src/club/wpia/gigi/pages/LoginPage.java

   1 package club.wpia.gigi.pages;
   2
   3 import static club.wpia.gigi.Gigi.*;
   4
   5 import java.io.IOException;
   6 import java.io.PrintWriter;
   7 import java.security.cert.X509Certificate;
   8 import java.util.Map;
   9
  10 import javax.servlet.http.HttpServletRequest;
  11 import javax.servlet.http.HttpServletResponse;
  12 import javax.servlet.http.HttpSession;
  13
  14 import club.wpia.gigi.GigiApiException;
  15 import club.wpia.gigi.database.GigiPreparedStatement;
  16 import club.wpia.gigi.database.GigiResultSet;
  17 import club.wpia.gigi.dbObjects.CertificateOwner;
  18 import club.wpia.gigi.dbObjects.Group;
  19 import club.wpia.gigi.dbObjects.User;
  20 import club.wpia.gigi.localisation.Language;
  21 import club.wpia.gigi.output.template.Form;
  22 import club.wpia.gigi.output.template.TranslateCommand;
  23 import club.wpia.gigi.pages.main.RegisterPage;
  24 import club.wpia.gigi.util.AuthorizationContext;
  25 import club.wpia.gigi.util.PasswordHash;
  26 import club.wpia.gigi.util.RateLimit;
  27 import club.wpia.gigi.util.RateLimit.RateLimitException;
  28 import club.wpia.gigi.util.ServerConstants;
  29
  30 public class LoginPage extends Page {
  31
  32     public static final RateLimit RATE_LIMIT = new RateLimit(10, 5 * 60 * 1000);
  33
  34     public class LoginForm extends Form {
  35
  36         public LoginForm(HttpServletRequest hsr) {
  37             super(hsr);
  38         }
  39
  40         @Override
  41         public RedirectResult submit(HttpServletRequest req) throws GigiApiException {
  42             if (RegisterPage.RATE_LIMIT.isLimitExceeded(req.getRemoteAddr())) {
  43                 throw new RateLimitException();
  44             }
  45             tryAuthWithUnpw(req);
  46             return new RedirectResult(redirectPath(req));
  47         }
  48
  49         @Override
  50         protected void outputContent(PrintWriter out, Language l, Map<String, Object> vars) {
  51             getDefaultTemplate().output(out, l, vars);
  52         }
  53
  54     }
  55
  56     public static final String LOGIN_RETURNPATH = "login-returnpath";
  57
  58     public LoginPage() {
  59         super("Password Login");
  60     }
  61
  62     @Override
  63     public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  64         if (req.getHeader("Host").equals(ServerConstants.getSecureHostNamePortSecure())) {
  65             resp.getWriter().println(getLanguage(req).getTranslation("Authentication with certificate failed. Try another certificate or use a password."));
  66         } else {
  67             new LoginForm(req).output(resp.getWriter(), getLanguage(req), getDefaultVars(req));
  68         }
  69     }
  70
  71     @Override
  72     public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  73         if (Form.printFormErrors(req, resp.getWriter())) {
  74             Form.getForm(req, LoginForm.class).output(resp.getWriter(), getLanguage(req), getDefaultVars(req));
  75         }
  76     }
  77
  78     @Override
  79     public boolean beforeTemplate(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  80         if (req.getSession().getAttribute("loggedin") == null) {
  81             X509Certificate cert = getCertificateFromRequest(req);
  82             if (cert != null) {
  83                 tryAuthWithCertificate(req, cert);
  84             }
  85             if (req.getMethod().equals("POST")) {
  86                 return Form.getForm(req, LoginForm.class).submitExceptionProtected(req, resp);
  87             }
  88         }
  89
  90         if (req.getSession().getAttribute("loggedin") != null) {
  91             resp.sendRedirect(redirectPath(req));
  92             return true;
  93         }
  94         return false;
  95     }
  96
  97     private static String redirectPath(HttpServletRequest req) {
  98         String redir = (String) req.getAttribute(LOGIN_RETURNPATH);
  99         String s = redir;
 100         if (s != null) {
 101             if ( !s.startsWith("/")) {
 102                 s = "/" + s;
 103             }
 104             return s;
 105         } else {
 106             return "/";
 107         }
 108     }
 109
 110     @Override
 111     public boolean needsLogin() {
 112         return false;
 113     }
 114
 115     private void tryAuthWithUnpw(HttpServletRequest req) throws GigiApiException {
 116         String un = req.getParameter("username");
 117         String pw = req.getParameter("password");
 118         try (GigiPreparedStatement ps = new GigiPreparedStatement("SELECT `password`, `id` FROM `users` WHERE `email`=? AND verified='1'")) {
 119             ps.setString(1, un);
 120             GigiResultSet rs = ps.executeQuery();
 121             if (rs.next()) {
 122                 String dbHash = rs.getString(1);
 123                 String hash = PasswordHash.verifyHash(pw, dbHash);
 124                 if (hash != null) {
 125                     if ( !hash.equals(dbHash)) {
 126                         try (GigiPreparedStatement gps = new GigiPreparedStatement("UPDATE `users` SET `password`=? WHERE `email`=?")) {
 127                             gps.setString(1, hash);
 128                             gps.setString(2, un);
 129                             gps.executeUpdate();
 130                         }
 131                     }
 132                     loginSession(req, User.getById(rs.getInt(2)));
 133                     req.getSession().setAttribute(LOGIN_METHOD, new TranslateCommand("Password"));
 134                     return;
 135                 }
 136             }
 137         }
 138         throw new GigiApiException("Username and password didn't match.");
 139     }
 140
 141     public static User getUser(HttpServletRequest req) {
 142         AuthorizationContext ac = getAuthorizationContext(req);
 143         if (ac == null) {
 144             return null;
 145         }
 146         return ac.getActor();
 147     }
 148
 149     public static AuthorizationContext getAuthorizationContext(HttpServletRequest req) {
 150         return ((AuthorizationContext) req.getSession().getAttribute(AUTH_CONTEXT));
 151     }
 152
 153     private void tryAuthWithCertificate(HttpServletRequest req, X509Certificate x509Certificate) {
 154         String serial = extractSerialFormCert(x509Certificate);
 155         User user = fetchUserBySerial(serial);
 156         if (user == null) {
 157             return;
 158         }
 159         loginSession(req, user);
 160         req.getSession().setAttribute(CERT_SERIAL, serial);
 161         req.getSession().setAttribute(CERT_ISSUER, x509Certificate.getIssuerDN());
 162         req.getSession().setAttribute(LOGIN_METHOD, new TranslateCommand("Certificate"));
 163     }
 164
 165     public static String extractSerialFormCert(X509Certificate x509Certificate) {
 166         return x509Certificate.getSerialNumber().toString(16).toLowerCase();
 167     }
 168
 169     public static User fetchUserBySerial(String serial) {
 170         if ( !serial.matches("[a-f0-9]+")) {
 171             throw new Error("serial malformed.");
 172         }
 173
 174         CertificateOwner o = CertificateOwner.getByEnabledSerial(serial);
 175         if (o == null || !(o instanceof User)) {
 176             return null;
 177         }
 178         return (User) o;
 179     }
 180
 181     public static X509Certificate getCertificateFromRequest(HttpServletRequest req) {
 182         X509Certificate[] cert = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
 183         X509Certificate uc = null;
 184         if (cert != null && cert[0] != null) {
 185             uc = cert[0];
 186         }
 187         return uc;
 188     }
 189
 190     private static final Group LOGIN_BLOCKED = Group.BLOCKEDLOGIN;
 191
 192     private void loginSession(HttpServletRequest req, User user) {
 193         if (user.isInGroup(LOGIN_BLOCKED)) {
 194             return;
 195         }
 196         req.setAttribute(LOGIN_RETURNPATH, req.getSession().getAttribute(LOGIN_RETURNPATH));
 197         req.getSession().invalidate();
 198         HttpSession hs = req.getSession();
 199         hs.setAttribute(LOGGEDIN, true);
 200         hs.setAttribute(Language.SESSION_ATTRIB_NAME, user.getPreferredLocale());
 201         hs.setAttribute(AUTH_CONTEXT, new AuthorizationContext(user, user));
 202     }
 203
 204     @Override
 205     public boolean isPermitted(AuthorizationContext ac) {
 206         return ac == null;
 207     }
 208 }