X-Git-Url: https://code.wpia.club/?p=gigi.git;a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2FGigi.java;h=fa259c96c77cbf99835c8df72e374c863935bd3e;hp=348cbecbb0afe3e1a7b74f7ec677e4b129049be9;hb=d690eda36eba121aa79e4f456d5f0eb481be8b86;hpb=4913098e21bdaf37cdfb9e7b0657dcfdd3c1aedd diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java index 348cbecb..fa259c96 100644 --- a/src/org/cacert/gigi/Gigi.java +++ b/src/org/cacert/gigi/Gigi.java @@ -5,12 +5,9 @@ import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.io.InputStreamReader; -import java.security.cert.X509Certificate; -import java.sql.PreparedStatement; -import java.sql.ResultSet; -import java.sql.SQLException; import java.util.Calendar; import java.util.HashMap; +import java.util.Properties; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; @@ -19,11 +16,19 @@ import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; import org.cacert.gigi.database.DatabaseConnection; +import org.cacert.gigi.email.EmailProvider; import org.cacert.gigi.pages.LoginPage; import org.cacert.gigi.pages.MainPage; import org.cacert.gigi.pages.Page; +import org.cacert.gigi.pages.TestSecure; +import org.cacert.gigi.pages.Verify; +import org.cacert.gigi.pages.account.MailAdd; +import org.cacert.gigi.pages.account.MailCertificates; +import org.cacert.gigi.pages.account.MailOverview; +import org.cacert.gigi.pages.account.MyDetails; import org.cacert.gigi.pages.main.RegisterPage; -import org.cacert.gigi.util.PasswordHash; +import org.cacert.gigi.pages.wot.AssurePage; +import org.cacert.gigi.util.ServerConstants; import org.eclipse.jetty.util.log.Log; public class Gigi extends HttpServlet { @@ -33,18 +38,29 @@ public class Gigi extends HttpServlet { private String[] baseTemplate; private HashMap pages = new HashMap(); + public Gigi(Properties conf) { + EmailProvider.init(conf); + DatabaseConnection.init(conf); + } @Override public void init() throws ServletException { pages.put("/login", new LoginPage("CACert - Login")); pages.put("/", new MainPage("CACert - Home")); + pages.put("/secure", new TestSecure()); + pages.put(Verify.PATH, new Verify()); + pages.put(AssurePage.PATH + "/*", new AssurePage()); + pages.put(MailCertificates.PATH, new MailCertificates()); + pages.put(MyDetails.PATH, new MyDetails()); pages.put(RegisterPage.PATH, new RegisterPage()); + pages.put(MailOverview.DEFAULT_PATH, new MailOverview( + "My email addresses")); + pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email")); String templ = ""; - try { - BufferedReader reader = new BufferedReader(new InputStreamReader( - new FileInputStream(new File("templates/base.html")))); + try (BufferedReader reader = new BufferedReader(new InputStreamReader( + new FileInputStream(new File("templates/base.html"))))) { String tmp; while ((tmp = reader.readLine()) != null) { - templ += tmp; + templ += tmp + "\n"; } baseTemplate = templ.split("\\$content\\$"); } catch (Exception e) { @@ -53,30 +69,15 @@ public class Gigi extends HttpServlet { super.init(); } - @Override protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { - X509Certificate[] cert = (X509Certificate[]) req - .getAttribute("javax.servlet.request.X509Certificate"); - HttpSession hs = req.getSession(); - if (hs.getAttribute(LOGGEDIN) == null) { - if (cert != null) { - tryAuthWithCertificate(req, cert[0]); - hs = req.getSession(); - } - } - if (((Boolean) hs.getAttribute("loggedin")) - && req.getPathInfo().equals("/login")) { - resp.sendRedirect("/"); - return; - } - if (req.getMethod().equals("POST") && req.getPathInfo() != null - && req.getPathInfo().equals("/login")) { - authWithUnpw(req); - resp.sendRedirect("/"); + addXSSHeaders(resp); + if (req.getHeader("Origin") != null) { + resp.getWriter().println("No cross domain access allowed."); return; } + HttpSession hs = req.getSession(); if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) { if (hs != null) { hs.setAttribute(LOGGEDIN, null); @@ -86,22 +87,24 @@ public class Gigi extends HttpServlet { return; } - if ((hs == null || !((Boolean) hs.getAttribute("loggedin"))) - && !"/login".equals(req.getPathInfo())) { - System.out.println(req.getPathInfo()); - resp.sendRedirect("/login"); - return; - } - if (pages.containsKey(req.getPathInfo())) { + Page p = getPage(req.getPathInfo()); + if (p != null) { + + if (p.needsLogin() && hs.getAttribute("loggedin") == null) { + String request = req.getPathInfo(); + request = request.split("\\?")[0]; + hs.setAttribute(LoginPage.LOGIN_RETURNPATH, request); + resp.sendRedirect("/login"); + return; + } + if (p.beforeTemplate(req, resp)) { + return; + } + String b0 = baseTemplate[0]; - Page p = pages.get(req.getPathInfo()); b0 = makeDynTempl(b0, p); resp.setContentType("text/html; charset=utf-8"); resp.getWriter().print(b0); - if (hs != null && hs.getAttribute(LOGGEDIN) != null) { - resp.getWriter().println( - "Hi " + ((User) hs.getAttribute(USER)).getFname()); - } if (req.getMethod().equals("POST")) { p.doPost(req, resp); } else { @@ -114,6 +117,28 @@ public class Gigi extends HttpServlet { resp.sendError(404, "Page not found."); } + } + private Page getPage(String pathInfo) { + if (pathInfo.endsWith("/") && !pathInfo.equals("/")) { + pathInfo = pathInfo.substring(0, pathInfo.length() - 1); + } + Page page = pages.get(pathInfo); + if (page != null) { + return page; + } + page = pages.get(pathInfo + "/*"); + if (page != null) { + return page; + } + int idx = pathInfo.lastIndexOf('/'); + pathInfo = pathInfo.substring(0, idx); + + page = pages.get(pathInfo + "/*"); + if (page != null) { + return page; + } + return null; + } private String makeDynTempl(String in, Page p) { int year = Calendar.getInstance().get(Calendar.YEAR); @@ -121,46 +146,14 @@ public class Gigi extends HttpServlet { in = in.replaceAll("\\$year\\$", year + ""); return in; } - private void authWithUnpw(HttpServletRequest req) { - String un = req.getParameter("username"); - String pw = req.getParameter("password"); - try { - PreparedStatement ps = DatabaseConnection.getInstance().prepare( - "SELECT `password`, `id` FROM `users` WHERE `email`=?"); - ps.setString(1, un); - ResultSet rs = ps.executeQuery(); - if (rs.next()) { - if (PasswordHash.verifyHash(pw, rs.getString(1))) { - HttpSession hs = req.getSession(); - hs.setAttribute(LOGGEDIN, true); - hs.setAttribute(USER, new User(rs.getInt(2))); - } - } - rs.close(); - } catch (SQLException e) { - e.printStackTrace(); - } - } - private void tryAuthWithCertificate(HttpServletRequest req, - X509Certificate x509Certificate) { - String serial = x509Certificate.getSerialNumber().toString(16) - .toUpperCase(); - try { - PreparedStatement ps = DatabaseConnection - .getInstance() - .prepare( - "SELECT `memid` FROM `emailcerts` WHERE `serial`=? AND `disablelogin`='0' AND `revoked` = " - + "'0000-00-00 00:00:00'"); - ps.setString(1, serial); - ResultSet rs = ps.executeQuery(); - if (rs.next()) { - HttpSession hs = req.getSession(); - hs.setAttribute(LOGGEDIN, true); - hs.setAttribute(USER, new User(rs.getInt(1))); - } - rs.close(); - } catch (SQLException e) { - e.printStackTrace(); - } + public static void addXSSHeaders(HttpServletResponse hsr) { + hsr.addHeader("Access-Control-Allow-Origin", + "http://cacert.org https://localhost"); + hsr.addHeader("Access-Control-Max-Age", "60"); + hsr.addHeader("Content-Security-Policy", "default-src 'self' https://" + + ServerConstants.getStaticHostNamePort() + + " https://www.cacert.org/*;frame-ancestors 'none'"); + // ;report-uri https://felix.dogcraft.de/report.php + } }