Merge "Update notes about password security"

[gigi.git] / src / org / cacert / gigi / dbObjects / User.java

diff --git a/src/org/cacert/gigi/dbObjects/User.java b/src/org/cacert/gigi/dbObjects/User.java
index 99d44a7c3674a1b6fcc329e76be731bc5de90025..567da97b20643b2f897e73ae4d6be815c95f3da8 100644 (file)
--- a/src/org/cacert/gigi/dbObjects/User.java
+++ b/src/org/cacert/gigi/dbObjects/User.java
@@ -13,6 +13,7 @@ import org.cacert.gigi.database.GigiPreparedStatement;
 import org.cacert.gigi.database.GigiResultSet;
 import org.cacert.gigi.localisation.Language;
 import org.cacert.gigi.output.DateSelector;
+import org.cacert.gigi.pages.PasswordResetPage;
 import org.cacert.gigi.util.CalendarUtil;
 import org.cacert.gigi.util.DayDate;
 import org.cacert.gigi.util.Notary;
@@ -39,6 +40,14 @@ public class User extends CertificateOwner {
 
     private final Set<Group> groups = new HashSet<>();
 
+    public static final int MINIMUM_AGE = 16;
+
+    public static final int POJAM_AGE = 14;
+
+    public static final int ADULT_AGE = 18;
+
+    public static final boolean POJAM_ENABLED = false;
+
     protected User(GigiResultSet rs) {
         super(rs.getInt("id"));
         updateName(rs);
@@ -132,8 +141,14 @@ public class User extends CertificateOwner {
     }
 
     public boolean canAssure() {
-        if ( !CalendarUtil.isOfAge(dob, 14)) { // PoJAM
-            return false;
+        if (POJAM_ENABLED) {
+            if ( !CalendarUtil.isOfAge(dob, POJAM_AGE)) { // PoJAM
+                return false;
+            }
+        } else {
+            if ( !CalendarUtil.isOfAge(dob, ADULT_AGE)) {
+                return false;
+            }
         }
         if (getAssurancePoints() < 100) {
             return false;
@@ -146,7 +161,7 @@ public class User extends CertificateOwner {
     public boolean hasPassedCATS() {
         try (GigiPreparedStatement query = new GigiPreparedStatement("SELECT 1 FROM `cats_passed` where `user_id`=? AND `variant_id`=?")) {
             query.setInt(1, getId());
-            query.setInt(2, CATS.ASSURER_CHALLANGE_ID);
+            query.setInt(2, CATS.ASSURER_CHALLENGE_ID);
             try (GigiResultSet rs = query.executeQuery()) {
                 if (rs.next()) {
                     return true;
@@ -194,7 +209,7 @@ public class User extends CertificateOwner {
      * @return the maximal points @
      */
     public int getMaxAssurePoints() {
-        if ( !CalendarUtil.isOfAge(dob, 18)) {
+        if ( !CalendarUtil.isOfAge(dob, ADULT_AGE) && POJAM_ENABLED) {
             return 10; // PoJAM
         }
 
@@ -506,9 +521,10 @@ public class User extends CertificateOwner {
     }
 
     public static User getResetWithToken(int id, String token) {
-        try (GigiPreparedStatement ps = new GigiPreparedStatement("SELECT `memid` FROM `passwordResetTickets` WHERE `id`=? AND `token`=? AND `used` IS NULL")) {
+        try (GigiPreparedStatement ps = new GigiPreparedStatement("SELECT `memid` FROM `passwordResetTickets` WHERE `id`=? AND `token`=? AND `used` IS NULL AND `created` > CURRENT_TIMESTAMP - interval '1 hours' * ?")) {
             ps.setInt(1, id);
             ps.setString(2, token);
+            ps.setInt(3, PasswordResetPage.HOUR_MAX);
             GigiResultSet res = ps.executeQuery();
             if ( !res.next()) {
                 return null;
@@ -523,7 +539,7 @@ public class User extends CertificateOwner {
             ps.setInt(2, getId());
             GigiResultSet rs = ps.executeQuery();
             if ( !rs.next()) {
-                throw new GigiApiException("Token not found... very bad.");
+                throw new GigiApiException("Token could not be found, has already been used, or is expired.");
             }
             if (PasswordHash.verifyHash(private_token, rs.getString(1)) == null) {
                 throw new GigiApiException("Private token does not match.");