Change cert variable names id -> serial for identification.

[gigi.git] / src / org / cacert / gigi / pages / account / MailCertificates.java

diff --git a/src/org/cacert/gigi/pages/account/MailCertificates.java b/src/org/cacert/gigi/pages/account/MailCertificates.java
index 6eae585a2c787cee2ab2691712e58346713feffc..f073d33a77b2b5ac8f2410a99552f4407c9021eb 100644 (file)
--- a/src/org/cacert/gigi/pages/account/MailCertificates.java
+++ b/src/org/cacert/gigi/pages/account/MailCertificates.java
@@ -27,15 +27,17 @@ public class MailCertificates extends Page {
        }
 
        @Override
-       public void doGet(HttpServletRequest req, HttpServletResponse resp)
-                       throws IOException {
+       public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
                PrintWriter out = resp.getWriter();
                String pi = req.getPathInfo().substring(PATH.length());
                if (pi.length() != 0) {
                        pi = pi.substring(1);
-                       int id = Integer.parseInt(pi);
-                       Certificate c = new Certificate(id);
-                       // TODO check ownership
+                       int serial = Integer.parseInt(pi);
+                       Certificate c = new Certificate(serial);
+                       if (LoginPage.getUser(req).getId() != c.getOwnerId()) {
+                               out.println(translate(req, "You do not own this certificate."));
+                               return;
+                       }
                        out.println("<pre>");
                        try {
                                out.print(c.cert());
@@ -51,10 +53,8 @@ public class MailCertificates extends Page {
                HashMap<String, Object> vars = new HashMap<String, Object>();
                User us = LoginPage.getUser(req);
                try {
-                       PreparedStatement ps = DatabaseConnection
-                                       .getInstance()
-                                       .prepare(
-                                                       "SELECT `id`, `CN`, `serial`, `revoked`, `expire`, `disablelogin` FROM `emailcerts` WHERE `memid`=?");
+                       PreparedStatement ps = DatabaseConnection.getInstance().prepare(
+                               "SELECT `id`, `CN`, `serial`, `revoked`, `expire`, `disablelogin` FROM `emailcerts` WHERE `memid`=?");
                        ps.setInt(1, us.getId());
                        ResultSet rs = ps.executeQuery();
                        vars.put("mailcerts", rs);