import org.cacert.gigi.pages.Page;
import org.cacert.gigi.pages.TestSecure;
import org.cacert.gigi.pages.Verify;
+import org.cacert.gigi.pages.account.MailAdd;
import org.cacert.gigi.pages.account.MailCertificates;
+import org.cacert.gigi.pages.account.MailOverview;
import org.cacert.gigi.pages.account.MyDetails;
import org.cacert.gigi.pages.main.RegisterPage;
+import org.cacert.gigi.pages.wot.AssurePage;
import org.eclipse.jetty.util.log.Log;
public class Gigi extends HttpServlet {
pages.put("/", new MainPage("CACert - Home"));
pages.put("/secure", new TestSecure());
pages.put(Verify.PATH, new Verify());
+ pages.put(AssurePage.PATH + "/*", new AssurePage());
pages.put(MailCertificates.PATH, new MailCertificates());
pages.put(MyDetails.PATH, new MyDetails());
pages.put(RegisterPage.PATH, new RegisterPage());
+ pages.put(MailOverview.DEFAULT_PATH, new MailOverview(
+ "My email addresses"));
+ pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email"));
String templ = "";
try (BufferedReader reader = new BufferedReader(new InputStreamReader(
new FileInputStream(new File("templates/base.html"))))) {
String tmp;
while ((tmp = reader.readLine()) != null) {
- templ += tmp;
+ templ += tmp + "\n";
}
baseTemplate = templ.split("\\$content\\$");
} catch (Exception e) {
@Override
protected void service(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
+ addXSSHeaders(resp);
+ if (req.getHeader("Origin") != null) {
+ resp.getWriter().println("No cross domain access allowed.");
+ return;
+ }
HttpSession hs = req.getSession();
if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
if (hs != null) {
return;
}
- if (pages.containsKey(req.getPathInfo())) {
- Page p = pages.get(req.getPathInfo());
+ Page p = getPage(req.getPathInfo());
+ if (p != null) {
+
if (p.needsLogin() && hs.getAttribute("loggedin") == null) {
String request = req.getPathInfo();
request = request.split("\\?")[0];
resp.sendError(404, "Page not found.");
}
+ }
+ private Page getPage(String pathInfo) {
+ if (pathInfo.endsWith("/") && !pathInfo.equals("/")) {
+ pathInfo = pathInfo.substring(0, pathInfo.length() - 1);
+ }
+ Page page = pages.get(pathInfo);
+ if (page != null) {
+ return page;
+ }
+ page = pages.get(pathInfo + "/*");
+ if (page != null) {
+ return page;
+ }
+ int idx = pathInfo.lastIndexOf('/');
+ pathInfo = pathInfo.substring(0, idx);
+
+ page = pages.get(pathInfo + "/*");
+ if (page != null) {
+ return page;
+ }
+ return null;
+
}
private String makeDynTempl(String in, Page p) {
int year = Calendar.getInstance().get(Calendar.YEAR);
in = in.replaceAll("\\$year\\$", year + "");
return in;
}
+ public static void addXSSHeaders(HttpServletResponse hsr) {
+ hsr.addHeader("Access-Control-Allow-Origin",
+ "http://cacert.org https://localhost");
+ hsr.addHeader("Access-Control-Max-Age", "60");
+ // hsr.addHeader("Content-Security-Policy",
+ // "default-src 'self'; report-uri https://felix.dogcraft.de/report.php");
+ }
}