add: prevent supporters from modifying their own accounts via support

[gigi.git] / src / org / cacert / gigi / pages / main / RegisterPage.java

diff --git a/src/org/cacert/gigi/pages/main/RegisterPage.java b/src/org/cacert/gigi/pages/main/RegisterPage.java
index 7d3b3e3f10b627694055f2c1dee6b386d6bcfb87..30c428333702991664e451aa3dc6b9b9452d32d7 100644 (file)
--- a/src/org/cacert/gigi/pages/main/RegisterPage.java
+++ b/src/org/cacert/gigi/pages/main/RegisterPage.java
@@ -8,9 +8,11 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
-import org.cacert.gigi.User;
-import org.cacert.gigi.output.Form;
+import org.cacert.gigi.GigiApiException;
+import org.cacert.gigi.output.template.Form;
 import org.cacert.gigi.pages.Page;
+import org.cacert.gigi.util.AuthorizationContext;
+import org.cacert.gigi.util.RateLimit;
 
 public class RegisterPage extends Page {
 
@@ -18,6 +20,9 @@ public class RegisterPage extends Page {
 
     public static final String PATH = "/register";
 
+    // 50 per 5 min
+    public static final RateLimit RATE_LIMIT = new RateLimit(50, 5 * 60 * 1000);
+
     public RegisterPage() {
         super("Register");
     }
@@ -38,13 +43,15 @@ public class RegisterPage extends Page {
     @Override
     public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
         Signup s = Form.getForm(req, Signup.class);
-        if (s == null) {
-            resp.getWriter().println(translate(req, "CSRF token check failed."));
-        } else if (s.submit(resp.getWriter(), req)) {
-            HttpSession hs = req.getSession();
-            hs.setAttribute(SIGNUP_PROCESS, null);
-            resp.getWriter().println(translate(req, "Your information has been submitted" + " into our system. You will now be sent an email with a web link," + " you need to open that link in your web browser within 24 hours" + " or your information will be removed from our system!"));
-            return;
+        try {
+            if (s.submit(resp.getWriter(), req)) {
+                HttpSession hs = req.getSession();
+                hs.setAttribute(SIGNUP_PROCESS, null);
+                resp.getWriter().println(translate(req, "Your information has been submitted" + " into our system. You will now be sent an email with a web link," + " you need to open that link in your web browser within 24 hours" + " or your information will be removed from our system!"));
+                return;
+            }
+        } catch (GigiApiException e) {
+            e.format(resp.getWriter(), getLanguage(req));
         }
 
         outputGet(req, resp, s);
@@ -56,7 +63,7 @@ public class RegisterPage extends Page {
     }
 
     @Override
-    public boolean isPermitted(User u) {
-        return u == null;
+    public boolean isPermitted(AuthorizationContext ac) {
+        return ac == null;
     }
 }