src/org/cacert/gigi/pages/LoginPage.java

   1 package org.cacert.gigi.pages;
   2
   3 import static org.cacert.gigi.Gigi.*;
   4
   5 import java.io.IOException;
   6 import java.io.PrintWriter;
   7 import java.security.cert.X509Certificate;
   8 import java.util.HashMap;
   9 import java.util.Map;
  10
  11 import javax.servlet.http.HttpServletRequest;
  12 import javax.servlet.http.HttpServletResponse;
  13 import javax.servlet.http.HttpSession;
  14
  15 import org.cacert.gigi.GigiApiException;
  16 import org.cacert.gigi.database.DatabaseConnection;
  17 import org.cacert.gigi.database.GigiPreparedStatement;
  18 import org.cacert.gigi.database.GigiResultSet;
  19 import org.cacert.gigi.dbObjects.Group;
  20 import org.cacert.gigi.dbObjects.User;
  21 import org.cacert.gigi.localisation.Language;
  22 import org.cacert.gigi.output.template.Form;
  23 import org.cacert.gigi.util.PasswordHash;
  24
  25 public class LoginPage extends Page {
  26
  27     public class LoginForm extends Form {
  28
  29         public LoginForm(HttpServletRequest hsr) {
  30             super(hsr);
  31         }
  32
  33         @Override
  34         public boolean submit(PrintWriter out, HttpServletRequest req) throws GigiApiException {
  35             tryAuthWithUnpw(req);
  36             return false;
  37         }
  38
  39         @Override
  40         protected void outputContent(PrintWriter out, Language l, Map<String, Object> vars) {
  41             getDefaultTemplate().output(out, l, vars);
  42         }
  43
  44     }
  45
  46     public static final String LOGIN_RETURNPATH = "login-returnpath";
  47
  48     public LoginPage(String title) {
  49         super(title);
  50     }
  51
  52     @Override
  53     public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  54         new LoginForm(req).output(resp.getWriter(), getLanguage(req), new HashMap<String, Object>());
  55     }
  56
  57     @Override
  58     public boolean beforeTemplate(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  59         String redir = (String) req.getSession().getAttribute(LOGIN_RETURNPATH);
  60         if (req.getSession().getAttribute("loggedin") == null) {
  61             X509Certificate[] cert = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
  62             if (cert != null && cert[0] != null) {
  63                 tryAuthWithCertificate(req, cert[0]);
  64             }
  65             if (req.getMethod().equals("POST")) {
  66                 try {
  67                     Form.getForm(req, LoginForm.class).submit(resp.getWriter(), req);
  68                 } catch (GigiApiException e) {
  69                 }
  70             }
  71         }
  72
  73         if (req.getSession().getAttribute("loggedin") != null) {
  74             String s = redir;
  75             if (s != null) {
  76                 if ( !s.startsWith("/")) {
  77                     s = "/" + s;
  78                 }
  79                 resp.sendRedirect(s);
  80             } else {
  81                 resp.sendRedirect("/");
  82             }
  83             return true;
  84         }
  85         return false;
  86     }
  87
  88     @Override
  89     public boolean needsLogin() {
  90         return false;
  91     }
  92
  93     private void tryAuthWithUnpw(HttpServletRequest req) {
  94         String un = req.getParameter("username");
  95         String pw = req.getParameter("password");
  96         GigiPreparedStatement ps = DatabaseConnection.getInstance().prepare("SELECT `password`, `id` FROM `users` WHERE `email`=? AND verified='1'");
  97         ps.setString(1, un);
  98         GigiResultSet rs = ps.executeQuery();
  99         if (rs.next()) {
 100             String dbHash = rs.getString(1);
 101             String hash = PasswordHash.verifyHash(pw, dbHash);
 102             if (hash != null) {
 103                 if ( !hash.equals(dbHash)) {
 104                     GigiPreparedStatement gps = DatabaseConnection.getInstance().prepare("UPDATE `users` SET `password`=? WHERE `email`=?");
 105                     gps.setString(1, hash);
 106                     gps.setString(2, un);
 107                     gps.executeUpdate();
 108                 }
 109                 loginSession(req, User.getById(rs.getInt(2)));
 110             }
 111         }
 112         rs.close();
 113     }
 114
 115     public static User getUser(HttpServletRequest req) {
 116         return (User) req.getSession().getAttribute(USER);
 117     }
 118
 119     private void tryAuthWithCertificate(HttpServletRequest req, X509Certificate x509Certificate) {
 120         String serial = x509Certificate.getSerialNumber().toString(16).toUpperCase();
 121         GigiPreparedStatement ps = DatabaseConnection.getInstance().prepare("SELECT `memid` FROM `certs` WHERE `serial`=? AND `disablelogin`='0' AND `revoked` is NULL");
 122         ps.setString(1, serial);
 123         GigiResultSet rs = ps.executeQuery();
 124         if (rs.next()) {
 125             loginSession(req, User.getById(rs.getInt(1)));
 126             req.getSession().setAttribute(CERT_SERIAL, serial);
 127             req.getSession().setAttribute(CERT_ISSUER, x509Certificate.getIssuerDN());
 128         }
 129         rs.close();
 130     }
 131
 132     private static final Group LOGIN_BLOCKED = Group.getByString("blockedlogin");
 133
 134     private void loginSession(HttpServletRequest req, User user) {
 135         if (user.isInGroup(LOGIN_BLOCKED)) {
 136             return;
 137         }
 138         req.getSession().invalidate();
 139         HttpSession hs = req.getSession();
 140         hs.setAttribute(LOGGEDIN, true);
 141         hs.setAttribute(Language.SESSION_ATTRIB_NAME, user.getPreferredLocale());
 142         hs.setAttribute(USER, user);
 143     }
 144
 145     @Override
 146     public boolean isPermitted(User u) {
 147         return u == null;
 148     }
 149 }