upd: use a more strict pattern for handling forms

[gigi.git] / src / org / cacert / gigi / pages / admin / support / SupportUserDetailsPage.java

diff --git a/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsPage.java b/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsPage.java
index 726bdd391566bd740b29faf426048d06047e9a5d..2a8ef874d8069d78303cabdb25b96ea945654b50 100644 (file)
--- a/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsPage.java
+++ b/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsPage.java
@@ -8,6 +8,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.cacert.gigi.GigiApiException;
+import org.cacert.gigi.dbObjects.Domain;
 import org.cacert.gigi.dbObjects.EmailAddress;
 import org.cacert.gigi.dbObjects.SupportedUser;
 import org.cacert.gigi.dbObjects.User;
@@ -17,6 +18,7 @@ import org.cacert.gigi.output.template.IterableDataset;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.Page;
 import org.cacert.gigi.util.AuthorizationContext;
+import org.cacert.gigi.util.HTMLEncoder;
 
 public class SupportUserDetailsPage extends Page {
 
@@ -29,6 +31,9 @@ public class SupportUserDetailsPage extends Page {
     @Override
     public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
         int id = -1;
+        if ( !req.getPathInfo().endsWith("/")) {
+            resp.sendError(404);
+        }
         String[] idP = req.getPathInfo().split("/");
         try {
             id = Integer.parseInt(idP[idP.length - 1]);
@@ -48,15 +53,36 @@ public class SupportUserDetailsPage extends Page {
             @Override
             public boolean next(Language l, Map<String, Object> vars) {
                 for (; i < addrs.length;) {
-                    String address = addrs[i++].getAddress();
+                    EmailAddress secAddress = addrs[i++];
+                    String address = secAddress.getAddress();
                     if ( !address.equals(user.getEmail())) {
                         vars.put("secmail", address);
+                        vars.put("status", l.getTranslation(secAddress.isVerified() ? "verified" : "not verified"));
                         return true;
                     }
                 }
                 return false;
             }
         });
+
+        final Domain[] doms = user.getDomains();
+        vars.put("domains", new IterableDataset() {
+
+            private int point = 0;
+
+            @Override
+            public boolean next(Language l, Map<String, Object> vars) {
+                if (point >= doms.length) {
+                    return false;
+                }
+                Domain domain = doms[point];
+                vars.put("domain", domain.getSuffix());
+                vars.put("status", l.getTranslation(domain.isVerified() ? "verified" : "not verified"));
+                point++;
+                return true;
+            }
+        });
+
         vars.put("certifrevoke", new SupportRevokeCertificatesForm(req, targetUser));
         getDefaultTemplate().output(resp.getWriter(), getLanguage(req), vars);
     }
@@ -65,11 +91,15 @@ public class SupportUserDetailsPage extends Page {
     public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
         try {
             if (req.getParameter("revokeall") != null) {
-                if ( !Form.getForm(req, SupportRevokeCertificatesForm.class).submit(resp.getWriter(), req)) {
+                if ( !Form.getForm(req, SupportRevokeCertificatesForm.class).submitProtected(resp.getWriter(), req)) {
                     throw new GigiApiException("No ticket number set.");
                 }
-            } else if (req.getParameter("detailupdate") != null || req.getParameter("resetPass") != null || req.getParameter("deny") != null || req.getParameter("grant") != null) {
-                if ( !Form.getForm(req, SupportUserDetailsForm.class).submit(resp.getWriter(), req)) {
+            } else if (req.getParameter("detailupdate") != null || req.getParameter("resetPass") != null || req.getParameter("removeGroup") != null || req.getParameter("addGroup") != null) {
+                SupportUserDetailsForm f = Form.getForm(req, SupportUserDetailsForm.class);
+                if (f.wasWithPasswordReset()) {
+                    resp.getWriter().println(HTMLEncoder.encodeHTML(translate(req, "Password reset successful.")));
+                }
+                if ( !f.submitProtected(resp.getWriter(), req)) {
                     throw new GigiApiException("No ticket number set.");
                 }
             }