X-Git-Url: https://code.wpia.club/?p=gigi.git;a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2FGigi.java;h=79cf670f9ba3a2eb1f3a932dc06e14129235636c;hp=eab09850fdea2acc36f8e41271375647c09e1f02;hb=ccccf71df5e25af791078b408eab30e162926868;hpb=06b41fa06bd488f943eae0a16a71babdd2745e24

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index eab09850..79cf670f 100644
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -2,6 +2,7 @@ package org.cacert.gigi;
 
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.security.KeyStore;
 import java.util.Calendar;
 import java.util.HashMap;
 import java.util.LinkedList;
@@ -25,6 +26,7 @@ import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.LogoutPage;
 import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
+import org.cacert.gigi.pages.RootCertPage;
 import org.cacert.gigi.pages.StaticPage;
 import org.cacert.gigi.pages.TestSecure;
 import org.cacert.gigi.pages.Verify;
@@ -63,14 +65,18 @@ public class Gigi extends HttpServlet {
 
     private static Gigi instance;
 
-    private PingerDaemon pinger = new PingerDaemon();
+    private PingerDaemon pinger;
 
-    public Gigi(Properties conf) {
+    private KeyStore truststore;
+
+    public Gigi(Properties conf, KeyStore truststore) {
         if (instance != null) {
             throw new IllegalStateException("Multiple Gigi instances!");
         }
         instance = this;
         DatabaseConnection.init(conf);
+        this.truststore = truststore;
+        pinger = new PingerDaemon(truststore);
         pinger.start();
     }
 
@@ -80,6 +86,7 @@ public class Gigi extends HttpServlet {
             putPage("/error", new PageNotFound(), null);
             putPage("/login", new LoginPage("CAcert - Login"), "Join CAcert.org");
             putPage("/", new MainPage("CAcert - Home"), null);
+            putPage("/roots", new RootCertPage(truststore), "Join CAcert.org");
             putPage(ChangePasswordPage.PATH, new ChangePasswordPage(), "My Account");
             putPage(LogoutPage.PATH, new LogoutPage("Logout"), "My Account");
             putPage("/secure", new TestSecure(), null);
@@ -126,18 +133,40 @@ public class Gigi extends HttpServlet {
 
     }
 
+    private static String staticTemplateVarHttp;
+
+    private static String staticTemplateVarHttps;
+
+    private static String getStaticTemplateVar(boolean https) {
+        if (https) {
+            if (staticTemplateVarHttps == null) {
+                staticTemplateVarHttps = "https://" + ServerConstants.getStaticHostNamePortSecure();
+            }
+            return staticTemplateVarHttps;
+        } else {
+            if (staticTemplateVarHttp == null) {
+                staticTemplateVarHttp = "http://" + ServerConstants.getStaticHostNamePort();
+            }
+            return staticTemplateVarHttp;
+        }
+    }
+
     @Override
     protected void service(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
-        addXSSHeaders(resp);
+        boolean isSecure = req.getServerPort() == ServerConstants.getSecurePort();
+        addXSSHeaders(resp, isSecure);
         // if (req.getHeader("Origin") != null) {
         // resp.getWriter().println("No cross domain access allowed.");
         // return;
         // }
         HttpSession hs = req.getSession();
-
         final Page p = getPage(req.getPathInfo());
-        if (p != null) {
 
+        if (p != null) {
+            if ( !isSecure && (p.needsLogin() || p instanceof LoginPage || p instanceof RegisterPage)) {
+                resp.sendRedirect("https://" + ServerConstants.getWwwHostNamePortSecure() + req.getPathInfo());
+                return;
+            }
             User currentPageUser = LoginPage.getUser(req);
             if ( !p.isPermitted(currentPageUser) && hs.getAttribute("loggedin") == null) {
                 String request = req.getPathInfo();
@@ -180,7 +209,7 @@ public class Gigi extends HttpServlet {
             vars.put(Menu.USER_VALUE, currentPageUser);
             vars.put("menu", rootMenu);
             vars.put("title", Page.getLanguage(req).getTranslation(p.getTitle()));
-            vars.put("static", ServerConstants.getStaticHostNamePort());
+            vars.put("static", getStaticTemplateVar(isSecure));
             vars.put("year", Calendar.getInstance().get(Calendar.YEAR));
             vars.put("content", content);
             baseTemplate.output(resp.getWriter(), Page.getLanguage(req), vars);
@@ -213,35 +242,60 @@ public class Gigi extends HttpServlet {
 
     }
 
-    public static void addXSSHeaders(HttpServletResponse hsr) {
-        hsr.addHeader("Access-Control-Allow-Origin", "https://" + ServerConstants.getWwwHostNamePort() + " https://" + ServerConstants.getSecureHostNamePort());
+    public static void addXSSHeaders(HttpServletResponse hsr, boolean doHttps) {
+        hsr.addHeader("Access-Control-Allow-Origin", "https://" + ServerConstants.getWwwHostNamePortSecure() + " https://" + ServerConstants.getSecureHostNamePort());
         hsr.addHeader("Access-Control-Max-Age", "60");
-
-        hsr.addHeader("Content-Security-Policy", getDefaultCSP());
+        if (doHttps) {
+            hsr.addHeader("Content-Security-Policy", getHttpsCSP());
+        } else {
+            hsr.addHeader("Content-Security-Policy", getHttpCSP());
+        }
         hsr.addHeader("Strict-Transport-Security", "max-age=31536000");
 
     }
 
-    private static String defaultCSP = null;
+    private static String httpsCSP = null;
+
+    private static String httpCSP = null;
 
-    private static String getDefaultCSP() {
-        if (defaultCSP == null) {
+    private static String getHttpsCSP() {
+        if (httpsCSP == null) {
             StringBuffer csp = new StringBuffer();
-            csp.append("default-src 'none';");
-            csp.append("font-src https://" + ServerConstants.getStaticHostNamePort());
-            csp.append(";img-src https://" + ServerConstants.getStaticHostNamePort());
-            csp.append(";media-src 'none'; object-src 'none';");
-            csp.append("script-src https://" + ServerConstants.getStaticHostNamePort());
-            csp.append(";style-src https://" + ServerConstants.getStaticHostNamePort());
+            csp.append("default-src 'none'");
+            csp.append(";font-src https://" + ServerConstants.getStaticHostNamePortSecure());
+            csp.append(";img-src https://" + ServerConstants.getStaticHostNamePortSecure());
+            csp.append(";media-src 'none'; object-src 'none'");
+            csp.append(";script-src https://" + ServerConstants.getStaticHostNamePortSecure());
+            csp.append(";style-src https://" + ServerConstants.getStaticHostNamePortSecure());
+            csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePortSecure());
+            csp.append(";report-url https://api.cacert.org/security/csp/report");
+            httpsCSP = csp.toString();
+        }
+        return httpsCSP;
+    }
+
+    private static String getHttpCSP() {
+        if (httpCSP == null) {
+            StringBuffer csp = new StringBuffer();
+            csp.append("default-src 'none'");
+            csp.append(";font-src http://" + ServerConstants.getStaticHostNamePort());
+            csp.append(";img-src http://" + ServerConstants.getStaticHostNamePort());
+            csp.append(";media-src 'none'; object-src 'none'");
+            csp.append(";script-src http://" + ServerConstants.getStaticHostNamePort());
+            csp.append(";style-src http://" + ServerConstants.getStaticHostNamePort());
             csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://" + ServerConstants.getWwwHostNamePort());
-            csp.append("report-url https://api.cacert.org/security/csp/report");
-            defaultCSP = csp.toString();
+            csp.append(";report-url http://api.cacert.org/security/csp/report");
+            httpCSP = csp.toString();
         }
-        return defaultCSP;
+        return httpCSP;
     }
 
     public static String getPathByPage(Page p) {
         return instance.reveresePages.get(p).replaceFirst("/?\\*$", "");
     }
 
+    public static void notifyPinger() {
+        instance.pinger.interrupt();
+    }
+
 }