]> WPIA git - gigi.git/blob - src/club/wpia/gigi/pages/wot/AssuranceForm.java
fix: XSS via Test Server Management interface
[gigi.git] / src / club / wpia / gigi / pages / wot / AssuranceForm.java
1 package club.wpia.gigi.pages.wot;
2
3 import java.io.PrintWriter;
4 import java.text.SimpleDateFormat;
5 import java.util.Arrays;
6 import java.util.HashMap;
7 import java.util.HashSet;
8 import java.util.Iterator;
9 import java.util.LinkedList;
10 import java.util.Map;
11
12 import javax.servlet.http.HttpServletRequest;
13
14 import club.wpia.gigi.GigiApiException;
15 import club.wpia.gigi.dbObjects.Assurance.AssuranceType;
16 import club.wpia.gigi.dbObjects.Name;
17 import club.wpia.gigi.dbObjects.User;
18 import club.wpia.gigi.localisation.Language;
19 import club.wpia.gigi.output.ArrayIterable;
20 import club.wpia.gigi.output.CountrySelector;
21 import club.wpia.gigi.output.template.Form;
22 import club.wpia.gigi.output.template.IterableDataset;
23 import club.wpia.gigi.output.template.Outputable;
24 import club.wpia.gigi.output.template.SprintfCommand;
25 import club.wpia.gigi.output.template.Template;
26 import club.wpia.gigi.output.template.TranslateCommand;
27 import club.wpia.gigi.pages.Page;
28 import club.wpia.gigi.pages.PasswordResetPage;
29 import club.wpia.gigi.util.DayDate;
30 import club.wpia.gigi.util.Notary;
31
32 public class AssuranceForm extends Form {
33
34     public static class ConcatOutputable implements Outputable {
35
36         private Outputable[] outputables;
37
38         public ConcatOutputable(Outputable... outputables) {
39             this.outputables = outputables;
40         }
41
42         @Override
43         public void output(PrintWriter out, Language l, Map<String, Object> vars) {
44             for (int i = 0; i < outputables.length; i++) {
45                 if (i != 0) {
46                     out.println();
47                 }
48                 outputables[i].output(out, l, vars);
49             }
50         }
51     }
52
53     private User assuree;
54
55     private Name[] assureeNames;
56
57     private boolean[] selected;
58
59     private DayDate dob;
60
61     private String location = "";
62
63     private String date = "";
64
65     private String aword;
66
67     private User assurer;
68
69     private AssuranceType type = AssuranceType.FACE_TO_FACE;
70
71     private static final Template templ = new Template(AssuranceForm.class.getResource("AssuranceForm.templ"));
72
73     private CountrySelector cs;
74
75     public AssuranceForm(HttpServletRequest hsr, User assuree) throws GigiApiException {
76         super(hsr);
77         assurer = Page.getUser(hsr);
78         this.assuree = assuree;
79
80         if (assurer.getId() == assuree.getId()) {
81             throw new GigiApiException("You cannot verify yourself.");
82         }
83         if ( !assurer.canAssure()) {
84             throw new GigiApiException("You are not a RA-Agent.");
85         }
86
87         Name[] initialNames = this.assuree.getNonDeprecatedNames();
88         LinkedList<Name> names = new LinkedList<>();
89         for (Name name : initialNames) {
90             if (Notary.checkAssuranceIsPossible(assurer, name)) {
91                 names.add(name);
92             }
93         }
94         if (names.size() == 0) {
95             throw new GigiApiException(SprintfCommand.createSimple("You have already verified all names of this applicant within the last {0} days.", Notary.LIMIT_DAYS_VERIFICATION));
96         }
97         assureeNames = names.toArray(new Name[names.size()]);
98         dob = this.assuree.getDoB();
99         selected = new boolean[assureeNames.length];
100         cs = new CountrySelector("countryCode", false);
101     }
102
103     SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd");
104
105     SimpleDateFormat sdf2 = new SimpleDateFormat("dd. MMM yyyy");
106
107     @Override
108     public void outputContent(PrintWriter out, Language l, Map<String, Object> vars) {
109         HashMap<String, Object> res = new HashMap<String, Object>(vars);
110         res.putAll(vars);
111         res.put("names", new ArrayIterable<Name>(assureeNames) {
112
113             @Override
114             public void apply(Name t, Language l, Map<String, Object> vars) {
115                 vars.put("nameExplicit", t);
116                 vars.put("nameId", t.getId());
117                 vars.put("checked", selected[i] ? " checked" : "");
118             }
119
120         });
121         res.put("name", assuree.getPreferredName().toString());
122         res.put("maxpoints", assurer.getMaxAssurePoints());
123         res.put("dob", sdf.format(assuree.getDoB().toDate()));
124         res.put("dobFmt2", sdf2.format(assuree.getDoB().toDate()));
125         res.put("location", location);
126         res.put("date", date);
127         res.put("aword", aword);
128         res.put("countryCode", cs);
129
130         final LinkedList<AssuranceType> ats = new LinkedList<>();
131         for (AssuranceType at : AssuranceType.values()) {
132             try {
133                 Notary.may(assurer, assuree, at);
134                 ats.add(at);
135             } catch (GigiApiException e) {
136             }
137         }
138         res.put("ats", new IterableDataset() {
139
140             Iterator<AssuranceType> t = ats.iterator();
141
142             @Override
143             public boolean next(Language l, Map<String, Object> vars) {
144                 if ( !t.hasNext()) {
145                     return false;
146                 }
147                 AssuranceType t1 = t.next();
148                 vars.put("type", t1.getDescription());
149                 vars.put("id", t1.toString());
150                 vars.put("sel", t1 == type ? " selected" : "");
151                 return true;
152             }
153         });
154         templ.output(out, l, res);
155     }
156
157     @Override
158     public SubmissionResult submit(HttpServletRequest req) throws GigiApiException {
159         location = req.getParameter("location");
160         date = req.getParameter("date");
161         cs.update(req);
162         GigiApiException gae = new GigiApiException();
163         if (date == null || location == null) {
164             gae.mergeInto(new GigiApiException("You need to enter location and date!"));
165         }
166
167         if ( !"1".equals(req.getParameter("certify")) || !"1".equals(req.getParameter("rules")) || !"1".equals(req.getParameter("assertion"))) {
168             gae.mergeInto(new GigiApiException("You failed to check all boxes to validate" + " your adherence to the rules and policies of SomeCA"));
169         }
170         if ("1".equals(req.getParameter("passwordReset"))) {
171             aword = req.getParameter("passwordResetValue");
172             if ("".equals(aword)) {
173                 aword = null;
174             }
175         } else {
176             aword = null;
177         }
178         String val = req.getParameter("assuranceType");
179         if (val != null) {
180             try {
181                 type = AssuranceType.valueOf(val);
182             } catch (IllegalArgumentException e) {
183                 gae.mergeInto(new GigiApiException("Verification Type wrong."));
184             }
185         }
186
187         int pointsI = 0;
188         String points = req.getParameter("points");
189         if (points == null || "".equals(points)) {
190             gae.mergeInto(new GigiApiException("For a verification, you need to enter points."));
191         } else {
192             try {
193                 pointsI = Integer.parseInt(points);
194             } catch (NumberFormatException e) {
195                 gae.mergeInto(new GigiApiException("The points entered were not a number."));
196             }
197         }
198         String[] parameterValues = req.getParameterValues("assuredName");
199         HashSet<String> data = new HashSet<>(Arrays.asList(parameterValues == null ? new String[0] : parameterValues));
200         for (int i = 0; i < assureeNames.length; i++) {
201             selected[i] = data.contains(Integer.toString(assureeNames[i].getId()));
202         }
203
204         if ( !gae.isEmpty()) {
205             throw gae;
206         }
207
208         LinkedList<Name> toAssure = new LinkedList<Name>();
209         for (int i = 0; i < selected.length; i++) {
210             if (selected[i]) {
211                 toAssure.add(assureeNames[i]);
212             }
213         }
214         if (toAssure.size() == 0) {
215             throw new GigiApiException("You must confirm at least one name to verify an account.");
216         }
217
218         Notary.assureAll(assurer, assuree, dob, pointsI, location, req.getParameter("date"), type, toAssure.toArray(new Name[toAssure.size()]), cs.getCountry());
219         Outputable result = new TranslateCommand("Verification complete.");
220         if (isWithPasswordReset()) {
221             Language langApplicant = Language.getInstance(assuree.getPreferredLocale());
222             String method = langApplicant.getTranslation("A password reset was triggered. If you did a password reset by verification, please enter your secret password using this form:");
223             String subject = langApplicant.getTranslation("Password reset by verification");
224             PasswordResetPage.initPasswordResetProcess(assuree, req, aword, langApplicant, method, subject);
225             result = new ConcatOutputable(result, new TranslateCommand("Password reset successful."));
226         }
227         return new SuccessMessageResult(result);
228     }
229
230     public boolean isWithPasswordReset() {
231         return aword != null && !aword.equals("");
232     }
233
234     public User getAssuree() {
235         return assuree;
236     }
237
238 }