Adding serial checking of certificate login against Database.

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 29ed65c4a829b3ed275327303eb6dfec9ab4600f..c52b98f0a7e5fc83df19e554d34f5f84aff95fc7 100644 (file)
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -58,7 +58,7 @@ public class Gigi extends HttpServlet {
                X509Certificate[] cert = (X509Certificate[]) req
                                .getAttribute("javax.servlet.request.X509Certificate");
                HttpSession hs = req.getSession(false);
-               if (hs == null || !((Boolean) hs.getAttribute(LOGGEDIN))) {
+               if (hs == null || hs.getAttribute(LOGGEDIN) == null) {
                        if (cert != null) {
                                tryAuthWithCertificate(req, cert[0]);
                                hs = req.getSession(false);
@@ -77,7 +77,7 @@ public class Gigi extends HttpServlet {
                }
                if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
                        if (hs != null) {
-                               hs.setAttribute(LOGGEDIN, false);
+                               hs.setAttribute(LOGGEDIN, null);
                                hs.invalidate();
                        }
                        resp.sendRedirect("/");
@@ -96,6 +96,10 @@ public class Gigi extends HttpServlet {
                        b0 = makeDynTempl(b0, p);
                        resp.setContentType("text/html");
                        resp.getWriter().print(b0);
+                       if (hs != null && hs.getAttribute(LOGGEDIN) != null) {
+                               resp.getWriter().println(
+                                               "Hi " + ((User) hs.getAttribute(USER)).getFname());
+                       }
                        p.doGet(req, resp);
                        String b1 = baseTemplate[1];
                        b1 = makeDynTempl(b1, p);
@@ -105,7 +109,6 @@ public class Gigi extends HttpServlet {
                }
 
        }
-
        private String makeDynTempl(String in, Page p) {
                int year = Calendar.getInstance().get(Calendar.YEAR);
                in = in.replaceAll("\\$title\\$", p.getTitle());
@@ -134,8 +137,24 @@ public class Gigi extends HttpServlet {
        }
        private void tryAuthWithCertificate(HttpServletRequest req,
                        X509Certificate x509Certificate) {
-               // TODO ckeck if certificate is valid
-               HttpSession hs = req.getSession();
-               hs.setAttribute(LOGGEDIN, true);
+               String serial = x509Certificate.getSerialNumber().toString(16)
+                               .toUpperCase();
+               try {
+                       PreparedStatement ps = DatabaseConnection
+                                       .getInstance()
+                                       .prepare(
+                                                       "SELECT `memid` FROM `emailcerts` WHERE `serial`=? AND `disablelogin`='0' AND `revoked` = "
+                                                                       + "'0000-00-00 00:00:00'");
+                       ps.setString(1, serial);
+                       ResultSet rs = ps.executeQuery();
+                       if (rs.next()) {
+                               HttpSession hs = req.getSession();
+                               hs.setAttribute(LOGGEDIN, true);
+                               hs.setAttribute(USER, new User(rs.getInt(1)));
+                       }
+                       rs.close();
+               } catch (SQLException e) {
+                       e.printStackTrace();
+               }
        }
 }

diff --git a/src/org/cacert/gigi/User.java b/src/org/cacert/gigi/User.java
index 4e366ba577e43beaa8fc516356c7313cdbe3d240..8c4b1f9dab466b7d6531e0d4d3b70cbf3becf7b0 100644 (file)
--- a/src/org/cacert/gigi/User.java
+++ b/src/org/cacert/gigi/User.java
@@ -1,14 +1,41 @@
 package org.cacert.gigi;
 
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+import org.cacert.gigi.database.DatabaseConnection;
+
 public class User {
 
        private int id;
+       String fname;
+       String lname;
 
        public User(int id) {
                this.id = id;
+               try {
+                       PreparedStatement ps = DatabaseConnection.getInstance().prepare(
+                                       "SELECT `fname`, `lname` FROM `users` WHERE id=?");
+                       ps.setInt(1, id);
+                       ResultSet rs = ps.executeQuery();
+                       if (rs.next()) {
+                               fname = rs.getString(1);
+                               lname = rs.getString(2);
+                       }
+                       rs.close();
+               } catch (SQLException e) {
+                       e.printStackTrace();
+               }
        }
        public int getId() {
                return id;
        }
+       public String getFname() {
+               return fname;
+       }
+       public String getLname() {
+               return lname;
+       }
 
 }