputStream out = response.getOutputStream();
		while (inStream.available() > 0) {
			out.write(inStream.read());
		}
		out.flush();
	}

	/**
	 * JSTL function to return the tab state of the tab from the form.
	 * 
	 * @param form
	 * @param tabKey
	 * @return
	 */
	public static String getTabState(KualiForm form, String tabKey) {
		return form.getTabState(tabKey);
	}

	public static void incrementTabIndex(KualiForm form, String tabKey) {
		form.incrementTabIndex();
	}

    /**
     * Attempts to reopen sub tabs which would have been closed for inactive records
     *
     * @param sections the list of Sections whose rows and fields to set the open tab state on
     * @param tabStates the map of tabKey->tabState.  This map will be modified to set entries to "OPEN"
     * @param collectionName the name of the collection reopening
     */
    public static void reopenInactiveRecords(List<Section> sections, Map<String, String> tabStates, String collectionName) {
        for (Section section : sections) {
            for (Row row: section.getRows()) {
                for (Field field : row.getFields()) {
                    if (field != null) {
                        if (Field.CONTAINER.equals(field.getFieldType()) && StringUtils.startsWith(field.getContainerName(), collectionName)) {
                            final String tabKey = WebUtils.generateTabKey(FieldUtils.generateCollectionSubTabName(field));
                            tabStates.put(tabKey, KualiForm.TabState.OPEN.name());
                        }
                    }
                }
            }
        }
    }

	/**
	 * Generates a String from the title that can be used as a Map key.
	 * 
	 * @param tabTitle
	 * @return
	 */
	public static String generateTabKey(String tabTitle) {
		String key = "";
		if (!StringUtils.isBlank(tabTitle)) {
			key = tabTitle.replaceAll("\\W", "");
			// if (key.length() > 25) {
			// key = key.substring(0, 24);
			// }
		}

		return key;
	}

	public static void getMultipartParameters(HttpServletRequest request, ActionServletWrapper servletWrapper,
			ActionForm form, ActionMapping mapping) {
		Map params = new HashMap();

		// Get the ActionServletWrapper from the form bean
		// ActionServletWrapper servletWrapper = getServletWrapper();

		try {
			CommonsMultipartRequestHandler multipartHandler = new CommonsMultipartRequestHandler();
			if (multipartHandler != null) {
				// Set servlet and mapping info
				if (servletWrapper != null) {
					// from pojoformbase
					// servlet only affects tempdir on local disk
					servletWrapper.setServletFor(multipartHandler);
				}
				multipartHandler.setMapping((ActionMapping) request.getAttribute(Globals.MAPPING_KEY));
				// Initialize multipart request class handler
				multipartHandler.handleRequest(request);

				Collection<FormFile> files = multipartHandler.getFileElements().values();
				Enumeration keys = multipartHandler.getFileElements().keys();

				while (keys.hasMoreElements()) {
					Object key = keys.nextElement();
					FormFile file = (FormFile) multipartHandler.getFileElements().get(key);
					long maxSize = WebUtils.getMaxUploadSize(form);
					if (LOG.isDebugEnabled()) {
						LOG.debug(file.getFileSize());
					}
					if (maxSize > 0 && Long.parseLong(file.getFileSize() + "") > maxSize) {

						GlobalVariables.getMessageMap().putError(key.toString(),
								RiceKeyConstants.ERROR_UPLOADFILE_SIZE,
								new String[] { file.getFileName(), Long.toString(maxSize) });

					}
				}

				// get file elements for kualirequestprocessor
				if (servletWrapper == null) {
					request.setAttribute(KRADConstants.UPLOADED_FILE_REQUEST_ATTRIBUTE_KEY,
							getFileParametersForMultipartRequest(request, multipartHandler));
				}
			}
		}
		catch (ServletException e) {
			throw new ValidationException("unable to handle multipart request " + e.getMessage(), e);
		}
	}

	public static long getMaxUploadSize(ActionForm form) {
		long max = 0L;
		KualiMultipartRequestHandler multipartHandler = new KualiMultipartRequestHandler();
		if (form instanceof PojoFormBase) {
			max = multipartHandler.calculateMaxUploadSizeToMaxOfList(((PojoFormBase) form).getMaxUploadSizes());
		}
		if (LOG.isDebugEnabled()) {
			LOG.debug("Max File Upload Size: " + max);
		}
		return max;
	}

	private static Map getFileParametersForMultipartRequest(HttpServletRequest request,
			MultipartRequestHandler multipartHandler) {
		Map parameters = new HashMap();
		Hashtable elements = multipartHandler.getFileElements();
		Enumeration e = elements.keys();
		while (e.hasMoreElements()) {
			String key = (String) e.nextElement();
			parameters.put(key, elements.get(key));
		}

		if (request instanceof MultipartRequestWrapper) {
			request = (HttpServletRequest) ((MultipartRequestWrapper) request).getRequest();
			e = request.getParameterNames();
			while (e.hasMoreElements()) {
				String key = (String) e.nextElement();
				parameters.put(key, request.getParameterValues(key));
			}
		}
		else {
			LOG.debug("Gathering multipart parameters for unwrapped request");
		}
		return parameters;
	}

	// end multipart

	public static void registerEditableProperty(PojoFormBase form, String editablePropertyName) {
		form.registerEditableProperty(editablePropertyName);
	}

	public static boolean isDocumentSession(Document document, PojoFormBase docForm) {
		boolean sessionDoc = document instanceof org.kuali.rice.krad.document.SessionDocument;
		boolean dataDictionarySessionDoc = false;
		if (!sessionDoc) {
			DataDictionary dataDictionary = KRADServiceLocatorWeb.getDataDictionaryService().getDataDictionary();
			if (docForm instanceof KualiMaintenanceForm) {
				KualiMaintenanceForm maintenanceForm = (KualiMaintenanceForm) docForm;
				if (dataDictionary != null) {
					if (maintenanceForm.getDocTypeName() != null) {
                        MaintenanceDocumentEntry maintenanceDocumentEntry = (MaintenanceDocumentEntry) dataDictionary.getDocumentEntry(maintenanceForm.getDocTypeName());
						dataDictionarySessionDoc = maintenanceDocumentEntry.isSessionDocument();
					}
				}
			}
			else {
				if (document != null && dataDictionary != null) {
					KNSDocumentEntry documentEntry = (KNSDocumentEntry) dataDictionary.getDocumentEntry(document.getClass().getName());
					dataDictionarySessionDoc = documentEntry.isSessionDocument();
				}
			}
		}
		return sessionDoc || dataDictionarySessionDoc;
	}

	public static boolean isFormSessionDocument(PojoFormBase form) {
		Document document = null;
		if (KualiDocumentFormBase.class.isAssignableFrom(form.getClass())) {
			KualiDocumentFormBase docForm = (KualiDocumentFormBase) form;
			document = docForm.getDocument();
		}
		return isDocumentSession(document, form);
	}

	public static String KEY_KUALI_FORM_IN_SESSION = "KualiForm";

	public static ActionForm getKualiForm(PageContext pageContext) {
		return getKualiForm((HttpServletRequest) pageContext.getRequest());
	}

	public static ActionForm getKualiForm(HttpServletRequest request) {
		if (request.getAttribute(KEY_KUALI_FORM_IN_SESSION) != null) {
			return (ActionForm) request.getAttribute(KEY_KUALI_FORM_IN_SESSION);
		}
		else {
			final HttpSession session = request.getSession(false);
			return session != null ? (ActionForm) session.getAttribute(KEY_KUALI_FORM_IN_SESSION) : null;
		}
	}

	public static boolean isPropertyEditable(Set<String> editableProperties, String propertyName) {
		if (LOG.isDebugEnabled()) {
			LOG.debug("isPropertyEditable(" + propertyName + ")");
		}

		boolean returnVal = editableProperties == null
				|| editableProperties.contains(propertyName)
				|| (getIndexOfCoordinateExtension(propertyName) == -1 ? false : editableProperties
						.contains(propertyName.substring(0, getIndexOfCoordinateExtension(propertyName))));
		if (!returnVal) {
			if (LOG.isDebugEnabled()) {
				LOG.debug("isPropertyEditable(" + propertyName + ") == false / editableProperties: "
						+ editableProperties);
			}
		}
		return returnVal;
	}

	public static boolean endsWithCoordinates(String parameter) {
		return parameter.endsWith(WebUtils.IMAGE_COORDINATE_CLICKED_X_EXTENSION)
				|| parameter.endsWith(WebUtils.IMAGE_COORDINATE_CLICKED_Y_EXTENSION);
	}

	public static int getIndexOfCoordinateExtension(String parameter) {
		int indexOfCoordinateExtension = parameter.lastIndexOf(WebUtils.IMAGE_COORDINATE_CLICKED_X_EXTENSION);
        if (indexOfCoordinateExtension == -1) {
            indexOfCoordinateExtension = parameter.lastIndexOf(WebUtils.IMAGE_COORDINATE_CLICKED_Y_EXTENSION);
        }
		return indexOfCoordinateExtension;
	}

    public static boolean isInquiryHiddenField(String className, String fieldName, Object formObject, String propertyName) {
    	boolean isHidden = false;
    	String hiddenInquiryFields = getKualiConfigurationService().getPropertyValueAsString(className + ".hidden");
    	if (StringUtils.isEmpty(hiddenInquiryFields)) {
    		return isHidden;
    	}
    	List hiddenFields = Arrays.asList(hiddenInquiryFields.replaceAll(" ", "").split(","));
    	if (hiddenFields.contains(fieldName.trim())) {
    		isHidden = true;
    	}
    	return isHidden;
    }

    public static boolean isHiddenKimObjectType(String type, String configParameter) {
    	boolean hideType = false;
    	String hiddenTypes = getKualiConfigurationService().getPropertyValueAsString(configParameter);
    	if (StringUtils.isEmpty(hiddenTypes)) {
    		return hideType;
    	}
    	List hiddenTypeValues = Arrays.asList(hiddenTypes.replaceAll(" ", "").split(","));
    	if (hiddenTypeValues.contains(type.trim())) {
    		hideType = true;
    	}
    	return hideType;
    }

	public static String getFullyMaskedValue(String className, String fieldName, Object formObject, String propertyName) {
		String displayMaskValue = null;
		Object propertyValue = ObjectUtils.getPropertyValue(formObject, propertyName);

		DataDictionaryEntryBase entry = (DataDictionaryEntryBase) KRADServiceLocatorWeb.getDataDictionaryService()
				.getDataDictionary().getDictionaryObjectEntry(className);
		AttributeDefinition a = entry.getAttributeDefinition(fieldName);

		AttributeSecurity attributeSecurity = a.getAttributeSecurity();
		if (attributeSecurity != null && attributeSecurity.isMask()) {
			MaskFormatter maskFormatter = attributeSecurity.getMaskFormatter();
			displayMaskValue = maskFormatter.maskValue(propertyValue);

		}
		return displayMaskValue;
	}

	public static String getPartiallyMaskedValue(String className, String fieldName, Object formObject,
			String propertyName) {
		String displayMaskValue = null;
		Object propertyValue = ObjectUtils.getPropertyValue(formObject, propertyName);

		DataDictionaryEntryBase entry = (DataDictionaryEntryBase) KRADServiceLocatorWeb.getDataDictionaryService()
				.getDataDictionary().getDictionaryObjectEntry(className);
		AttributeDefinition a = entry.getAttributeDefinition(fieldName);

		AttributeSecurity attributeSecurity = a.getAttributeSecurity();
		if (attributeSecurity != null && attributeSecurity.isPartialMask()) {
			MaskFormatter partialMaskFormatter = attributeSecurity.getPartialMaskFormatter();
			displayMaskValue = partialMaskFormatter.maskValue(propertyValue);

		}
		return displayMaskValue;
	}

	public static boolean canFullyUnmaskField(String businessObjectClassName, String fieldName, KualiForm form) {
		Class businessObjClass = null;
		try {
			businessObjClass = Class.forName(businessObjectClassName);
		}
		catch (Exception e) {
			throw new RuntimeException("Unable to resolve class name: " + businessObjectClassName);
		}
		if (form instanceof KualiDocumentFormBase) {
			return KNSServiceLocator.getBusinessObjectAuthorizationService().canFullyUnmaskField(
					GlobalVariables.getUserSession().getPerson(), businessObjClass, fieldName,
					((KualiDocumentFormBase) form).getDocument());
		}
		else {
			return KNSServiceLocator.getBusinessObjectAuthorizationService().canFullyUnmaskField(
					GlobalVariables.getUserSession().getPerson(), businessObjClass, fieldName, null);
		}
	}

	public static boolean canPartiallyUnmaskField(String businessObjectClassName, String fieldName, KualiForm form) {
		Class businessObjClass = null;
		try {
			businessObjClass = Class.forName(businessObjectClassName);
		}
		catch (Exception e) {
			throw new RuntimeException("Unable to resolve class name: " + businessObjectClassName);
		}
		if (form instanceof KualiDocumentFormBase) {
			return KNSServiceLocator.getBusinessObjectAuthorizationService().canPartiallyUnmaskField(
					GlobalVariables.getUserSession().getPerson(), businessObjClass, fieldName,
					((KualiDocumentFormBase) form).getDocument());
		}
		else {
			return KNSServiceLocator.getBusinessObjectAuthorizationService().canPartiallyUnmaskField(
					GlobalVariables.getUserSession().getPerson(), businessObjClass, fieldName, null);
		}
	}

	public static boolean canAddNoteAttachment(Document document) {
		boolean canViewNoteAttachment = false;
		DocumentAuthorizer documentAuthorizer = KNSServiceLocator.getDocumentHelperService().getDocumentAuthorizer(
				document);
		canViewNoteAttachment = documentAuthorizer.canAddNoteAttachment(document, null, GlobalVariables
				.getUserSession().getPerson());
		return canViewNoteAttachment;
	}

	public static boolean canViewNoteAttachment(Document document, String attachmentTypeCode) {
		boolean canViewNoteAttachment = false;
		DocumentAuthorizer documentAuthorizer = KNSServiceLocator.getDocumentHelperService().getDocumentAuthorizer(
				document);
		canViewNoteAttachment = documentAuthorizer.canViewNoteAttachment(document, attachmentTypeCode, GlobalVariables
				.getUserSession().getPerson());
		return canViewNoteAttachment;
	}

	public static boolean canDeleteNoteAttachment(Document document, String attachmentTypeCode,
			String authorUniversalIdentifier) {
		boolean canDeleteNoteAttachment = false;
		DocumentAuthorizer documentAuthorizer = KNSServiceLocator.getDocumentHelperService().getDocumentAuthorizer(
				document);
		canDeleteNoteAttachment = documentAuthorizer.canDeleteNoteAttachment(document, attachmentTypeCode, "false",
				GlobalVariables.getUserSession().getPerson());
		if (canDeleteNoteAttachment) {
			return canDeleteNoteAttachment;
		}
		else {
			canDeleteNoteAttachment = documentAuthorizer.canDeleteNoteAttachment(document, attachmentTypeCode, "true",
					GlobalVariables.getUserSession().getPerson());
			if (canDeleteNoteAttachment
					&& !authorUniversalIdentifier.equals(GlobalVariables.getUserSession().getPerson().getPrincipalId())) {
				canDeleteNoteAttachment = false;
			}
		}
		return canDeleteNoteAttachment;
	}

	public static void reuseErrorMapFromPreviousRequest(KualiDocumentFormBase kualiDocumentFormBase) {
		if (kualiDocumentFormBase.getMessageMapFromPreviousRequest() == null) {
			LOG.error("Error map from previous request is null!");
			return;
		}
		MessageMap errorMapFromGlobalVariables = GlobalVariables.getMessageMap();
		if (kualiDocumentFormBase.getMessageMapFromPreviousRequest() == errorMapFromGlobalVariables) {
			// if we've switched them already, then return early and do nothing
			return;
		}
		if (!errorMapFromGlobalVariables.hasNoErrors()) {
			throw new RuntimeException("Cannot replace error map because it is not empty");
		}
		GlobalVariables.setMessageMap(kualiDocumentFormBase.getMessageMapFromPreviousRequest());
		GlobalVariables.getMessageMap().clearErrorPath();
	}

	/**
	 * Excapes out HTML to prevent XSS attacks, and replaces the following
	 * strings to allow for a limited set of HTML tags
	 * 
	 * <li>[X] and [/X], where X represents any 1 or 2 letter string may be used
	 * to specify the equivalent tag in HTML (i.e. &lt;X&gt; and &lt;/X&gt;) <li>
	 * [font COLOR], where COLOR represents any valid html color (i.e. color
	 * name or hexcode preceeded by #) will be filtered into &lt;font
	 * color="COLOR"/&gt; <li>[/font] will be filtered into &lt;/font&gt; <li>
	 * [table CLASS], where CLASS gives the style class to use, will be filter
	 * into &lt;table class="CLASS"/&gt; <li>[/table] will be filtered into
	 * &lt;/table&gt; <li>[td CLASS], where CLASS gives the style class to use,
	 * will be filter into &lt;td class="CLASS"/&gt;
	 * 
	 * @param inputString
	 * @return
	 */
	public static String filterHtmlAndReplaceRiceMarkup(String inputString) {
		String outputString = StringEscapeUtils.escapeHtml(inputString);
		// string has been escaped of all <, >, and & (and other characters)

        Map<String, String> findAndReplacePatterns = new LinkedHashMap<String, String>();

        // now replace our rice custom markup into html

        // DON'T ALLOW THE SCRIPT TAG OR ARBITRARY IMAGES/URLS/ETC. THROUGH

        //strip out instances where javascript precedes a URL
        findAndReplacePatterns.put("\\[a ((javascript|JAVASCRIPT|JavaScript).+)\\]", "");
        //turn passed a href value into appropriate tag
        findAndReplacePatterns.put("\\[a (.+)\\]", "<a href=\"$1\">");
        findAndReplacePatterns.put("\\[/a\\]", "</a>");
        
		// filter any one character tags
		findAndReplacePatterns.put("\\[([A-Za-z])\\]", "<$1>");
		findAndReplacePatterns.put("\\[/([A-Za-z])\\]", "</$1>");
		// filter any two character tags
		findAndReplacePatterns.put("\\[([A-Za-z]{2})\\]", "<$1>");
		findAndReplacePatterns.put("\\[/([A-Za-z]{2})\\]", "</$1>");
		// filter the font tag
		findAndReplacePatterns.put("\\[font (#[0-9A-Fa-f]{1,6}|[A-Za-z]+)\\]", "<font color=\"$1\">");
		findAndReplacePatterns.put("\\[/font\\]", "</font>");
		// filter the table tag
		findAndReplacePatterns.put("\\[table\\]", "<table>");
		findAndReplacePatterns.put("\\[table ([A-Za-z]+)\\]", "<table class=\"$1\">");
		findAndReplacePatterns.put("\\[/table\\]", "</table>");
		// fiter td with class
		findAndReplacePatterns.put("\\[td ([A-Za-z]+)\\]", "<td class=\"$1\">");

		for (String findPattern : findAndReplacePatterns.keySet()) {
			Pattern p = Pattern.compile(findPattern);
			Matcher m = p.matcher(outputString);
			if (m.find()) {
				String replacePattern = findAndReplacePatterns.get(findPattern);
				outputString = m.replaceAll(replacePattern);
			}
		}

		return outputString;
	}

    /**
	 * Determines and returns the URL for question button images; looks first
	 * for a property "application.custom.image.url", and if that is missing,
	 * uses the image url returned by getDefaultButtonImageUrl()
	 * 
	 * @param imageName
	 *            the name of the image to find a button for
	 * @return the URL where question button images are located
	 */
	public static String getButtonImageUrl(String imageName) {
		String buttonImageUrl = getKualiConfigurationService().getPropertyValueAsString(
                WebUtils.APPLICATION_IMAGE_URL_PROPERTY_PREFIX + "." + imageName);
		if (StringUtils.isBlank(buttonImageUrl)) {
			buttonImageUrl = getDefaultButtonImageUrl(imageName);
		}
		return buttonImageUrl;
	}

    public static String getAttachmentImageForUrl(String contentType) {
        String image = getKualiConfigurationService().getPropertyValueAsString(KRADConstants.ATTACHMENT_IMAGE_PREFIX + contentType);
        if (StringUtils.isEmpty(image)) {
            return getKualiConfigurationService().getPropertyValueAsString(KRADConstants.ATTACHMENT_IMAGE_DEFAULT);
        }
        return image;
    }

	/**
	 * Generates a default button image URL, in the form of:
	 * ${kr.externalizable.images.url}buttonsmall_${imageName}.gif
	 * 
	 * @param imageName
	 *            the image name to generate a default button name for
	 * @return the default button image url
	 */
	public static String getDefaultButtonImageUrl(String imageName) {
		return getKualiConfigurationService().getPropertyValueAsString(WebUtils.DEFAULT_IMAGE_URL_PROPERTY_NAME)
				+ "buttonsmall_" + imageName + ".gif";
	}

    /**
	 * @return an implementation of the KualiConfigurationService
	 */
	public static ConfigurationService getKualiConfigurationService() {
		if (configurationService == null) {
			configurationService = CoreApiServiceLocator.getKualiConfigurationService();
		}
		return configurationService;
	}
	
    /**
     * Takes a string an converts the whitespace which would be ignored in an
     * HTML document into HTML elements so the whitespace is preserved
     * 
     * @param startingString The string to preserve whitespace in
     * @return A string whose whitespace has been converted to HTML elements to preserve the whitespace in an HTML document
     */
    public static String preserveWhitespace(String startingString) {
    	String convertedString = startingString.replaceAll("\n", "<br />");
    	convertedString = convertedString.replaceAll("  ", "&nbsp;&nbsp;").replaceAll("(&nbsp; | &nbsp;)", "&nbsp;&nbsp;");
    	return convertedString;
    }
    
    public static String getKimGroupDisplayName(String groupId) {
    	if(StringUtils.isBlank(groupId)) {
    		throw new IllegalArgumentException("Group ID must have a value");
    	}
    	return KimApiServiceLocator.getGroupService().getGroup(groupId).getName();
    }
    
    public static String getPrincipalDisplayName(String principalId) {
    	if(StringUtils.isBlank(principalId)) {
    		throw new IllegalArgumentException("Principal ID must have a value");
    	}
        if (KimApiServiceLocator.getIdentityService().getDefaultNamesForPrincipalId(principalId) == null){
            return "";
        }
        else {
    	    return KimApiServiceLocator.getIdentityService().getDefaultNamesForPrincipalId(principalId).getDefaultName().getCompositeName();
        }
    }

    /**
     * Takes an {@link org.kuali.rice.kew.api.action.ActionRequest} with a recipient type of
     * {@link org.kuali.rice.kew.api.action.RecipientType#ROLE} and returns the display name for the role.
     *
     * @param actionRequest the action request
     * @return the display name for the role
     * @throws IllegalArgumentException if the action request is null, or the recipient type is not ROLE
     */
    public static String getRoleDisplayName(ActionRequest actionRequest) {
        String result;

        if(actionRequest == null) {
            throw new IllegalArgumentException("actionRequest must be non-null");
        }
        if (RecipientType.ROLE != actionRequest.getRecipientType()) {
            throw new IllegalArgumentException("actionRequest recipient must be a Role");
        }

        Role role = KimApiServiceLocator.getRoleService().getRole(actionRequest.getRoleName());

        if (role != null) {
            result = role.getName();
        } else if (!StringUtils.isBlank(actionRequest.getQualifiedRoleNameLabel())) {
            result = actionRequest.getQualifiedRoleNameLabel();
        } else {
            result = actionRequest.getRoleName();
        }

        return result;
    }

    /**
     * Returns an absolute URL which is a combination of a base part plus path,
     * or in the case that the path is already an absolute URL, the path alone
     * @param base the url base path
     * @param path the path to append to base
     * @return an absolute URL representing the combination of base+path, or path alone if it is already absolute
     */
    public static String toAbsoluteURL(String base, String path) {
        boolean abs = false;
        if (StringUtils.isBlank(path)) {
            path = "";
        } else {
            for (String scheme: SCHEMES) {
                if (path.startsWith(scheme)) {
                    abs = true;
                    break;
                }
            }
        }
        if (abs) {
            return path;
        }
        return base + path;
    }

	public static String sanitizeBackLocation(String backLocation) {
		if(StringUtils.isBlank(backLocation)) {
			return backLocation;
		}
		// if it's a relative URL then we should be good regardless
		try {
			URI uri = new URI(backLocation);
			if (!uri.isAbsolute()) {
				return backLocation;
			}
		} catch (URISyntaxException e) {
			// move on to the other checks if it doesn't parse up as a URI for some reason
		}
		Pattern pattern = Pattern.compile(ConfigContext.getCurrentContextConfig().getProperty(KRADConstants.BACK_LOCATION_ALLOWED_REGEX));
		if(pattern.matcher(backLocation).matches()) {
			return backLocation;
		} else {
			return ConfigContext.getCurrentContextConfig().getProperty(KRADConstants.BACK_LOCATION_DEFAULT_URL);
		}
	}

}
