[UPDATE-CONFIG] Use 3 hosts www, secure and static.

[gigi.git] / src / org / cacert / gigi / Gigi.java

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 286f5eb976186c5daf821c62ee377cf518a7fea9..fa259c96c77cbf99835c8df72e374c863935bd3e 100644 (file)
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -7,6 +7,7 @@ import java.io.IOException;
 import java.io.InputStreamReader;
 import java.util.Calendar;
 import java.util.HashMap;
+import java.util.Properties;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
@@ -14,12 +15,20 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
+import org.cacert.gigi.database.DatabaseConnection;
+import org.cacert.gigi.email.EmailProvider;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
 import org.cacert.gigi.pages.TestSecure;
+import org.cacert.gigi.pages.Verify;
+import org.cacert.gigi.pages.account.MailAdd;
+import org.cacert.gigi.pages.account.MailCertificates;
+import org.cacert.gigi.pages.account.MailOverview;
 import org.cacert.gigi.pages.account.MyDetails;
 import org.cacert.gigi.pages.main.RegisterPage;
+import org.cacert.gigi.pages.wot.AssurePage;
+import org.cacert.gigi.util.ServerConstants;
 import org.eclipse.jetty.util.log.Log;
 
 public class Gigi extends HttpServlet {
@@ -29,20 +38,29 @@ public class Gigi extends HttpServlet {
        private String[] baseTemplate;
        private HashMap<String, Page> pages = new HashMap<String, Page>();
 
+       public Gigi(Properties conf) {
+               EmailProvider.init(conf);
+               DatabaseConnection.init(conf);
+       }
        @Override
        public void init() throws ServletException {
                pages.put("/login", new LoginPage("CACert - Login"));
                pages.put("/", new MainPage("CACert - Home"));
                pages.put("/secure", new TestSecure());
+               pages.put(Verify.PATH, new Verify());
+               pages.put(AssurePage.PATH + "/*", new AssurePage());
+               pages.put(MailCertificates.PATH, new MailCertificates());
                pages.put(MyDetails.PATH, new MyDetails());
                pages.put(RegisterPage.PATH, new RegisterPage());
+               pages.put(MailOverview.DEFAULT_PATH, new MailOverview(
+                               "My email addresses"));
+               pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email"));
                String templ = "";
-               try {
-                       BufferedReader reader = new BufferedReader(new InputStreamReader(
-                                       new FileInputStream(new File("templates/base.html"))));
+               try (BufferedReader reader = new BufferedReader(new InputStreamReader(
+                               new FileInputStream(new File("templates/base.html"))))) {
                        String tmp;
                        while ((tmp = reader.readLine()) != null) {
-                               templ += tmp;
+                               templ += tmp + "\n";
                        }
                        baseTemplate = templ.split("\\$content\\$");
                } catch (Exception e) {
@@ -54,6 +72,11 @@ public class Gigi extends HttpServlet {
        @Override
        protected void service(HttpServletRequest req, HttpServletResponse resp)
                        throws ServletException, IOException {
+               addXSSHeaders(resp);
+               if (req.getHeader("Origin") != null) {
+                       resp.getWriter().println("No cross domain access allowed.");
+                       return;
+               }
                HttpSession hs = req.getSession();
                if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
                        if (hs != null) {
@@ -64,12 +87,19 @@ public class Gigi extends HttpServlet {
                        return;
                }
 
-               if (pages.containsKey(req.getPathInfo())) {
-                       Page p = pages.get(req.getPathInfo());
+               Page p = getPage(req.getPathInfo());
+               if (p != null) {
+
                        if (p.needsLogin() && hs.getAttribute("loggedin") == null) {
+                               String request = req.getPathInfo();
+                               request = request.split("\\?")[0];
+                               hs.setAttribute(LoginPage.LOGIN_RETURNPATH, request);
                                resp.sendRedirect("/login");
                                return;
                        }
+                       if (p.beforeTemplate(req, resp)) {
+                               return;
+                       }
 
                        String b0 = baseTemplate[0];
                        b0 = makeDynTempl(b0, p);
@@ -87,6 +117,28 @@ public class Gigi extends HttpServlet {
                        resp.sendError(404, "Page not found.");
                }
 
+       }
+       private Page getPage(String pathInfo) {
+               if (pathInfo.endsWith("/") && !pathInfo.equals("/")) {
+                       pathInfo = pathInfo.substring(0, pathInfo.length() - 1);
+               }
+               Page page = pages.get(pathInfo);
+               if (page != null) {
+                       return page;
+               }
+               page = pages.get(pathInfo + "/*");
+               if (page != null) {
+                       return page;
+               }
+               int idx = pathInfo.lastIndexOf('/');
+               pathInfo = pathInfo.substring(0, idx);
+
+               page = pages.get(pathInfo + "/*");
+               if (page != null) {
+                       return page;
+               }
+               return null;
+
        }
        private String makeDynTempl(String in, Page p) {
                int year = Calendar.getInstance().get(Calendar.YEAR);
@@ -94,5 +146,14 @@ public class Gigi extends HttpServlet {
                in = in.replaceAll("\\$year\\$", year + "");
                return in;
        }
+       public static void addXSSHeaders(HttpServletResponse hsr) {
+               hsr.addHeader("Access-Control-Allow-Origin",
+                               "http://cacert.org https://localhost");
+               hsr.addHeader("Access-Control-Max-Age", "60");
+               hsr.addHeader("Content-Security-Policy", "default-src 'self' https://"
+                               + ServerConstants.getStaticHostNamePort()
+                               + " https://www.cacert.org/*;frame-ancestors 'none'");
+               // ;report-uri https://felix.dogcraft.de/report.php
 
+       }
 }