]> WPIA git - gigi.git/blob - src/org/cacert/gigi/output/GroupSelector.java
add: defense-in-depth mechanism to prevent unauthorized adding of groups
[gigi.git] / src / org / cacert / gigi / output / GroupSelector.java
1 package org.cacert.gigi.output;
2
3 import java.io.PrintWriter;
4 import java.util.Map;
5
6 import javax.servlet.http.HttpServletRequest;
7
8 import org.cacert.gigi.GigiApiException;
9 import org.cacert.gigi.dbObjects.Group;
10 import org.cacert.gigi.localisation.Language;
11 import org.cacert.gigi.output.template.Outputable;
12 import org.cacert.gigi.util.HTMLEncoder;
13
14 public class GroupSelector implements Outputable {
15
16     private final String name;
17
18     private Group value = null;
19
20     private final boolean bySupporter;
21
22     public GroupSelector(String name, boolean bySupporter) {
23         this.name = HTMLEncoder.encodeHTML(name);
24         this.bySupporter = bySupporter;
25     }
26
27     public void update(HttpServletRequest r) throws GigiApiException {
28         String vS = r.getParameter(name);
29         value = null;
30         for (Group g : Group.values()) {
31             if (g.getDatabaseName().equals(vS) && mayManage(g)) {
32                 value = g;
33             }
34         }
35     }
36
37     @Override
38     public void output(PrintWriter out, Language l, Map<String, Object> vars) {
39         out.println("<select name='" + name + "'>");
40         for (Group g : Group.values()) {
41             if (mayManage(g)) {
42                 out.print("<option value='" + g.getDatabaseName());
43                 if (g.equals(value)) {
44                     out.print(" selected");
45                 }
46                 out.println("'>");
47                 g.getName().output(out, l, vars);
48                 out.println("</option>");
49             }
50         }
51         out.println("</select>");
52     }
53
54     private boolean mayManage(Group g) {
55         return (bySupporter && g.isManagedBySupport()) || ( !bySupporter && g.isManagedByUser());
56     }
57
58     public Group getGroup() {
59         return value;
60     }
61 }