import org.cacert.gigi.dbObjects.Group;
import org.cacert.gigi.dbObjects.User;
import org.cacert.gigi.localisation.Language;
-import org.cacert.gigi.output.Form;
+import org.cacert.gigi.output.template.Form;
import org.cacert.gigi.util.PasswordHash;
public class LoginPage extends Page {
public boolean beforeTemplate(HttpServletRequest req, HttpServletResponse resp) throws IOException {
String redir = (String) req.getSession().getAttribute(LOGIN_RETURNPATH);
if (req.getSession().getAttribute("loggedin") == null) {
- X509Certificate[] cert = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
- if (cert != null && cert[0] != null) {
- tryAuthWithCertificate(req, cert[0]);
+ X509Certificate cert = getCertificateFromRequest(req);
+ if (cert != null) {
+ tryAuthWithCertificate(req, cert);
}
if (req.getMethod().equals("POST")) {
try {
ps.setString(1, un);
GigiResultSet rs = ps.executeQuery();
if (rs.next()) {
- if (PasswordHash.verifyHash(pw, rs.getString(1))) {
+ String dbHash = rs.getString(1);
+ String hash = PasswordHash.verifyHash(pw, dbHash);
+ if (hash != null) {
+ if ( !hash.equals(dbHash)) {
+ GigiPreparedStatement gps = DatabaseConnection.getInstance().prepare("UPDATE `users` SET `password`=? WHERE `email`=?");
+ gps.setString(1, hash);
+ gps.setString(2, un);
+ gps.executeUpdate();
+ }
loginSession(req, User.getById(rs.getInt(2)));
+ req.getSession().setAttribute(LOGIN_METHOD, "Password");
}
}
rs.close();
}
private void tryAuthWithCertificate(HttpServletRequest req, X509Certificate x509Certificate) {
- String serial = x509Certificate.getSerialNumber().toString(16).toUpperCase();
+ String serial = extractSerialFormCert(x509Certificate);
+ User user = fetchUserBySerial(serial);
+ if (user == null) {
+ return;
+ }
+ loginSession(req, user);
+ req.getSession().setAttribute(CERT_SERIAL, serial);
+ req.getSession().setAttribute(CERT_ISSUER, x509Certificate.getIssuerDN());
+ req.getSession().setAttribute(LOGIN_METHOD, "Certificate");
+ }
+
+ public static String extractSerialFormCert(X509Certificate x509Certificate) {
+ return x509Certificate.getSerialNumber().toString(16).toUpperCase();
+ }
+
+ public static User fetchUserBySerial(String serial) {
+ if ( !serial.matches("[A-Fa-f0-9]+")) {
+ throw new Error("serial malformed.");
+ }
GigiPreparedStatement ps = DatabaseConnection.getInstance().prepare("SELECT `memid` FROM `certs` WHERE `serial`=? AND `disablelogin`='0' AND `revoked` is NULL");
- ps.setString(1, serial);
+ ps.setString(1, serial.toLowerCase());
GigiResultSet rs = ps.executeQuery();
+ User user = null;
if (rs.next()) {
- loginSession(req, User.getById(rs.getInt(1)));
- req.getSession().setAttribute(CERT_SERIAL, serial);
- req.getSession().setAttribute(CERT_ISSUER, x509Certificate.getIssuerDN());
+ user = User.getById(rs.getInt(1));
+ } else {
+ System.out.println("User with serial " + serial + " not found.");
}
rs.close();
+ return user;
+ }
+
+ public static X509Certificate getCertificateFromRequest(HttpServletRequest req) {
+ X509Certificate[] cert = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
+ X509Certificate uc = null;
+ if (cert != null && cert[0] != null) {
+ uc = cert[0];
+ }
+ return uc;
}
private static final Group LOGIN_BLOCKED = Group.getByString("blockedlogin");