fix: restrict access to CATS-API even more

[gigi.git] / src / org / cacert / gigi / api / APIPoint.java

diff --git a/src/org/cacert/gigi/api/APIPoint.java b/src/org/cacert/gigi/api/APIPoint.java
index 5a66ff68b998fe096cb391b7e101cfa77f398726..72a555b1539a5a89ba51f2bb564c9d1453877f68 100644 (file)
--- a/src/org/cacert/gigi/api/APIPoint.java
+++ b/src/org/cacert/gigi/api/APIPoint.java
@@ -6,6 +6,7 @@ import java.security.cert.X509Certificate;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.cacert.gigi.dbObjects.Certificate;
 import org.cacert.gigi.dbObjects.CertificateOwner;
 import org.cacert.gigi.dbObjects.User;
 import org.cacert.gigi.pages.LoginPage;
@@ -15,15 +16,25 @@ public abstract class APIPoint {
     public void process(HttpServletRequest req, HttpServletResponse resp) throws IOException {
         X509Certificate cert = LoginPage.getCertificateFromRequest(req);
         if (cert == null) {
-            resp.sendError(403, "Error, cert authing required.");
+            resp.sendError(403, "Error, cert authing required. No cert found.");
             return;
         }
         String serial = LoginPage.extractSerialFormCert(cert);
+        Certificate clientCert = Certificate.getBySerial(serial);
         CertificateOwner u = CertificateOwner.getByEnabledSerial(serial);
-        if (u == null) {
-            resp.sendError(403, "Error, cert authing required.");
+        if (u == null || clientCert == null) {
+            resp.sendError(403, "Error, cert authing required. Serial not found: " + serial);
             return;
         }
+        if (req.getMethod().equals("GET")) {
+            if (u instanceof User) {
+                processGet(req, resp, (User) u);
+                return;
+            } else {
+                resp.sendError(500, "Error, requires a User certificate.");
+                return;
+            }
+        }
 
         if ( !req.getMethod().equals("POST")) {
             resp.sendError(500, "Error, POST required.");
@@ -33,6 +44,10 @@ public abstract class APIPoint {
             resp.sendError(500, "Error, no query String allowed.");
             return;
         }
+        process(req, resp, u, clientCert);
+    }
+
+    protected void process(HttpServletRequest req, HttpServletResponse resp, CertificateOwner u, Certificate clientCert) throws IOException {
         process(req, resp, u);
     }
 
@@ -46,6 +61,10 @@ public abstract class APIPoint {
     }
 
     protected void process(HttpServletRequest req, HttpServletResponse resp, User u) throws IOException {
+        resp.sendError(500, "Error, Post not allowed.");
+    }
 
+    protected void processGet(HttpServletRequest req, HttpServletResponse resp, User u) throws IOException {
+        resp.sendError(500, "Error, Get not allowed.");
     }
 }