src/org/cacert/gigi/pages/LoginPage.java

   1 package org.cacert.gigi.pages;
   2
   3 import static org.cacert.gigi.Gigi.*;
   4
   5 import java.io.IOException;
   6 import java.security.cert.X509Certificate;
   7 import javax.servlet.http.HttpServletRequest;
   8 import javax.servlet.http.HttpServletResponse;
   9 import javax.servlet.http.HttpSession;
  10
  11 import org.cacert.gigi.database.DatabaseConnection;
  12 import org.cacert.gigi.database.GigiPreparedStatement;
  13 import org.cacert.gigi.database.GigiResultSet;
  14 import org.cacert.gigi.dbObjects.User;
  15 import org.cacert.gigi.localisation.Language;
  16 import org.cacert.gigi.util.PasswordHash;
  17
  18 public class LoginPage extends Page {
  19
  20     public static final String LOGIN_RETURNPATH = "login-returnpath";
  21
  22     public LoginPage(String title) {
  23         super(title);
  24     }
  25
  26     @Override
  27     public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  28         resp.getWriter().println("<form method='POST' action='/login'>" + "<input type='text' name='username'>" + "<input type='password' name='password'> <input type='submit' value='login'></form>");
  29     }
  30
  31     @Override
  32     public boolean beforeTemplate(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  33         String redir = (String) req.getSession().getAttribute(LOGIN_RETURNPATH);
  34         if (req.getSession().getAttribute("loggedin") == null) {
  35             X509Certificate[] cert = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
  36             if (cert != null && cert[0] != null) {
  37                 tryAuthWithCertificate(req, cert[0]);
  38             }
  39             if (req.getMethod().equals("POST")) {
  40                 tryAuthWithUnpw(req);
  41             }
  42         }
  43
  44         if (req.getSession().getAttribute("loggedin") != null) {
  45             String s = redir;
  46             if (s != null) {
  47                 if ( !s.startsWith("/")) {
  48                     s = "/" + s;
  49                 }
  50                 resp.sendRedirect(s);
  51             } else {
  52                 resp.sendRedirect("/");
  53             }
  54             return true;
  55         }
  56         return false;
  57     }
  58
  59     @Override
  60     public boolean needsLogin() {
  61         return false;
  62     }
  63
  64     private void tryAuthWithUnpw(HttpServletRequest req) {
  65         String un = req.getParameter("username");
  66         String pw = req.getParameter("password");
  67         GigiPreparedStatement ps = DatabaseConnection.getInstance().prepare("SELECT `password`, `id` FROM `users` WHERE `email`=? AND locked='0' AND verified='1'");
  68         ps.setString(1, un);
  69         GigiResultSet rs = ps.executeQuery();
  70         if (rs.next()) {
  71             if (PasswordHash.verifyHash(pw, rs.getString(1))) {
  72                 loginSession(req, User.getById(rs.getInt(2)));
  73             }
  74         }
  75         rs.close();
  76     }
  77
  78     public static User getUser(HttpServletRequest req) {
  79         return (User) req.getSession().getAttribute(USER);
  80     }
  81
  82     private void tryAuthWithCertificate(HttpServletRequest req, X509Certificate x509Certificate) {
  83         String serial = x509Certificate.getSerialNumber().toString(16).toUpperCase();
  84         GigiPreparedStatement ps = DatabaseConnection.getInstance().prepare("SELECT `memid` FROM `certs` WHERE `serial`=? AND `disablelogin`='0' AND `revoked` = " + "'0000-00-00 00:00:00'");
  85         ps.setString(1, serial);
  86         GigiResultSet rs = ps.executeQuery();
  87         if (rs.next()) {
  88             loginSession(req, User.getById(rs.getInt(1)));
  89         }
  90         rs.close();
  91     }
  92
  93     private void loginSession(HttpServletRequest req, User user) {
  94         req.getSession().invalidate();
  95         HttpSession hs = req.getSession();
  96         hs.setAttribute(LOGGEDIN, true);
  97         hs.setAttribute(Language.SESSION_ATTRIB_NAME, user.getPreferredLocale());
  98         hs.setAttribute(USER, user);
  99     }
 100
 101     @Override
 102     public boolean isPermitted(User u) {
 103         return u == null;
 104     }
 105 }