Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that implements a metadata catalog as a java Servlet

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones, Dan Higgins, Jivka Bojilova, Chad Berkley

 *    Release: @release@

 *

 *   '$Author: sgarg $'

 *     '$Date: 2005-11-10 13:34:44 -0800 (Thu, 10 Nov 2005) $'

 * '$Revision: 2729 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.io.BufferedInputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.IOException;

import java.io.PrintWriter;

import java.io.StringReader;

import java.net.MalformedURLException;

import java.net.URL;

import java.sql.PreparedStatement;

import java.sql.ResultSet;

import java.sql.SQLException;

import java.sql.Timestamp;

import java.text.ParseException;

import java.text.SimpleDateFormat;

import java.util.Enumeration;

import java.util.Hashtable;

import java.util.Iterator;

import java.util.PropertyResourceBundle;

import java.util.Vector;

import java.util.zip.ZipEntry;

import java.util.zip.ZipOutputStream;

import java.util.Timer;

import javax.servlet.ServletConfig;

import javax.servlet.ServletContext;

import javax.servlet.ServletException;

import javax.servlet.ServletOutputStream;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import org.ecoinformatics.eml.EMLParser;

import com.oreilly.servlet.multipart.FilePart;

import com.oreilly.servlet.multipart.MultipartParser;

import com.oreilly.servlet.multipart.ParamPart;

import com.oreilly.servlet.multipart.Part;

import org.apache.log4j.Logger;

import org.apache.log4j.PropertyConfigurator;

import edu.ucsb.nceas.utilities.Options;

/**

 * A metadata catalog server implemented as a Java Servlet

 *

 * <p>

 * Valid parameters are: <br>

 * action=query -- query the values of all elements and attributes and return a

 * result set of nodes <br>

 * action=squery -- structured query (see pathquery.dtd) <br>

 * action= -- export a zip format for data packadge <br>

 * action=read -- read any metadata/data file from Metacat and from Internet

 * <br>

 * action=insert -- insert an XML document into the database store <br>

 * action=update -- update an XML document that is in the database store <br>

 * action=delete -- delete an XML document from the database store <br>

 * action=validate -- vallidate the xml contained in valtext <br>

 * doctype -- document type list returned by the query (publicID) <br>

 * qformat=xml -- display resultset from query in XML <br>

 * qformat=html -- display resultset from query in HTML <br>

 * qformat=zip -- zip resultset from query <br>

 * docid=34 -- display the document with the document ID number 34 <br>

 * doctext -- XML text of the document to load into the database <br>

 * acltext -- XML access text for a document to load into the database <br>

 * dtdtext -- XML DTD text for a new DTD to load into Metacat XML Catalog <br>

 * query -- actual query text (to go with 'action=query' or 'action=squery')

 * <br>

 * valtext -- XML text to be validated <br>

 * action=getaccesscontrol -- retrieve acl info for Metacat document <br>

 * action=getdoctypes -- retrieve all doctypes (publicID) <br>

 * action=getdtdschema -- retrieve a DTD or Schema file <br>

 * action=getdataguide -- retrieve a Data Guide <br>

 * action=getprincipals -- retrieve a list of principals in XML <br>

 * datadoc -- data document name (id) <br>

 * action=getlog -- get a report of events that have occurred in the system<br>

 * ipAddress --  filter on one or more IP addresses<br>

 * principal -- filter on one or more principals (LDAP DN syntax)<br>

 * docid -- filter on one or more document identifiers (with revision)<br>

 * event -- filter on event type (e.g., read, insert, update, delete)<br>

 * start -- filter out events before the start date-time<br>

 * end -- filter out events before the end date-time<br>

 * <p>

 * The particular combination of parameters that are valid for each particular

 * action value is quite specific. This documentation will be reorganized to

 * reflect this information.

 */

public class MetaCatServlet extends HttpServlet

{

    private ServletConfig config = null;

    private ServletContext context = null;

    private String resultStyleURL = null;

    private String xmlcatalogfile = null;

    private String saxparser = null;

    private String datafilepath = null;

    private File dataDirectory = null;

    private String servletpath = null;

    private String htmlpath = null;

    private PropertyResourceBundle options = null;

    private MetaCatUtil util = null;

    private DBConnectionPool connPool = null;

    private static Hashtable sessionHash = new Hashtable();

    private static final String PROLOG = "<?xml version=\"1.0\"?>";

    private static final String SUCCESS = "<success>";

    private static final String SUCCESSCLOSE = "</success>";

    private static final String ERROR = "<error>";

    private static final String ERRORCLOSE = "</error>";

    public static final String SCHEMALOCATIONKEYWORD = ":schemaLocation";

    public static final String NONAMESPACELOCATION = ":noNamespaceSchemaLocation";

    public static final String NAMESPACEKEYWORD = "xmlns";

    public static final String EML2KEYWORD = ":eml";

    public static final String XMLFORMAT = "xml";

    private static final String CONFIG_DIR = "WEB-INF";

    private static final String CONFIG_NAME = "metacat.properties";

    private static Logger logMetacat = Logger.getLogger(MetaCatServlet.class);

    private Timer timer = null;

    /**

     * Initialize the servlet by creating appropriate database connections

     */

    public void init(ServletConfig config) throws ServletException

    {

        try {

            super.init(config);

            this.config = config;

            this.context = config.getServletContext();

            // Initialize the properties file for our options

            String dirPath = context.getRealPath(CONFIG_DIR);

            File propertyFile = new File(dirPath, CONFIG_NAME);

            String LOG_CONFIG_NAME = dirPath + "/log4j.properties";

            PropertyConfigurator.configureAndWatch(LOG_CONFIG_NAME);

            Options options = null;

            try {

                options = Options.initialize(propertyFile);

                MetaCatUtil.printMessage("Options configured: "

                        + options.getOption("configured"));

            } catch (IOException ioe) {

                logMetacat.error("Error in loading options: "

                        + ioe.getMessage());

            }

            util = new MetaCatUtil();

            //initial DBConnection pool

            connPool = DBConnectionPool.getInstance();

            // Get the configuration file information

            resultStyleURL = MetaCatUtil.getOption("resultStyleURL");

            xmlcatalogfile = MetaCatUtil.getOption("xmlcatalogfile");

            saxparser = MetaCatUtil.getOption("saxparser");

            datafilepath = MetaCatUtil.getOption("datafilepath");

            dataDirectory = new File(datafilepath);

            servletpath = MetaCatUtil.getOption("servletpath");

            htmlpath = MetaCatUtil.getOption("htmlpath");

            // Index the paths specified in the metacat.properties

            checkIndexPaths();

            // initiate the indexing Queue

            IndexingQueue.getInstance();

            // start the IndexingThread if indexingTimerTaskTime more than 0. 

            // It will index all the documents not yet indexed in the database             

            int indexingTimerTaskTime = Integer.parseInt(MetaCatUtil.getOption("indexingTimerTaskTime"));

            if(indexingTimerTaskTime > 0){

            	timer = new Timer();

            	timer.schedule(new IndexingTimerTask(), 0, indexingTimerTaskTime);

            }

            MetaCatUtil.printMessage("Metacat (" + Version.getVersion()

                               + ") initialized.");

        } catch (ServletException ex) {

            throw ex;

        } catch (SQLException e) {

            logMetacat.error("Error in MetacatServlet.init: "

                    + e.getMessage());

        }

    }

    /**

     * Close all db connections from the pool

     */

    public void destroy()

    {

        // Close all db connection

        System.out.println("Destroying MetacatServlet");

        DBConnectionPool.release();

        timer.cancel();

    }

    /** Handle "GET" method requests from HTTP clients */

    public void doGet(HttpServletRequest request, HttpServletResponse response)

            throws ServletException, IOException

    {

        // Process the data and send back the response

        handleGetOrPost(request, response);

    }

    /** Handle "POST" method requests from HTTP clients */

    public void doPost(HttpServletRequest request, HttpServletResponse response)

            throws ServletException, IOException

    {

        // Process the data and send back the response

        handleGetOrPost(request, response);

    }

    /**

     * Index the paths specified in the metacat.properties

     */

    private void checkIndexPaths(){

        MetaCatUtil.pathsForIndexing

            = MetaCatUtil.getOptionList(MetaCatUtil.getOption("indexed_paths"));

        if (MetaCatUtil.pathsForIndexing != null) {

            MetaCatUtil.printMessage("Indexing paths specified in metacat.properties....");

            DBConnection conn = null;

            int serialNumber = -1;

            PreparedStatement pstmt = null;

            PreparedStatement pstmt1 = null;

            ResultSet rs = null;

            for (int i = 0; i < MetaCatUtil.pathsForIndexing.size(); i++) {

                logMetacat.info("Checking if '"

                           + (String) MetaCatUtil.pathsForIndexing.elementAt(i)

                           + "' is indexed.... ");

                try {

                    //check out DBConnection

                    conn = DBConnectionPool.

                        getDBConnection("MetaCatServlet.checkIndexPaths");

                    serialNumber = conn.getCheckOutSerialNumber();

                    pstmt = conn.prepareStatement(

                        "SELECT * FROM xml_path_index " + "WHERE path = ?");

                    pstmt.setString(1, (String) MetaCatUtil.pathsForIndexing

                                    .elementAt(i));

                    pstmt.execute();

                    rs = pstmt.getResultSet();

                    if (!rs.next()) {

                        logMetacat.info(".....not indexed yet.");

                        rs.close();

                        pstmt.close();

                        conn.increaseUsageCount(1);

                        logMetacat.debug(

                              "Inserting following path in xml_path_index: "

                              + (String)MetaCatUtil.pathsForIndexing

                                                   .elementAt(i));

                        pstmt = conn.prepareStatement("SELECT DISTINCT n.docid, "

                              + "n.nodedata, n.nodedatanumerical, n.parentnodeid"

                              + " FROM xml_nodes n, xml_index i WHERE"

                              + " i.path = ? and n.parentnodeid=i.nodeid and"

                              + " n.nodetype LIKE 'TEXT' order by n.parentnodeid");

                        pstmt.setString(1, (String) MetaCatUtil.

                                        pathsForIndexing.elementAt(i));

                        pstmt.execute();

                        rs = pstmt.getResultSet();

                        int count = 0;

                        logMetacat.debug(

                                       "Executed the select statement for: "

                                       + (String) MetaCatUtil.pathsForIndexing

                                         .elementAt(i));

                        try {

                            while (rs.next()) {

                                String docid = rs.getString(1);

                                String nodedata = rs.getString(2);

                                float nodedatanumerical = rs.getFloat(3);

                                int parentnodeid = rs.getInt(4);

                                if (!nodedata.trim().equals("")) {

                                    pstmt1 = conn.prepareStatement(

                                        "INSERT INTO xml_path_index"

                                        + " (docid, path, nodedata, "

                                        + "nodedatanumerical, parentnodeid)"

                                        + " VALUES (?, ?, ?, ?, ?)");

                                    pstmt1.setString(1, docid);

                                    pstmt1.setString(2, (String) MetaCatUtil.

                                                pathsForIndexing.elementAt(i));

                                    pstmt1.setString(3, nodedata);

                                    pstmt1.setFloat(4, nodedatanumerical);

                                    pstmt1.setInt(5, parentnodeid);

                                    pstmt1.execute();

                                    pstmt1.close();

                                    count++;

                                }

                            }

                        }

                        catch (Exception e) {

                            System.out.println("Exception:" + e.getMessage());

                            e.printStackTrace();

                        }

                        rs.close();

                        pstmt.close();

                        conn.increaseUsageCount(1);

                        logMetacat.warn("Indexed " + count

                                + " records from xml_nodes for '"

                                + (String) MetaCatUtil.pathsForIndexing.elementAt(i)

                                + "'");

                    } else {

                    	logMetacat.info(".....already indexed.");

                    }

                    rs.close();

                    pstmt.close();

                    conn.increaseUsageCount(1);

                } catch (Exception e) {

                    logMetacat.error("Error in MetaCatServlet.checkIndexPaths: "

                                             + e.getMessage());

                }finally {

                    //check in DBonnection

                    DBConnectionPool.returnDBConnection(conn, serialNumber);

                }

            }

            MetaCatUtil.printMessage("Path Indexing Completed");

        }

    }    

    /**

     * Control servlet response depending on the action parameter specified

     */

    private void handleGetOrPost(HttpServletRequest request,

            HttpServletResponse response) throws ServletException, IOException

    {

        if (util == null) {

            util = new MetaCatUtil();

        }

        /*

         * logMetacat.info("Connection pool size: "

         * +connPool.getSizeOfDBConnectionPool(),10);

         * logMetacat.info("Free DBConnection number: "

         */

        //If all DBConnection in the pool are free and DBConnection pool

        //size is greater than initial value, shrink the connection pool

        //size to initial value

        DBConnectionPool.shrinkDBConnectionPoolSize();

        //Debug message to print out the method which have a busy DBConnection

        connPool.printMethodNameHavingBusyDBConnection();

        String ctype = request.getContentType();

        if (ctype != null && ctype.startsWith("multipart/form-data")) {

            handleMultipartForm(request, response);

        } else {

            String name = null;

            String[] value = null;

            String[] docid = new String[3];

            Hashtable params = new Hashtable();

            Enumeration paramlist = request.getParameterNames();

            while (paramlist.hasMoreElements()) {

                name = (String) paramlist.nextElement();

                value = request.getParameterValues(name);

                // Decode the docid and mouse click information

                if (name.endsWith(".y")) {

                    docid[0] = name.substring(0, name.length() - 2);

                    params.put("docid", docid);

                    name = "ypos";

                }

                if (name.endsWith(".x")) {

                    name = "xpos";

                }

                params.put(name, value);

            }

            //handle param is emptpy

            if (params.isEmpty() || params == null) { return; }

            //if the user clicked on the input images, decode which image

            //was clicked then set the action.

            if(params.get("action") == null){

                PrintWriter out = response.getWriter();

                response.setContentType("text/xml");

                out.println("<?xml version=\"1.0\"?>");

                out.println("<error>");

                out.println("Action not specified");

                out.println("</error>");

                out.close();

                return;

            }

            String action = ((String[]) params.get("action"))[0];

            logMetacat.warn("Action is: " + action);

            // This block handles session management for the servlet

            // by looking up the current session information for all actions

            // other than "login" and "logout"

            String username = null;

            String password = null;

            String[] groupnames = null;

            String sess_id = null;

            name = null;

            // handle login action

            if (action.equals("login")) {

                PrintWriter out = response.getWriter();

                handleLoginAction(out, params, request, response);

                out.close();

                // handle logout action

            } else if (action.equals("logout")) {

                PrintWriter out = response.getWriter();

                handleLogoutAction(out, params, request, response);

                out.close();

                // handle shrink DBConnection request

            } else if (action.equals("shrink")) {

                PrintWriter out = response.getWriter();

                boolean success = false;

                //If all DBConnection in the pool are free and DBConnection

                // pool

                //size is greater than initial value, shrink the connection

                // pool

                //size to initial value

                success = DBConnectionPool.shrinkConnectionPoolSize();

                if (success) {

                    //if successfully shrink the pool size to initial value

                    out.println("DBConnection Pool shrunk successfully.");

                }//if

                else {

                    out.println("DBConnection pool not shrunk successfully.");

                }

                //close out put

                out.close();

                // aware of session expiration on every request

            } else {

                HttpSession sess = request.getSession(true);

                if (sess.isNew() && !params.containsKey("sessionid")) {

                    // session expired or has not been stored b/w user requests

                    logMetacat.warn(

                            "The session is new or no sessionid is assigned. The user is public");

                    username = "public";

                    sess.setAttribute("username", username);

                } else {

                    logMetacat.warn("The session is either old or "

                            + "has sessionid parameter");

                    try {

                        if (params.containsKey("sessionid")) {

                            sess_id = ((String[]) params.get("sessionid"))[0];

                            logMetacat.info("in has sessionid "

                                    + sess_id);

                            if (sessionHash.containsKey(sess_id)) {

                                logMetacat.info("find the id "

                                        + sess_id + " in hash table");

                                sess = (HttpSession) sessionHash.get(sess_id);

                            }

                        } else {

                            // we already store the session in login, so we

                            // don't need here

                            /*

                             * logMetacat.info("in no sessionid

                             * parameter ", 40); sess_id =

                             * (String)sess.getId();

                             * logMetacat.info("storing the session id "

                             * + sess_id + " which has username " +

                             * sess.getAttribute("username") + " into session

                             * hash in handleGetOrPost method", 35);

                             */

                        }

                    } catch (IllegalStateException ise) {

                        logMetacat.error(

                                "Error in handleGetOrPost: this shouldn't "

                                + "happen: the session should be valid: "

                                + ise.getMessage());

                    }

                    username = (String) sess.getAttribute("username");

                    logMetacat.info("The user name from session is: "

                            + username);

                    password = (String) sess.getAttribute("password");

                    groupnames = (String[]) sess.getAttribute("groupnames");

                    name = (String) sess.getAttribute("name");

                }

                //make user user username should be public

                if (username == null || (username.trim().equals(""))) {

                    username = "public";

                }

                logMetacat.warn("The user is : " + username);

            }

            // Now that we know the session is valid, we can delegate the

            // request

            // to a particular action handler

            if (action.equals("query")) {

                PrintWriter out = response.getWriter();

                handleQuery(out, params, response, username, groupnames,

                        sess_id);

                out.close();

            } else if (action.equals("squery")) {

                PrintWriter out = response.getWriter();

                if (params.containsKey("query")) {

                    handleSQuery(out, params, response, username, groupnames,

                            sess_id);

                    out.close();

                } else {

                    out.println(

                            "Illegal action squery without \"query\" parameter");

                    out.close();

                }

            } else if (action.equals("export")) {

                handleExportAction(params, response, username,

                        groupnames, password);

            } else if (action.equals("read")) {

                handleReadAction(params, request, response, username, password,

                        groupnames);

            } else if (action.equals("readinlinedata")) {

                handleReadInlineDataAction(params, request, response, username,

                        password, groupnames);

            } else if (action.equals("insert") || action.equals("update")) {

                PrintWriter out = response.getWriter();

                if ((username != null) && !username.equals("public")) {

                    handleInsertOrUpdateAction(request, response,

                            out, params, username, groupnames);

                } else {

                    response.setContentType("text/xml");

                    out.println("<?xml version=\"1.0\"?>");

                    out.println("<error>");

                    out.println("Permission denied for user " + username + " "

                            + action);

                    out.println("</error>");

                }

                out.close();

            } else if (action.equals("delete")) {

                PrintWriter out = response.getWriter();

                if ((username != null) && !username.equals("public")) {

                    handleDeleteAction(out, params, request, response, username,

                            groupnames);

                } else {

                    response.setContentType("text/xml");

                    out.println("<?xml version=\"1.0\"?>");

                    out.println("<error>");

                    out.println("Permission denied for " + action);

                    out.println("</error>");

                }

                out.close();

            } else if (action.equals("validate")) {

                PrintWriter out = response.getWriter();

                handleValidateAction(out, params);

                out.close();

            } else if (action.equals("setaccess")) {

                PrintWriter out = response.getWriter();

                handleSetAccessAction(out, params, username);

                out.close();

            } else if (action.equals("getaccesscontrol")) {

                PrintWriter out = response.getWriter();

                handleGetAccessControlAction(out, params, response, username,

                        groupnames);

                out.close();

            } else if (action.equals("getprincipals")) {

                PrintWriter out = response.getWriter();

                handleGetPrincipalsAction(out, username, password);

                out.close();

            } else if (action.equals("getdoctypes")) {

                PrintWriter out = response.getWriter();

                handleGetDoctypesAction(out, params, response);

                out.close();

            } else if (action.equals("getdtdschema")) {

                PrintWriter out = response.getWriter();

                handleGetDTDSchemaAction(out, params, response);

                out.close();

            } else if (action.equals("getlastdocid")) {

                PrintWriter out = response.getWriter();

                handleGetMaxDocidAction(out, params, response);

                out.close();

            } else if (action.equals("getrevisionanddoctype")) {

                PrintWriter out = response.getWriter();

                handleGetRevisionAndDocTypeAction(out, params);

                out.close();

            } else if (action.equals("getversion")) {

                response.setContentType("text/xml");

                PrintWriter out = response.getWriter();

                out.println(Version.getVersionAsXml());

                out.close();

            } else if (action.equals("getlog")) {

                handleGetLogAction(params, request, response, username, groupnames);

            } else if (action.equals("getloggedinuserinfo")) {

                PrintWriter out = response.getWriter();

                response.setContentType("text/xml");

                out.println("<?xml version=\"1.0\"?>");

                out.println("\n<user>\n");

                out.println("\n<username>\n");

                out.println(username);

                out.println("\n</username>\n");

                if(name!=null){

                	out.println("\n<name>\n");

                	out.println(name);

                	out.println("\n</name>\n");

                }

                if(MetaCatUtil.isAdministrator(username, groupnames)){

                	out.println("<isAdministrator></isAdministrator>\n");	

                }

                if(MetaCatUtil.isModerator(username, groupnames)){

                	out.println("<isModerator></isModerator>\n");	

                }

                out.println("\n</user>\n");

                out.close();

            } else if (action.equals("buildindex")) {

                handleBuildIndexAction(params, request, response, username, groupnames);

            } else if (action.equals("login") || action.equals("logout")) {

                /*

            } else if (action.equals("protocoltest")) {

                String testURL = "metacat://dev.nceas.ucsb.edu/NCEAS.897766.9";

                try {

                    testURL = ((String[]) params.get("url"))[0];

                } catch (Throwable t) {

                }

                String phandler = System

                        .getProperty("java.protocol.handler.pkgs");

                response.setContentType("text/html");

                PrintWriter out = response.getWriter();

                out.println("<body bgcolor=\"white\">");

                out.println("<p>Handler property: <code>" + phandler

                        + "</code></p>");

                out.println("<p>Starting test for:<br>");

                out.println("    " + testURL + "</p>");

                try {

                    URL u = new URL(testURL);

                    out.println("<pre>");

                    out.println("Protocol: " + u.getProtocol());

                    out.println("    Host: " + u.getHost());

                    out.println("    Port: " + u.getPort());

                    out.println("    Path: " + u.getPath());

                    out.println("     Ref: " + u.getRef());

                    String pquery = u.getQuery();

                    out.println("   Query: " + pquery);

                    out.println("  Params: ");

                    if (pquery != null) {

                        Hashtable qparams = MetaCatUtil.parseQuery(u.getQuery());

                        for (Enumeration en = qparams.keys(); en

                                .hasMoreElements();) {

                            String pname = (String) en.nextElement();

                            String pvalue = (String) qparams.get(pname);

                            out.println("    " + pname + ": " + pvalue);

                        }

                    }

                    out.println("</pre>");

                    out.println("</body>");

                    out.close();

                } catch (MalformedURLException mue) {

                    System.out.println(

                            "bad url from MetacatServlet.handleGetOrPost");

                    out.println(mue.getMessage());

                    mue.printStackTrace(out);

                    out.close();

                }

                */

            } else {

                PrintWriter out = response.getWriter();

                out.println("<?xml version=\"1.0\"?>");

                out.println("<error>");

                out.println(

                     "Error: action not registered.  Please report this error.");

                out.println("</error>");

                out.close();

            }

            //util.closeConnections();

            // Close the stream to the client

            //out.close();

        }

    }

    // LOGIN & LOGOUT SECTION

    /**

     * Handle the login request. Create a new session object. Do user

     * authentication through the session.

     */

    private void handleLoginAction(PrintWriter out, Hashtable params,

            HttpServletRequest request, HttpServletResponse response)

    {

        AuthSession sess = null;

        if(params.get("username") == null){

            response.setContentType("text/xml");

            out.println("<?xml version=\"1.0\"?>");

            out.println("<error>");

            out.println("Username not specified");

            out.println("</error>");

            return;

        }

        if(params.get("password") == null){

            response.setContentType("text/xml");

            out.println("<?xml version=\"1.0\"?>");

            out.println("<error>");

            out.println("Password not specified");

            out.println("</error>");

            return;

        }

        String un = ((String[]) params.get("username"))[0];

        logMetacat.warn("user " + un + " is trying to login");

        String pw = ((String[]) params.get("password"))[0];

        String qformat = "xml";

        if(params.get("qformat") != null){

            qformat = ((String[]) params.get("qformat"))[0];

        }

        try {

            sess = new AuthSession();

        } catch (Exception e) {

            System.out.println("error in MetacatServlet.handleLoginAction: "

                    + e.getMessage());

            out.println(e.getMessage());

            return;

        }

        boolean isValid = sess.authenticate(request, un, pw);

        //if it is authernticate is true, store the session

        if (isValid) {

            HttpSession session = sess.getSessions();

            String id = session.getId();

            logMetacat.info("Store session id " + id

                    + "which has username" + session.getAttribute("username")

                    + " into hash in login method");

            sessionHash.put(id, session);

        }

        // format and transform the output

        if (qformat.equals("xml")) {

            response.setContentType("text/xml");

            out.println(sess.getMessage());

        } else {

            try {

                DBTransform trans = new DBTransform();

                response.setContentType("text/html");

                trans.transformXMLDocument(sess.getMessage(),

                        "-//NCEAS//login//EN", "-//W3C//HTML//EN", qformat,

                        out, null);

            } catch (Exception e) {

                logMetacat.error(

                        "Error in MetaCatServlet.handleLoginAction: "

                                + e.getMessage());

            }

        }

    }

    /**

     * Handle the logout request. Close the connection.

     */

    private void handleLogoutAction(PrintWriter out, Hashtable params,

            HttpServletRequest request, HttpServletResponse response)

    {

        String qformat = "xml";

        if(params.get("qformat") != null){

            qformat = ((String[]) params.get("qformat"))[0];

        }

        // close the connection

        HttpSession sess = request.getSession(false);

        logMetacat.info("After get session in logout request");

        if (sess != null) {

            logMetacat.info("The session id " + sess.getId()

                    + " will be invalidate in logout action");

            logMetacat.warn("The session contains user "

                    + sess.getAttribute("username")

                    + " will be invalidate in logout action");

            sess.invalidate();

        }

        // produce output

        StringBuffer output = new StringBuffer();

        output.append("<?xml version=\"1.0\"?>");

        output.append("<logout>");

        output.append("User logged out");

        output.append("</logout>");

        //format and transform the output

        if (qformat.equals("xml")) {

            response.setContentType("text/xml");

            out.println(output.toString());

        } else {

            try {

                DBTransform trans = new DBTransform();

                response.setContentType("text/html");

                trans.transformXMLDocument(output.toString(),

                        "-//NCEAS//login//EN", "-//W3C//HTML//EN", qformat,

                        out, null);

            } catch (Exception e) {

                logMetacat.error(

                        "Error in MetaCatServlet.handleLogoutAction"

                                + e.getMessage());

            }

        }

    }

    // END OF LOGIN & LOGOUT SECTION

    // SQUERY & QUERY SECTION

    /**

     * Retreive the squery xml, execute it and display it

     *

     * @param out the output stream to the client

     * @param params the Hashtable of parameters that should be included in the

     *            squery.

     * @param response the response object linked to the client

     * @param conn the database connection

     */

    private void handleSQuery(PrintWriter out, Hashtable params,