]> WPIA git - gigi.git/blobdiff - src/org/cacert/gigi/Gigi.java
Merge "Suggestions to enhance the SQL call pattern."
[gigi.git] / src / org / cacert / gigi / Gigi.java
index cf91b6b1279e80911c501ea3abf1796765c79229..bf6c32edc2404126276fcf140842cb18f80a0cab 100644 (file)
@@ -2,8 +2,11 @@ package org.cacert.gigi;
 
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.io.UnsupportedEncodingException;
 import java.security.KeyStore;
+import java.security.cert.X509Certificate;
 import java.util.Calendar;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.Locale;
@@ -18,167 +21,306 @@ import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
 import org.cacert.gigi.database.DatabaseConnection;
-import org.cacert.gigi.dbObjects.User;
+import org.cacert.gigi.database.DatabaseConnection.Link;
+import org.cacert.gigi.dbObjects.CACertificate;
+import org.cacert.gigi.dbObjects.CertificateProfile;
+import org.cacert.gigi.dbObjects.DomainPingConfiguration;
 import org.cacert.gigi.localisation.Language;
-import org.cacert.gigi.output.Form.CSRFException;
 import org.cacert.gigi.output.Menu;
-import org.cacert.gigi.output.Outputable;
+import org.cacert.gigi.output.MenuCollector;
 import org.cacert.gigi.output.PageMenuItem;
 import org.cacert.gigi.output.SimpleMenuItem;
+import org.cacert.gigi.output.template.Form.CSRFException;
+import org.cacert.gigi.output.template.Outputable;
 import org.cacert.gigi.output.template.Template;
+import org.cacert.gigi.pages.HandlesMixedRequest;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.LogoutPage;
 import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
-import org.cacert.gigi.pages.PolicyIndex;
+import org.cacert.gigi.pages.PasswordResetPage;
 import org.cacert.gigi.pages.RootCertPage;
 import org.cacert.gigi.pages.StaticPage;
 import org.cacert.gigi.pages.TestSecure;
 import org.cacert.gigi.pages.Verify;
 import org.cacert.gigi.pages.account.ChangePasswordPage;
+import org.cacert.gigi.pages.account.History;
 import org.cacert.gigi.pages.account.MyDetails;
+import org.cacert.gigi.pages.account.UserTrainings;
 import org.cacert.gigi.pages.account.certs.CertificateAdd;
 import org.cacert.gigi.pages.account.certs.Certificates;
 import org.cacert.gigi.pages.account.domain.DomainOverview;
 import org.cacert.gigi.pages.account.mail.MailOverview;
+import org.cacert.gigi.pages.admin.TTPAdminPage;
+import org.cacert.gigi.pages.admin.support.FindDomainPage;
+import org.cacert.gigi.pages.admin.support.FindUserPage;
+import org.cacert.gigi.pages.admin.support.SupportEnterTicketPage;
+import org.cacert.gigi.pages.admin.support.SupportUserDetailsPage;
+import org.cacert.gigi.pages.error.AccessDenied;
 import org.cacert.gigi.pages.error.PageNotFound;
 import org.cacert.gigi.pages.main.RegisterPage;
+import org.cacert.gigi.pages.orga.CreateOrgPage;
+import org.cacert.gigi.pages.orga.ViewOrgPage;
 import org.cacert.gigi.pages.wot.AssurePage;
+import org.cacert.gigi.pages.wot.MyListingPage;
 import org.cacert.gigi.pages.wot.MyPoints;
 import org.cacert.gigi.pages.wot.RequestTTPPage;
 import org.cacert.gigi.ping.PingerDaemon;
+import org.cacert.gigi.util.AuthorizationContext;
 import org.cacert.gigi.util.ServerConstants;
 
-public class Gigi extends HttpServlet {
+public final class Gigi extends HttpServlet {
 
-    private boolean firstInstanceInited = false;
+    private class MenuBuilder {
 
-    public static final String LOGGEDIN = "loggedin";
+        private LinkedList<Menu> categories = new LinkedList<Menu>();
 
-    public static final String USER = "user";
+        private HashMap<String, Page> pages = new HashMap<String, Page>();
 
-    private static final long serialVersionUID = -6386785421902852904L;
-
-    private Template baseTemplate;
+        private MenuCollector rootMenu;
 
-    private LinkedList<Menu> categories = new LinkedList<Menu>();
+        public MenuBuilder() {}
 
-    private HashMap<String, Page> pages = new HashMap<String, Page>();
-
-    private HashMap<Page, String> reveresePages = new HashMap<Page, String>();
+        private void putPage(String path, Page p, String category) {
+            pages.put(path, p);
+            if (category == null) {
+                return;
+            }
+            Menu m = getMenu(category);
+            m.addItem(new PageMenuItem(p, path.replaceFirst("/?\\*$", "")));
 
-    private Menu rootMenu;
+        }
 
-    private static Gigi instance;
+        private Menu getMenu(String category) {
+            Menu m = null;
+            for (Menu menu : categories) {
+                if (menu.getMenuName().equals(category)) {
+                    m = menu;
+                    break;
+                }
+            }
+            if (m == null) {
+                m = new Menu(category);
+                categories.add(m);
+            }
+            return m;
+        }
 
-    private PingerDaemon pinger;
+        public MenuCollector generateMenu() throws ServletException {
+            putPage("/denied", new AccessDenied(), null);
+            putPage("/error", new PageNotFound(), null);
+            putPage("/login", new LoginPage(), null);
+            getMenu("SomeCA.org").addItem(new SimpleMenuItem("https://" + ServerConstants.getWwwHostNamePort() + "/login", "Password Login") {
 
-    private KeyStore truststore;
+                @Override
+                public boolean isPermitted(AuthorizationContext ac) {
+                    return ac == null;
+                }
+            });
+            getMenu("SomeCA.org").addItem(new SimpleMenuItem("https://" + ServerConstants.getSecureHostNamePort() + "/login", "Certificate Login") {
 
-    public Gigi(Properties conf, KeyStore truststore) {
-        if (instance != null) {
-            throw new IllegalStateException("Multiple Gigi instances!");
-        }
-        instance = this;
-        DatabaseConnection.init(conf);
-        this.truststore = truststore;
-        pinger = new PingerDaemon(truststore);
-        pinger.start();
-    }
+                @Override
+                public boolean isPermitted(AuthorizationContext ac) {
+                    return ac == null;
+                }
+            });
+            putPage("/", new MainPage(), null);
+            putPage("/roots", new RootCertPage(truststore), "SomeCA.org");
 
-    @Override
-    public void init() throws ServletException {
-        if ( !firstInstanceInited) {
-            putPage("/error", new PageNotFound(), null);
-            putPage("/login", new LoginPage("CAcert - Login"), "CAcert.org");
-            putPage("/", new MainPage("CAcert - Home"), null);
-            putPage("/roots", new RootCertPage(truststore), "CAcert.org");
-            putPage(ChangePasswordPage.PATH, new ChangePasswordPage(), "My Account");
-            putPage(LogoutPage.PATH, new LogoutPage("Logout"), "My Account");
             putPage("/secure", new TestSecure(), null);
             putPage(Verify.PATH, new Verify(), null);
-            putPage(AssurePage.PATH + "/*", new AssurePage(), "CAcert Web of Trust");
             putPage(Certificates.PATH + "/*", new Certificates(), "Certificates");
-            putPage(MyDetails.PATH, new MyDetails(), "My Account");
-            putPage(RegisterPage.PATH, new RegisterPage(), "CAcert.org");
+            putPage(RegisterPage.PATH, new RegisterPage(), "SomeCA.org");
             putPage(CertificateAdd.PATH, new CertificateAdd(), "Certificates");
-            putPage(MailOverview.DEFAULT_PATH, new MailOverview("My email addresses"), "Certificates");
-            putPage(DomainOverview.PATH + "*", new DomainOverview("Domains"), "Certificates");
-            putPage(MyPoints.PATH, new MyPoints("My Points"), "CAcert Web of Trust");
-            putPage(RequestTTPPage.PATH, new RequestTTPPage(), "CAcert Web of Trust");
-            putPage("/wot/rules", new StaticPage("CAcert Web of Trust Rules", AssurePage.class.getResourceAsStream("Rules.templ")), "CAcert Web of Trust");
+            putPage(MailOverview.DEFAULT_PATH, new MailOverview(), "Certificates");
+            putPage(DomainOverview.PATH + "*", new DomainOverview(), "Certificates");
+
+            putPage(AssurePage.PATH + "/*", new AssurePage(), "Web of Trust");
+            putPage(MyPoints.PATH, new MyPoints(), "Web of Trust");
+            putPage(MyListingPage.PATH, new MyListingPage(), "Web of Trust");
+            putPage(RequestTTPPage.PATH, new RequestTTPPage(), "Web of Trust");
+
+            putPage(TTPAdminPage.PATH + "/*", new TTPAdminPage(), "Admin");
+            putPage(CreateOrgPage.DEFAULT_PATH, new CreateOrgPage(), "Organisation Admin");
+            putPage(ViewOrgPage.DEFAULT_PATH + "/*", new ViewOrgPage(), "Organisation Admin");
+
+            putPage(SupportEnterTicketPage.PATH, new SupportEnterTicketPage(), "Support Console");
+            putPage(FindUserPage.PATH, new FindUserPage(), "Support Console");
+            putPage(FindDomainPage.PATH, new FindDomainPage(), "Support Console");
+
+            putPage(SupportUserDetailsPage.PATH + "*", new SupportUserDetailsPage(), null);
+            putPage(ChangePasswordPage.PATH, new ChangePasswordPage(), "My Account");
+            putPage(LogoutPage.PATH, new LogoutPage(), "My Account");
+            putPage(History.PATH, new History(false), "My Account");
+            putPage(History.SUPPORT_PATH, new History(true), null);
+            putPage(UserTrainings.PATH, new UserTrainings(false), "My Account");
+            putPage(MyDetails.PATH, new MyDetails(), "My Account");
+            putPage(UserTrainings.SUPPORT_PATH, new UserTrainings(true), null);
+
+            putPage(PasswordResetPage.PATH, new PasswordResetPage(), null);
+
+            if (testing) {
+                try {
+                    Class<?> manager = Class.forName("org.cacert.gigi.pages.Manager");
+                    Page p = (Page) manager.getMethod("getInstance").invoke(null);
+                    String pa = (String) manager.getField("PATH").get(null);
+                    putPage(pa + "/*", p, "Gigi test server");
+                } catch (ReflectiveOperationException e) {
+                    e.printStackTrace();
+                }
+            }
+
+            try {
+                putPage("/wot/rules", new StaticPage("Web of Trust Rules", AssurePage.class.getResourceAsStream("Rules.templ")), "Web of Trust");
+            } catch (UnsupportedEncodingException e) {
+                throw new ServletException(e);
+            }
             baseTemplate = new Template(Gigi.class.getResource("Gigi.templ"));
-            rootMenu = new Menu("Main");
-            Menu about = new Menu("About CAcert.org");
-            categories.add(about);
-
-            about.addItem(new SimpleMenuItem("//blog.cacert.org/", "CAcert News"));
-            about.addItem(new SimpleMenuItem("//wiki.cacert.org/", "Wiki Documentation"));
-            putPage(PolicyIndex.DEFAULT_PATH, new PolicyIndex(), "About CAcert.org");
-            about.addItem(new SimpleMenuItem("//wiki.cacert.org/FAQ/Privileges", "Point System"));
-            about.addItem(new SimpleMenuItem("//bugs.cacert.org/", "Bug Database"));
-            about.addItem(new SimpleMenuItem("//wiki.cacert.org/Board", "CAcert Board"));
-            about.addItem(new SimpleMenuItem("//lists.cacert.org/wws", "Mailing Lists"));
-            about.addItem(new SimpleMenuItem("//blog.CAcert.org/feed", "RSS News Feed"));
-
-            Menu languages = new Menu("Translations");
+            rootMenu = new MenuCollector();
+
+            Menu languages = new Menu("Language");
             for (Locale l : Language.getSupportedLocales()) {
                 languages.addItem(new SimpleMenuItem("?lang=" + l.toString(), l.getDisplayName(l)));
             }
             categories.add(languages);
             for (Menu menu : categories) {
                 menu.prepare();
-                rootMenu.addItem(menu);
+                rootMenu.put(menu);
             }
 
-            rootMenu.prepare();
-            firstInstanceInited = true;
+            // rootMenu.prepare();
+            return rootMenu;
+        }
+
+        public Map<String, Page> getPages() {
+            return Collections.unmodifiableMap(pages);
+        }
+    }
+
+    public static final String LOGGEDIN = "loggedin";
+
+    public static final String CERT_SERIAL = "org.cacert.gigi.serial";
+
+    public static final String CERT_ISSUER = "org.cacert.gigi.issuer";
+
+    public static final String AUTH_CONTEXT = "auth";
+
+    public static final String LOGIN_METHOD = "org.cacert.gigi.loginMethod";
+
+    private static final long serialVersionUID = -6386785421902852904L;
+
+    private static Gigi instance;
+
+    private Template baseTemplate;
+
+    private PingerDaemon pinger;
+
+    private KeyStore truststore;
+
+    private boolean testing;
+
+    private MenuCollector rootMenu;
+
+    private Map<String, Page> pages;
+
+    private boolean firstInstanceInited = false;
+
+    public Gigi(Properties conf, KeyStore truststore) {
+        synchronized (Gigi.class) {
+            if (instance != null) {
+                throw new IllegalStateException("Multiple Gigi instances!");
+            }
+            testing = conf.getProperty("testing") != null;
+            instance = this;
+            DatabaseConnection.init(conf);
+            this.truststore = truststore;
+            pinger = new PingerDaemon(truststore);
+            pinger.start();
         }
-        super.init();
     }
 
-    private void putPage(String path, Page p, String category) {
-        pages.put(path, p);
-        reveresePages.put(p, path);
-        if (category == null) {
+    @Override
+    public synchronized void init() throws ServletException {
+        if (firstInstanceInited) {
+            super.init();
             return;
         }
-        Menu m = null;
-        for (Menu menu : categories) {
-            if (menu.getMenuName().equals(category)) {
-                m = menu;
-                break;
-            }
+        // ensure those static initializers are finished
+        try (Link l = DatabaseConnection.newLink(false)) {
+            CACertificate.getById(1);
+            CertificateProfile.getById(1);
+        } catch (InterruptedException e) {
+            throw new Error(e);
+        }
+
+        MenuBuilder mb = new MenuBuilder();
+        rootMenu = mb.generateMenu();
+        pages = mb.getPages();
+
+        firstInstanceInited = true;
+        super.init();
+    }
+
+    private Page getPage(String pathInfo) {
+        if (pathInfo.endsWith("/") && !pathInfo.equals("/")) {
+            pathInfo = pathInfo.substring(0, pathInfo.length() - 1);
+        }
+        Page page = pages.get(pathInfo);
+        if (page != null) {
+            return page;
+        }
+        page = pages.get(pathInfo + "/*");
+        if (page != null) {
+            return page;
+        }
+        int idx = pathInfo.lastIndexOf('/');
+        if (idx == -1 || idx == 0) {
+            return null;
+        }
+
+        page = pages.get(pathInfo.substring(0, idx) + "/*");
+        if (page != null) {
+            return page;
         }
-        if (m == null) {
-            m = new Menu(category);
-            categories.add(m);
+        int lIdx = pathInfo.lastIndexOf('/', idx - 1);
+        if (lIdx == -1) {
+            return null;
         }
-        m.addItem(new PageMenuItem(p));
+        String lastResort = pathInfo.substring(0, lIdx) + "/*" + pathInfo.substring(idx);
+        page = pages.get(lastResort);
+        return page;
 
     }
 
-    private static String staticTemplateVarHttp;
+    private static String staticTemplateVarHttp = "http://" + ServerConstants.getStaticHostNamePort();
 
-    private static String staticTemplateVarHttps;
+    private static String staticTemplateVarHttps = "https://" + ServerConstants.getStaticHostNamePortSecure();
 
     private static String getStaticTemplateVar(boolean https) {
         if (https) {
-            if (staticTemplateVarHttps == null) {
-                staticTemplateVarHttps = "https://" + ServerConstants.getStaticHostNamePortSecure();
-            }
             return staticTemplateVarHttps;
         } else {
-            if (staticTemplateVarHttp == null) {
-                staticTemplateVarHttp = "http://" + ServerConstants.getStaticHostNamePort();
-            }
             return staticTemplateVarHttp;
         }
     }
 
     @Override
     protected void service(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
-        boolean isSecure = req.getServerPort() == ServerConstants.getSecurePort();
+        if ("/error".equals(req.getPathInfo()) || "/denied".equals(req.getPathInfo())) {
+            if (DatabaseConnection.hasInstance()) {
+                serviceWithConnection(req, resp);
+                return;
+            }
+        }
+        try (DatabaseConnection.Link l = DatabaseConnection.newLink( !req.getMethod().equals("POST"))) {
+            serviceWithConnection(req, resp);
+        } catch (InterruptedException e) {
+            e.printStackTrace();
+        }
+    }
+
+    protected void serviceWithConnection(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
+        boolean isSecure = req.isSecure();
         addXSSHeaders(resp, isSecure);
         // Firefox only sends this, if it's a cross domain access; safari sends
         // it always
@@ -193,6 +335,18 @@ public class Gigi extends HttpServlet {
             return;
         }
         HttpSession hs = req.getSession();
+        String clientSerial = (String) hs.getAttribute(CERT_SERIAL);
+        if (clientSerial != null) {
+            X509Certificate[] cert = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");
+            if (cert == null || cert[0] == null//
+                    || !cert[0].getSerialNumber().toString(16).toUpperCase().equals(clientSerial) //
+                    || !cert[0].getIssuerDN().equals(hs.getAttribute(CERT_ISSUER))) {
+                hs.invalidate();
+                resp.sendError(403, "Certificate mismatch.");
+                return;
+            }
+
+        }
         if (req.getParameter("lang") != null) {
             Locale l = Language.getLocaleFromString(req.getParameter("lang"));
             Language lu = Language.getInstance(l);
@@ -205,25 +359,31 @@ public class Gigi extends HttpServlet {
                 resp.sendRedirect("https://" + ServerConstants.getWwwHostNamePortSecure() + req.getPathInfo());
                 return;
             }
-            User currentPageUser = LoginPage.getUser(req);
-            if ( !p.isPermitted(currentPageUser) && hs.getAttribute("loggedin") == null) {
-                String request = req.getPathInfo();
-                request = request.split("\\?")[0];
-                hs.setAttribute(LoginPage.LOGIN_RETURNPATH, request);
-                resp.sendRedirect("/login");
+            AuthorizationContext currentAuthContext = LoginPage.getAuthorizationContext(req);
+            if ( !p.isPermitted(currentAuthContext)) {
+                if (hs.getAttribute("loggedin") == null) {
+                    String request = req.getPathInfo();
+                    request = request.split("\\?")[0];
+                    hs.setAttribute(LoginPage.LOGIN_RETURNPATH, request);
+                    resp.sendRedirect("/login");
+                    return;
+                }
+                resp.sendError(403);
                 return;
             }
             if (p.beforeTemplate(req, resp)) {
                 return;
             }
             HashMap<String, Object> vars = new HashMap<String, Object>();
+            // System.out.println(req.getMethod() + ": " + req.getPathInfo() +
+            // " -> " + p);
             Outputable content = new Outputable() {
 
                 @Override
                 public void output(PrintWriter out, Language l, Map<String, Object> vars) {
                     try {
                         if (req.getMethod().equals("POST")) {
-                            if (req.getQueryString() != null) {
+                            if (req.getQueryString() != null && !(p instanceof HandlesMixedRequest)) {
                                 return;
                             }
                             p.doPost(req, resp);
@@ -242,96 +402,81 @@ public class Gigi extends HttpServlet {
 
                 }
             };
-            vars.put(Menu.USER_VALUE, currentPageUser);
+            Language lang = Page.getLanguage(req);
+
+            vars.put(Menu.AUTH_VALUE, currentAuthContext);
             vars.put("menu", rootMenu);
-            vars.put("title", Page.getLanguage(req).getTranslation(p.getTitle()));
+            vars.put("title", lang.getTranslation(p.getTitle()));
             vars.put("static", getStaticTemplateVar(isSecure));
             vars.put("year", Calendar.getInstance().get(Calendar.YEAR));
             vars.put("content", content);
+            if (currentAuthContext != null) {
+                // TODO maybe move this information into the AuthContext object
+                vars.put("loginMethod", req.getSession().getAttribute(LOGIN_METHOD));
+                vars.put("authContext", currentAuthContext);
+
+            }
             resp.setContentType("text/html; charset=utf-8");
-            baseTemplate.output(resp.getWriter(), Page.getLanguage(req), vars);
+            baseTemplate.output(resp.getWriter(), lang, vars);
         } else {
             resp.sendError(404, "Page not found.");
         }
 
     }
 
-    private Page getPage(String pathInfo) {
-        if (pathInfo.endsWith("/") && !pathInfo.equals("/")) {
-            pathInfo = pathInfo.substring(0, pathInfo.length() - 1);
-        }
-        Page page = pages.get(pathInfo);
-        if (page != null) {
-            return page;
-        }
-        page = pages.get(pathInfo + "/*");
-        if (page != null) {
-            return page;
-        }
-        int idx = pathInfo.lastIndexOf('/');
-        pathInfo = pathInfo.substring(0, idx);
-
-        page = pages.get(pathInfo + "/*");
-        if (page != null) {
-            return page;
-        }
-        return null;
-
-    }
-
     public static void addXSSHeaders(HttpServletResponse hsr, boolean doHttps) {
         hsr.addHeader("Access-Control-Allow-Origin", "https://" + ServerConstants.getWwwHostNamePortSecure() + " https://" + ServerConstants.getSecureHostNamePort());
         hsr.addHeader("Access-Control-Max-Age", "60");
         if (doHttps) {
-            hsr.addHeader("Content-Security-Policy", getHttpsCSP());
+            hsr.addHeader("Content-Security-Policy", httpsCSP);
         } else {
-            hsr.addHeader("Content-Security-Policy", getHttpCSP());
+            hsr.addHeader("Content-Security-Policy", httpCSP);
         }
         hsr.addHeader("Strict-Transport-Security", "max-age=31536000");
 
     }
 
-    private static String httpsCSP = null;
-
-    private static String httpCSP = null;
-
-    private static String getHttpsCSP() {
-        if (httpsCSP == null) {
-            StringBuffer csp = new StringBuffer();
-            csp.append("default-src 'none'");
-            csp.append(";font-src https://" + ServerConstants.getStaticHostNamePortSecure());
-            csp.append(";img-src https://" + ServerConstants.getStaticHostNamePortSecure());
-            csp.append(";media-src 'none'; object-src 'none'");
-            csp.append(";script-src https://" + ServerConstants.getStaticHostNamePortSecure());
-            csp.append(";style-src https://" + ServerConstants.getStaticHostNamePortSecure());
-            csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePortSecure());
-            csp.append(";report-url https://api.cacert.org/security/csp/report");
-            httpsCSP = csp.toString();
-        }
-        return httpsCSP;
-    }
-
-    private static String getHttpCSP() {
-        if (httpCSP == null) {
-            StringBuffer csp = new StringBuffer();
-            csp.append("default-src 'none'");
-            csp.append(";font-src http://" + ServerConstants.getStaticHostNamePort());
-            csp.append(";img-src http://" + ServerConstants.getStaticHostNamePort());
-            csp.append(";media-src 'none'; object-src 'none'");
-            csp.append(";script-src http://" + ServerConstants.getStaticHostNamePort());
-            csp.append(";style-src http://" + ServerConstants.getStaticHostNamePort());
-            csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePort());
-            csp.append(";report-url http://api.cacert.org/security/csp/report");
-            httpCSP = csp.toString();
-        }
-        return httpCSP;
+    private static String httpsCSP = genHttpsCSP();
+
+    private static String httpCSP = genHttpCSP();
+
+    private static String genHttpsCSP() {
+        StringBuffer csp = new StringBuffer();
+        csp.append("default-src 'none'");
+        csp.append(";font-src https://" + ServerConstants.getStaticHostNamePortSecure());
+        csp.append(";img-src https://" + ServerConstants.getStaticHostNamePortSecure());
+        csp.append(";media-src 'none'; object-src 'none'");
+        csp.append(";script-src https://" + ServerConstants.getStaticHostNamePortSecure());
+        csp.append(";style-src https://" + ServerConstants.getStaticHostNamePortSecure());
+        csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePortSecure());
+        // csp.append(";report-url https://api.cacert.org/security/csp/report");
+        return csp.toString();
     }
 
-    public static String getPathByPage(Page p) {
-        return instance.reveresePages.get(p).replaceFirst("/?\\*$", "");
+    private static String genHttpCSP() {
+        StringBuffer csp = new StringBuffer();
+        csp.append("default-src 'none'");
+        csp.append(";font-src http://" + ServerConstants.getStaticHostNamePort());
+        csp.append(";img-src http://" + ServerConstants.getStaticHostNamePort());
+        csp.append(";media-src 'none'; object-src 'none'");
+        csp.append(";script-src http://" + ServerConstants.getStaticHostNamePort());
+        csp.append(";style-src http://" + ServerConstants.getStaticHostNamePort());
+        csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePort());
+        // csp.append(";report-url http://api.cacert.org/security/csp/report");
+        return csp.toString();
     }
 
-    public static void notifyPinger() {
+    /**
+     * Requests Pinging of domains.
+     * 
+     * @param toReping
+     *            if not null, the {@link DomainPingConfiguration} to test, if
+     *            null, just re-check if there is something to do.
+     */
+    public static void notifyPinger(DomainPingConfiguration toReping) {
+        if (toReping != null) {
+            instance.pinger.queue(toReping);
+        }
         instance.pinger.interrupt();
     }