X-Git-Url: https://code.wpia.club/?p=gigi.git;a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2FGigi.java;h=fa259c96c77cbf99835c8df72e374c863935bd3e;hp=78924e822687909511c231cfa8dd5a52417804c3;hb=d690eda36eba121aa79e4f456d5f0eb481be8b86;hpb=7cf984749cf0027ccae90a53ebef07ab97ff164b

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 78924e82..fa259c96 100644
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -22,9 +22,13 @@ import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
 import org.cacert.gigi.pages.TestSecure;
 import org.cacert.gigi.pages.Verify;
+import org.cacert.gigi.pages.account.MailAdd;
 import org.cacert.gigi.pages.account.MailCertificates;
+import org.cacert.gigi.pages.account.MailOverview;
 import org.cacert.gigi.pages.account.MyDetails;
 import org.cacert.gigi.pages.main.RegisterPage;
+import org.cacert.gigi.pages.wot.AssurePage;
+import org.cacert.gigi.util.ServerConstants;
 import org.eclipse.jetty.util.log.Log;
 
 public class Gigi extends HttpServlet {
@@ -44,15 +48,19 @@ public class Gigi extends HttpServlet {
 		pages.put("/", new MainPage("CACert - Home"));
 		pages.put("/secure", new TestSecure());
 		pages.put(Verify.PATH, new Verify());
+		pages.put(AssurePage.PATH + "/*", new AssurePage());
 		pages.put(MailCertificates.PATH, new MailCertificates());
 		pages.put(MyDetails.PATH, new MyDetails());
 		pages.put(RegisterPage.PATH, new RegisterPage());
+		pages.put(MailOverview.DEFAULT_PATH, new MailOverview(
+				"My email addresses"));
+		pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email"));
 		String templ = "";
 		try (BufferedReader reader = new BufferedReader(new InputStreamReader(
 				new FileInputStream(new File("templates/base.html"))))) {
 			String tmp;
 			while ((tmp = reader.readLine()) != null) {
-				templ += tmp;
+				templ += tmp + "\n";
 			}
 			baseTemplate = templ.split("\\$content\\$");
 		} catch (Exception e) {
@@ -64,6 +72,11 @@ public class Gigi extends HttpServlet {
 	@Override
 	protected void service(HttpServletRequest req, HttpServletResponse resp)
 			throws ServletException, IOException {
+		addXSSHeaders(resp);
+		if (req.getHeader("Origin") != null) {
+			resp.getWriter().println("No cross domain access allowed.");
+			return;
+		}
 		HttpSession hs = req.getSession();
 		if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
 			if (hs != null) {
@@ -74,8 +87,9 @@ public class Gigi extends HttpServlet {
 			return;
 		}
 
-		if (pages.containsKey(req.getPathInfo())) {
-			Page p = pages.get(req.getPathInfo());
+		Page p = getPage(req.getPathInfo());
+		if (p != null) {
+
 			if (p.needsLogin() && hs.getAttribute("loggedin") == null) {
 				String request = req.getPathInfo();
 				request = request.split("\\?")[0];
@@ -103,6 +117,28 @@ public class Gigi extends HttpServlet {
 			resp.sendError(404, "Page not found.");
 		}
 
+	}
+	private Page getPage(String pathInfo) {
+		if (pathInfo.endsWith("/") && !pathInfo.equals("/")) {
+			pathInfo = pathInfo.substring(0, pathInfo.length() - 1);
+		}
+		Page page = pages.get(pathInfo);
+		if (page != null) {
+			return page;
+		}
+		page = pages.get(pathInfo + "/*");
+		if (page != null) {
+			return page;
+		}
+		int idx = pathInfo.lastIndexOf('/');
+		pathInfo = pathInfo.substring(0, idx);
+
+		page = pages.get(pathInfo + "/*");
+		if (page != null) {
+			return page;
+		}
+		return null;
+
 	}
 	private String makeDynTempl(String in, Page p) {
 		int year = Calendar.getInstance().get(Calendar.YEAR);
@@ -110,5 +146,14 @@ public class Gigi extends HttpServlet {
 		in = in.replaceAll("\\$year\\$", year + "");
 		return in;
 	}
+	public static void addXSSHeaders(HttpServletResponse hsr) {
+		hsr.addHeader("Access-Control-Allow-Origin",
+				"http://cacert.org https://localhost");
+		hsr.addHeader("Access-Control-Max-Age", "60");
+		hsr.addHeader("Content-Security-Policy", "default-src 'self' https://"
+				+ ServerConstants.getStaticHostNamePort()
+				+ " https://www.cacert.org/*;frame-ancestors 'none'");
+		// ;report-uri https://felix.dogcraft.de/report.php
 
+	}
 }