Merge "Update notes about password security"

[gigi.git] / src / org / cacert / gigi / dbObjects / User.java

diff --git a/src/org/cacert/gigi/dbObjects/User.java b/src/org/cacert/gigi/dbObjects/User.java
index d68b183fa330ead188befeecd67eb73bd1e74c31..567da97b20643b2f897e73ae4d6be815c95f3da8 100644 (file)
--- a/src/org/cacert/gigi/dbObjects/User.java
+++ b/src/org/cacert/gigi/dbObjects/User.java
@@ -1,7 +1,6 @@
 package org.cacert.gigi.dbObjects;
 
 import java.util.ArrayList;
-import java.util.Calendar;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.LinkedList;
@@ -14,6 +13,8 @@ import org.cacert.gigi.database.GigiPreparedStatement;
 import org.cacert.gigi.database.GigiResultSet;
 import org.cacert.gigi.localisation.Language;
 import org.cacert.gigi.output.DateSelector;
+import org.cacert.gigi.pages.PasswordResetPage;
+import org.cacert.gigi.util.CalendarUtil;
 import org.cacert.gigi.util.DayDate;
 import org.cacert.gigi.util.Notary;
 import org.cacert.gigi.util.PasswordHash;
@@ -39,6 +40,14 @@ public class User extends CertificateOwner {
 
     private final Set<Group> groups = new HashSet<>();
 
+    public static final int MINIMUM_AGE = 16;
+
+    public static final int POJAM_AGE = 14;
+
+    public static final int ADULT_AGE = 18;
+
+    public static final boolean POJAM_ENABLED = false;
+
     protected User(GigiResultSet rs) {
         super(rs.getInt("id"));
         updateName(rs);
@@ -132,8 +141,14 @@ public class User extends CertificateOwner {
     }
 
     public boolean canAssure() {
-        if ( !isOfAge(14)) { // PoJAM
-            return false;
+        if (POJAM_ENABLED) {
+            if ( !CalendarUtil.isOfAge(dob, POJAM_AGE)) { // PoJAM
+                return false;
+            }
+        } else {
+            if ( !CalendarUtil.isOfAge(dob, ADULT_AGE)) {
+                return false;
+            }
         }
         if (getAssurancePoints() < 100) {
             return false;
@@ -146,7 +161,7 @@ public class User extends CertificateOwner {
     public boolean hasPassedCATS() {
         try (GigiPreparedStatement query = new GigiPreparedStatement("SELECT 1 FROM `cats_passed` where `user_id`=? AND `variant_id`=?")) {
             query.setInt(1, getId());
-            query.setInt(2, CATS.ASSURER_CHALLANGE_ID);
+            query.setInt(2, CATS.ASSURER_CHALLENGE_ID);
             try (GigiResultSet rs = query.executeQuery()) {
                 if (rs.next()) {
                     return true;
@@ -194,7 +209,7 @@ public class User extends CertificateOwner {
      * @return the maximal points @
      */
     public int getMaxAssurePoints() {
-        if ( !isOfAge(18)) {
+        if ( !CalendarUtil.isOfAge(dob, ADULT_AGE) && POJAM_ENABLED) {
             return 10; // PoJAM
         }
 
@@ -220,17 +235,6 @@ public class User extends CertificateOwner {
         return points;
     }
 
-    public boolean isOfAge(int desiredAge) {
-        Calendar c = Calendar.getInstance();
-        c.setTimeInMillis(dob.getTime());
-        int year = c.get(Calendar.YEAR);
-        int month = c.get(Calendar.MONTH);
-        int day = c.get(Calendar.DAY_OF_MONTH);
-        c.set(year, month, day);
-        c.add(Calendar.YEAR, desiredAge);
-        return System.currentTimeMillis() >= c.getTime().getTime();
-    }
-
     public boolean isValidName(String name) {
         return getName().matches(name);
     }
@@ -517,9 +521,10 @@ public class User extends CertificateOwner {
     }
 
     public static User getResetWithToken(int id, String token) {
-        try (GigiPreparedStatement ps = new GigiPreparedStatement("SELECT `memid` FROM `passwordResetTickets` WHERE `id`=? AND `token`=? AND `used` IS NULL")) {
+        try (GigiPreparedStatement ps = new GigiPreparedStatement("SELECT `memid` FROM `passwordResetTickets` WHERE `id`=? AND `token`=? AND `used` IS NULL AND `created` > CURRENT_TIMESTAMP - interval '1 hours' * ?")) {
             ps.setInt(1, id);
             ps.setString(2, token);
+            ps.setInt(3, PasswordResetPage.HOUR_MAX);
             GigiResultSet res = ps.executeQuery();
             if ( !res.next()) {
                 return null;
@@ -534,7 +539,7 @@ public class User extends CertificateOwner {
             ps.setInt(2, getId());
             GigiResultSet rs = ps.executeQuery();
             if ( !rs.next()) {
-                throw new GigiApiException("Token not found... very bad.");
+                throw new GigiApiException("Token could not be found, has already been used, or is expired.");
             }
             if (PasswordHash.verifyHash(private_token, rs.getString(1)) == null) {
                 throw new GigiApiException("Private token does not match.");