import org.cacert.gigi.output.PageMenuItem;
import org.cacert.gigi.output.SimpleMenuItem;
import org.cacert.gigi.output.SimpleUntranslatedMenuItem;
-import org.cacert.gigi.output.template.Form;
import org.cacert.gigi.output.template.Form.CSRFException;
import org.cacert.gigi.output.template.Outputable;
import org.cacert.gigi.output.template.Template;
import org.cacert.gigi.pages.account.certs.CertificateAdd;
import org.cacert.gigi.pages.account.certs.Certificates;
import org.cacert.gigi.pages.account.domain.DomainOverview;
+import org.cacert.gigi.pages.account.domain.EditDomain;
import org.cacert.gigi.pages.account.mail.MailOverview;
import org.cacert.gigi.pages.admin.TTPAdminPage;
-import org.cacert.gigi.pages.admin.support.FindDomainPage;
-import org.cacert.gigi.pages.admin.support.FindUserPage;
+import org.cacert.gigi.pages.admin.support.FindCertPage;
+import org.cacert.gigi.pages.admin.support.FindUserByDomainPage;
+import org.cacert.gigi.pages.admin.support.FindUserByEmailPage;
import org.cacert.gigi.pages.admin.support.SupportEnterTicketPage;
import org.cacert.gigi.pages.admin.support.SupportUserDetailsPage;
import org.cacert.gigi.pages.error.AccessDenied;
import org.cacert.gigi.pages.main.RegisterPage;
import org.cacert.gigi.pages.orga.CreateOrgPage;
import org.cacert.gigi.pages.orga.ViewOrgPage;
+import org.cacert.gigi.pages.statistics.StatisticsRoles;
import org.cacert.gigi.pages.wot.AssurePage;
-import org.cacert.gigi.pages.wot.MyPoints;
+import org.cacert.gigi.pages.wot.Points;
import org.cacert.gigi.pages.wot.RequestTTPPage;
import org.cacert.gigi.ping.PingerDaemon;
import org.cacert.gigi.util.AuthorizationContext;
import org.cacert.gigi.util.DomainAssessment;
+import org.cacert.gigi.util.PasswordHash;
import org.cacert.gigi.util.ServerConstants;
+import org.cacert.gigi.util.TimeConditions;
public final class Gigi extends HttpServlet {
return ac == null;
}
});
- getMenu("SomeCA.org").addItem(new SimpleMenuItem("https://" + ServerConstants.getSecureHostNamePort() + "/login", "Certificate Login") {
+ getMenu("SomeCA.org").addItem(new SimpleMenuItem("https://" + ServerConstants.getSecureHostNamePortSecure() + "/login", "Certificate Login") {
@Override
public boolean isPermitted(AuthorizationContext ac) {
});
putPage("/", new MainPage(), null);
putPage("/roots", new RootCertPage(truststore), "SomeCA.org");
+ putPage(StatisticsRoles.PATH, new StatisticsRoles(), "SomeCA.org");
putPage("/about", new AboutPage(), "SomeCA.org");
putPage("/secure", new TestSecure(), null);
putPage(Verify.PATH, new Verify(), null);
- putPage(Certificates.PATH + "/*", new Certificates(), "Certificates");
+ putPage(Certificates.PATH + "/*", new Certificates(false), "Certificates");
putPage(RegisterPage.PATH, new RegisterPage(), "SomeCA.org");
putPage(CertificateAdd.PATH, new CertificateAdd(), "Certificates");
putPage(MailOverview.DEFAULT_PATH, new MailOverview(), "Certificates");
- putPage(DomainOverview.PATH + "*", new DomainOverview(), "Certificates");
+ putPage(DomainOverview.PATH, new DomainOverview(), "Certificates");
+ putPage(EditDomain.PATH + "*", new EditDomain(), null);
putPage(AssurePage.PATH + "/*", new AssurePage(), "Web of Trust");
- putPage(MyPoints.PATH, new MyPoints(), "Web of Trust");
+ putPage(Points.PATH, new Points(false), "Web of Trust");
putPage(RequestTTPPage.PATH, new RequestTTPPage(), "Web of Trust");
putPage(TTPAdminPage.PATH + "/*", new TTPAdminPage(), "Admin");
putPage(ViewOrgPage.DEFAULT_PATH + "/*", new ViewOrgPage(), "Organisation Admin");
putPage(SupportEnterTicketPage.PATH, new SupportEnterTicketPage(), "Support Console");
- putPage(FindUserPage.PATH, new FindUserPage(), "Support Console");
- putPage(FindDomainPage.PATH, new FindDomainPage(), "Support Console");
+ putPage(FindUserByEmailPage.PATH, new FindUserByEmailPage(), "Support Console");
+ putPage(FindUserByDomainPage.PATH, new FindUserByDomainPage(), "Support Console");
+ putPage(FindCertPage.PATH, new FindCertPage(), "Support Console");
putPage(SupportUserDetailsPage.PATH + "*", new SupportUserDetailsPage(), null);
putPage(ChangePasswordPage.PATH, new ChangePasswordPage(), "My Account");
putPage(History.PATH, new History(false), "My Account");
- putPage(FindAgentAccess.PATH, new OneFormPage("Access to Find Agent", FindAgentAccess.class) {
-
- @Override
- public String getSuccessPath(Form f) {
- return FindAgentAccess.PATH;
- }
- }, "My Account");
+ putPage(FindAgentAccess.PATH, new OneFormPage("Access to Find Agent", FindAgentAccess.class), "My Account");
putPage(History.SUPPORT_PATH, new History(true), null);
putPage(UserTrainings.PATH, new UserTrainings(false), "My Account");
putPage(MyDetails.PATH, new MyDetails(), "My Account");
putPage(UserTrainings.SUPPORT_PATH, new UserTrainings(true), null);
+ putPage(Points.SUPPORT_PATH, new Points(true), null);
+ putPage(Certificates.SUPPORT_PATH + "/*", new Certificates(true), null);
putPage(PasswordResetPage.PATH, new PasswordResetPage(), null);
putPage(LogoutPage.PATH, new LogoutPage(), null);
instance = this;
DomainAssessment.init(conf);
DatabaseConnection.init(conf);
+ TimeConditions.init(conf);
+ PasswordHash.init(conf);
this.truststore = truststore;
pinger = new PingerDaemon(truststore);
pinger.start();
}
- private static String staticTemplateVarHttp = "http://" + ServerConstants.getStaticHostNamePort();
-
- private static String staticTemplateVarHttps = "https://" + ServerConstants.getStaticHostNamePortSecure();
+ private static String staticTemplateVar = "//" + ServerConstants.getStaticHostNamePort();
- private static String getStaticTemplateVar(boolean https) {
- if (https) {
- return staticTemplateVarHttps;
- } else {
- return staticTemplateVarHttp;
- }
- }
+ private static String staticTemplateVarSecure = "//" + ServerConstants.getStaticHostNamePortSecure();
@Override
protected void service(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
if (originHeader != null //
&& !(originHeader.matches("^" + Pattern.quote("https://" + ServerConstants.getWwwHostNamePortSecure()) + "(/.*|)") || //
originHeader.matches("^" + Pattern.quote("http://" + ServerConstants.getWwwHostNamePort()) + "(/.*|)") || //
- originHeader.matches("^" + Pattern.quote("https://" + ServerConstants.getSecureHostNamePort()) + "(/.*|)"))) {
+ originHeader.matches("^" + Pattern.quote("https://" + ServerConstants.getSecureHostNamePortSecure()) + "(/.*|)"))) {
resp.setContentType("text/html; charset=utf-8");
resp.getWriter().println("<html><head><title>Alert</title></head><body>No cross domain access allowed.<br/><b>If you don't know why you're seeing this you may have been fished! Please change your password immediately!</b></body></html>");
return;
if (clientSerial != null) {
X509Certificate[] cert = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
if (cert == null || cert[0] == null//
- || !cert[0].getSerialNumber().toString(16).toUpperCase().equals(clientSerial) //
+ || !cert[0].getSerialNumber().toString(16).toLowerCase().equals(clientSerial) //
|| !cert[0].getIssuerDN().equals(hs.getAttribute(CERT_ISSUER))) {
hs.invalidate();
resp.sendError(403, "Certificate mismatch.");
if (req.getParameter("lang") != null) {
Locale l = Language.getLocaleFromString(req.getParameter("lang"));
Language lu = Language.getInstance(l);
- req.getSession().setAttribute(Language.SESSION_ATTRIB_NAME, lu.getLocale());
+ req.getSession().setAttribute(Language.SESSION_ATTRIB_NAME, lu != null ? lu.getLocale() : Locale.ENGLISH);
}
final Page p = getPage(req.getPathInfo());
vars.put(Menu.AUTH_VALUE, currentAuthContext);
vars.put("menu", rootMenu);
vars.put("title", lang.getTranslation(p.getTitle()));
- vars.put("static", getStaticTemplateVar(isSecure));
+ vars.put("static", isSecure ? staticTemplateVarSecure : staticTemplateVar);
vars.put("year", Calendar.getInstance().get(Calendar.YEAR));
vars.put("content", content);
if (currentAuthContext != null) {
}
public static void addXSSHeaders(HttpServletResponse hsr, boolean doHttps) {
- hsr.addHeader("Access-Control-Allow-Origin", "https://" + ServerConstants.getWwwHostNamePortSecure() + " https://" + ServerConstants.getSecureHostNamePort());
+ hsr.addHeader("Access-Control-Allow-Origin", "https://" + ServerConstants.getWwwHostNamePortSecure() + " https://" + ServerConstants.getSecureHostNamePortSecure());
hsr.addHeader("Access-Control-Max-Age", "60");
if (doHttps) {
hsr.addHeader("Content-Security-Policy", httpsCSP);
csp.append(";media-src 'none'; object-src 'none'");
csp.append(";script-src https://" + ServerConstants.getStaticHostNamePortSecure());
csp.append(";style-src https://" + ServerConstants.getStaticHostNamePortSecure());
- csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePortSecure());
+ csp.append(";form-action https://" + ServerConstants.getSecureHostNamePortSecure() + " https://" + ServerConstants.getWwwHostNamePortSecure());
// csp.append(";report-url https://api.cacert.org/security/csp/report");
return csp.toString();
}
csp.append(";media-src 'none'; object-src 'none'");
csp.append(";script-src http://" + ServerConstants.getStaticHostNamePort());
csp.append(";style-src http://" + ServerConstants.getStaticHostNamePort());
- csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePort());
+ csp.append(";form-action https://" + ServerConstants.getSecureHostNamePortSecure() + " https://" + ServerConstants.getWwwHostNamePort());
// csp.append(";report-url http://api.cacert.org/security/csp/report");
return csp.toString();
}