X-Git-Url: https://code.wpia.club/?p=gigi.git;a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2FGigi.java;h=bdd0e9cd2a8ca7a53ba25145cdd6af4b12300308;hp=1b730f29568cb3e1cd67532816df35d5a72b8355;hb=42495354baad719d52d1e126f7e3d778e42a3e51;hpb=f00a29a230689e952d413818073fff0644e04786 diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java index 1b730f29..bdd0e9cd 100644 --- a/src/org/cacert/gigi/Gigi.java +++ b/src/org/cacert/gigi/Gigi.java @@ -1,8 +1,12 @@ package org.cacert.gigi; import java.io.IOException; -import java.security.cert.X509Certificate; +import java.io.InputStreamReader; +import java.io.PrintWriter; +import java.util.Calendar; import java.util.HashMap; +import java.util.Map; +import java.util.Properties; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; @@ -10,78 +14,175 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; +import org.cacert.gigi.database.DatabaseConnection; +import org.cacert.gigi.email.EmailProvider; +import org.cacert.gigi.output.Menu; +import org.cacert.gigi.output.MenuItem; +import org.cacert.gigi.output.Outputable; +import org.cacert.gigi.output.Template; import org.cacert.gigi.pages.LoginPage; import org.cacert.gigi.pages.MainPage; +import org.cacert.gigi.pages.Page; +import org.cacert.gigi.pages.TestSecure; +import org.cacert.gigi.pages.Verify; +import org.cacert.gigi.pages.account.MailAdd; +import org.cacert.gigi.pages.account.MailCertificates; +import org.cacert.gigi.pages.account.MailOverview; +import org.cacert.gigi.pages.account.MyDetails; +import org.cacert.gigi.pages.main.RegisterPage; +import org.cacert.gigi.pages.wot.AssurePage; +import org.cacert.gigi.util.ServerConstants; public class Gigi extends HttpServlet { + public static final String LOGGEDIN = "loggedin"; + public static final String USER = "user"; + private static final long serialVersionUID = -6386785421902852904L; + private Template baseTemplate; private HashMap pages = new HashMap(); + Menu m; + public Gigi(Properties conf) { + EmailProvider.init(conf); + DatabaseConnection.init(conf); + } @Override public void init() throws ServletException { - pages.put("/login", new LoginPage()); - pages.put("/", new MainPage()); + pages.put("/login", new LoginPage("CACert - Login")); + pages.put("/", new MainPage("CACert - Home")); + pages.put("/secure", new TestSecure()); + pages.put(Verify.PATH, new Verify()); + pages.put(AssurePage.PATH + "/*", new AssurePage()); + pages.put(MailCertificates.PATH, new MailCertificates()); + pages.put(MyDetails.PATH, new MyDetails()); + pages.put(RegisterPage.PATH, new RegisterPage()); + pages.put(MailOverview.DEFAULT_PATH, new MailOverview( + "My email addresses")); + pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email")); + baseTemplate = new Template(new InputStreamReader( + Gigi.class.getResourceAsStream("Gigi.templ"))); + m = new Menu("Certificates", "cert", new MenuItem( + MailOverview.DEFAULT_PATH, "Emails"), new MenuItem("", + "Client Certificates"), new MenuItem("", "Domains"), + new MenuItem("", "Server Certificates")); super.init(); - } + } @Override - protected void service(HttpServletRequest req, HttpServletResponse resp) - throws ServletException, IOException { - X509Certificate[] cert = (X509Certificate[]) req - .getAttribute("javax.servlet.request.X509Certificate"); - HttpSession hs = req.getSession(false); - if (hs == null || !((Boolean) hs.getAttribute("loggedin"))) { - if (cert != null) { - tryAuthWithCertificate(req, cert[0]); - hs = req.getSession(false); - } - } - if (hs != null && ((Boolean) hs.getAttribute("loggedin")) - && req.getPathInfo().equals("/login")) { - resp.sendRedirect("/"); - return; - } - if (req.getMethod().equals("POST") && req.getPathInfo() != null - && req.getPathInfo().equals("/login")) { - authWithUnpw(req); - resp.sendRedirect("/"); + protected void service(final HttpServletRequest req, + final HttpServletResponse resp) throws ServletException, + IOException { + addXSSHeaders(resp); + if (req.getHeader("Origin") != null) { + resp.getWriter().println("No cross domain access allowed."); return; } + HttpSession hs = req.getSession(); if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) { if (hs != null) { - hs.setAttribute("loggedin", false); + hs.setAttribute(LOGGEDIN, null); hs.invalidate(); } resp.sendRedirect("/"); return; } - if ((hs == null || !((Boolean) hs.getAttribute("loggedin"))) - && !"/login".equals(req.getPathInfo())) { - System.out.println(req.getPathInfo()); - resp.sendRedirect("/login"); - return; - } - if (pages.containsKey(req.getPathInfo())) { - Page p = pages.get(req.getPathInfo()); - p.doGet(req, resp); + final Page p = getPage(req.getPathInfo()); + if (p != null) { + + if (p.needsLogin() && hs.getAttribute("loggedin") == null) { + String request = req.getPathInfo(); + request = request.split("\\?")[0]; + hs.setAttribute(LoginPage.LOGIN_RETURNPATH, request); + resp.sendRedirect("/login"); + return; + } + if (p.beforeTemplate(req, resp)) { + return; + } + HashMap vars = new HashMap(); + + resp.setContentType("text/html; charset=utf-8"); + Outputable content = new Outputable() { + + @Override + public void output(PrintWriter out, Language l, + Map vars) { + try { + if (req.getMethod().equals("POST")) { + p.doPost(req, resp); + } else { + p.doGet(req, resp); + } + } catch (IOException e) { + e.printStackTrace(); + } + + } + }; + vars.put("menu", m); + vars.put("title", p.getTitle()); + vars.put("static", ServerConstants.getStaticHostNamePort()); + vars.put("year", Calendar.getInstance().get(Calendar.YEAR)); + vars.put("content", content); + baseTemplate.output(resp.getWriter(), Page.getLanguage(req), vars); } else { resp.sendError(404, "Page not found."); } } + private Page getPage(String pathInfo) { + if (pathInfo.endsWith("/") && !pathInfo.equals("/")) { + pathInfo = pathInfo.substring(0, pathInfo.length() - 1); + } + Page page = pages.get(pathInfo); + if (page != null) { + return page; + } + page = pages.get(pathInfo + "/*"); + if (page != null) { + return page; + } + int idx = pathInfo.lastIndexOf('/'); + pathInfo = pathInfo.substring(0, idx); + + page = pages.get(pathInfo + "/*"); + if (page != null) { + return page; + } + return null; - private void authWithUnpw(HttpServletRequest req) { - String un = req.getParameter("username"); - String pw = req.getParameter("password"); - // TODO dummy password check if (un.equals(pw)) { - HttpSession hs = req.getSession(); - hs.setAttribute("loggedin", true); } - private void tryAuthWithCertificate(HttpServletRequest req, - X509Certificate x509Certificate) { - // TODO ckeck if certificate is valid - HttpSession hs = req.getSession(); - hs.setAttribute("loggedin", true); + public static void addXSSHeaders(HttpServletResponse hsr) { + hsr.addHeader("Access-Control-Allow-Origin", "https://" + + ServerConstants.getWwwHostNamePort() + " https://" + + ServerConstants.getSecureHostNamePort()); + hsr.addHeader("Access-Control-Max-Age", "60"); + + hsr.addHeader("Content-Security-Policy", getDefaultCSP()); + hsr.addHeader("Strict-Transport-Security", "max-age=31536000"); + + } + private static String defaultCSP = null; + private static String getDefaultCSP() { + if (defaultCSP == null) { + StringBuffer csp = new StringBuffer(); + csp.append("default-src 'none';"); + csp.append("font-src https://" + + ServerConstants.getStaticHostNamePort()); + csp.append(";img-src https://" + + ServerConstants.getStaticHostNamePort()); + csp.append(";media-src 'none'; object-src 'none';"); + csp.append("script-src https://" + + ServerConstants.getStaticHostNamePort()); + csp.append(";style-src https://" + + ServerConstants.getStaticHostNamePort()); + csp.append(";form-action https://" + + ServerConstants.getSecureHostNamePort() + " https://" + + ServerConstants.getWwwHostNamePort()); + csp.append("report-url https://api.cacert.org/security/csp/report"); + defaultCSP = csp.toString(); + } + return defaultCSP; } }