X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2Fpages%2FLoginPage.java;h=acfc8f51ed310153e9f1d041402167599d91e35d;hb=1cfb44d81a7d919db6670a06b0832c7b398005be;hp=905daf16aa1248252a073f602f6ad6df227018d0;hpb=7e979cc57595d265f750ac2076a34a3565b1197d;p=gigi.git

diff --git a/src/org/cacert/gigi/pages/LoginPage.java b/src/org/cacert/gigi/pages/LoginPage.java
index 905daf16..acfc8f51 100644
--- a/src/org/cacert/gigi/pages/LoginPage.java
+++ b/src/org/cacert/gigi/pages/LoginPage.java
@@ -1,17 +1,31 @@
 package org.cacert.gigi.pages;
 
+import static org.cacert.gigi.Gigi.LOGGEDIN;
+import static org.cacert.gigi.Gigi.USER;
+
 import java.io.IOException;
+import java.security.cert.X509Certificate;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
 
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
+import org.cacert.gigi.User;
+import org.cacert.gigi.database.DatabaseConnection;
+import org.cacert.gigi.util.PasswordHash;
 
 public class LoginPage extends Page {
+	public static final String LOGIN_RETURNPATH = "login-returnpath";
+
 	public LoginPage(String title) {
 		super(title);
 	}
 
 	@Override
-	public void doGet(ServletRequest req, ServletResponse resp)
+	public void doGet(HttpServletRequest req, HttpServletResponse resp)
 			throws IOException {
 		resp.getWriter()
 				.println(
@@ -20,4 +34,85 @@ public class LoginPage extends Page {
 								+ "<input type='password' name='password'> <input type='submit' value='login'></form>");
 	}
 
+	@Override
+	public boolean beforeTemplate(HttpServletRequest req,
+			HttpServletResponse resp) throws IOException {
+		if (req.getSession().getAttribute("loggedin") == null) {
+			X509Certificate[] cert = (X509Certificate[]) req
+					.getAttribute("javax.servlet.request.X509Certificate");
+			if (cert != null && cert[0] != null) {
+				tryAuthWithCertificate(req, cert[0]);
+			}
+			if (req.getMethod().equals("POST")) {
+				tryAuthWithUnpw(req);
+			}
+		}
+
+		if (req.getSession().getAttribute("loggedin") != null) {
+			String s = (String) req.getSession().getAttribute(LOGIN_RETURNPATH);
+			if (s != null) {
+				if (!s.startsWith("/")) {
+					s = "/" + s;
+				}
+				resp.sendRedirect(s);
+			} else {
+				resp.sendRedirect("/");
+			}
+			return true;
+		}
+		return false;
+	}
+	@Override
+	public boolean needsLogin() {
+		return false;
+	}
+	private void tryAuthWithUnpw(HttpServletRequest req) {
+		String un = req.getParameter("username");
+		String pw = req.getParameter("password");
+		try {
+			PreparedStatement ps = DatabaseConnection
+					.getInstance()
+					.prepare(
+							"SELECT `password`, `id` FROM `users` WHERE `email`=? AND locked='0' AND verified='1'");
+			ps.setString(1, un);
+			ResultSet rs = ps.executeQuery();
+			if (rs.next()) {
+				if (PasswordHash.verifyHash(pw, rs.getString(1))) {
+					req.getSession().invalidate();
+					HttpSession hs = req.getSession();
+					hs.setAttribute(LOGGEDIN, true);
+					hs.setAttribute(USER, new User(rs.getInt(2)));
+				}
+			}
+			rs.close();
+		} catch (SQLException e) {
+			e.printStackTrace();
+		}
+	}
+	public static User getUser(HttpServletRequest req) {
+		return (User) req.getSession().getAttribute(USER);
+	}
+	private void tryAuthWithCertificate(HttpServletRequest req,
+			X509Certificate x509Certificate) {
+		String serial = x509Certificate.getSerialNumber().toString(16)
+				.toUpperCase();
+		try {
+			PreparedStatement ps = DatabaseConnection
+					.getInstance()
+					.prepare(
+							"SELECT `memid` FROM `emailcerts` WHERE `serial`=? AND `disablelogin`='0' AND `revoked` = "
+									+ "'0000-00-00 00:00:00'");
+			ps.setString(1, serial);
+			ResultSet rs = ps.executeQuery();
+			if (rs.next()) {
+				req.getSession().invalidate();
+				HttpSession hs = req.getSession();
+				hs.setAttribute(LOGGEDIN, true);
+				hs.setAttribute(USER, new User(rs.getInt(1)));
+			}
+			rs.close();
+		} catch (SQLException e) {
+			e.printStackTrace();
+		}
+	}
 }