X-Git-Url: https://code.wpia.club/?p=gigi.git;a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2Fpages%2Fwot%2FAssurePage.java;h=c29b2388cd83a13e7cabd63fe9b6142b08df0603;hp=f553793e5d3d4ebd47d1e0e1cc9ff5d557f0a942;hb=17a15662212d973d12ed4cea3f5eaa9c0d1169ed;hpb=086118bb498331de19b4d8d55caa59e0efd41402 diff --git a/src/org/cacert/gigi/pages/wot/AssurePage.java b/src/org/cacert/gigi/pages/wot/AssurePage.java index f553793e..c29b2388 100644 --- a/src/org/cacert/gigi/pages/wot/AssurePage.java +++ b/src/org/cacert/gigi/pages/wot/AssurePage.java @@ -1,145 +1,98 @@ package org.cacert.gigi.pages.wot; import java.io.IOException; -import java.io.InputStreamReader; import java.io.PrintWriter; -import java.sql.PreparedStatement; -import java.sql.ResultSet; -import java.sql.SQLException; import java.util.HashMap; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import org.cacert.gigi.User; -import org.cacert.gigi.database.DatabaseConnection; +import org.cacert.gigi.GigiApiException; +import org.cacert.gigi.database.GigiPreparedStatement; +import org.cacert.gigi.database.GigiResultSet; +import org.cacert.gigi.dbObjects.User; import org.cacert.gigi.output.DateSelector; -import org.cacert.gigi.output.Template; -import org.cacert.gigi.output.Form.CSRFError; -import org.cacert.gigi.pages.LoginPage; +import org.cacert.gigi.output.template.Form; +import org.cacert.gigi.output.template.Template; import org.cacert.gigi.pages.Page; -import org.cacert.gigi.util.Notary; -import org.cacert.gigi.util.Notary.AssuranceResult; +import org.cacert.gigi.util.AuthorizationContext; +import org.cacert.gigi.util.HTMLEncoder; public class AssurePage extends Page { - public static final String PATH = "/wot/assure"; - public static final String SESSION = "/wot/assure/FORM"; - DateSelector ds = new DateSelector("day", "month", "year"); - Template t; - - public AssurePage() { - super("Assure someone"); - t = new Template(new InputStreamReader( - AssuranceForm.class.getResourceAsStream("AssureeSearch.templ"))); - - } - - @Override - public void doGet(HttpServletRequest req, HttpServletResponse resp) - throws IOException { - - PrintWriter out = resp.getWriter(); - String pi = req.getPathInfo().substring(PATH.length()); - if (pi.length() > 1) { - User myself = LoginPage.getUser(req); - int mid = Integer.parseInt(pi.substring(1)); - AssuranceResult check = Notary.checkAssuranceIsPossible(myself, - new User(mid)); - if (check != AssuranceResult.ASSURANCE_SUCCEDED) { - out.println(translate(req, check.getMessage())); - return; - } - HttpSession hs = req.getSession(); - AssuranceForm form = (AssuranceForm) hs.getAttribute(SESSION); - if (form == null || form.assuree.getId() != mid) { - form = new AssuranceForm(mid); - hs.setAttribute(SESSION, form); - } - - form.output(out, getLanguage(req), new HashMap());; - } else { - HashMap vars = new HashMap(); - vars.put("DoB", ds); - t.output(out, getLanguage(req), vars); - } - } - @Override - public void doPost(HttpServletRequest req, HttpServletResponse resp) - throws IOException { - PrintWriter out = resp.getWriter(); - String pi = req.getPathInfo().substring(PATH.length()); - if (pi.length() > 1) { - User myself = LoginPage.getUser(req); - int mid = Integer.parseInt(pi.substring(1)); - if (mid == myself.getId()) { - out.println("Cannot assure myself."); - return; - } - - AssuranceForm form = (AssuranceForm) req.getSession().getAttribute( - SESSION); - if (form == null) { - out.println("No form found. This is an Error. Fill in the form again."); - return; - } - try { - form.submit(out, req); - } catch (CSRFError e) { - resp.sendError(500, "CSRF Failed"); - out.println(translate(req, "CSRF Token failed.")); - } - - return; - } - - System.out.println("searching for"); - ResultSet rs = null; - try { - PreparedStatement ps = DatabaseConnection - .getInstance() - .prepare( - "SELECT id, verified FROM users WHERE email=? AND dob=? AND deleted=0"); - ps.setString(1, req.getParameter("email")); - String day = req.getParameter("year") + "-" - + req.getParameter("month") + "-" + req.getParameter("day"); - ps.setString(2, day); - rs = ps.executeQuery(); - int id = 0; - if (rs.next()) { - id = rs.getInt(1); - int verified = rs.getInt(2); - if (rs.next()) { - out.println("Error, ambigous user. Please contact support@cacert.org."); - } else { - if (verified == 0) { - out.println(translate(req, - "User is not yet verified. Please try again in 24 hours!")); - } - resp.sendRedirect(PATH + "/" + id); - } - } else { - out.print("
"); - - out.println(translate( - req, - "I'm sorry, there was no email and date of birth matching" - + " what you entered in the system. Please double check" - + " your information.")); - out.print("
"); - } - - rs.close(); - } catch (SQLException e) { - e.printStackTrace(); - } finally { - try { - if (rs != null) { - rs.close(); - } - } catch (SQLException e) { - e.printStackTrace(); - } - } - } + + public static final String PATH = "/wot/assure"; + + DateSelector ds = new DateSelector("day", "month", "year"); + + private static final Template t = new Template(AssuranceForm.class.getResource("AssureeSearch.templ")); + + public AssurePage() { + super("Verify someone"); + + } + + @Override + public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException { + + PrintWriter out = resp.getWriter(); + HashMap vars = new HashMap(); + vars.put("DoB", ds); + t.output(out, getLanguage(req), vars); + } + + @Override + public boolean isPermitted(AuthorizationContext ac) { + return ac != null && ac.canAssure(); + } + + @Override + public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException { + PrintWriter out = resp.getWriter(); + if (req.getParameter("search") == null) { + AssuranceForm form = Form.getForm(req, AssuranceForm.class); + if (form.submitProtected(out, req)) { + if (form.isWithPasswordReset()) { + resp.getWriter().println(HTMLEncoder.encodeHTML(translate(req, "Password reset successful."))); + } + out.println(translate(req, "Verification complete.")); + return; + } + return; + } + + try (GigiPreparedStatement ps = new GigiPreparedStatement("SELECT `users`.`id`, `verified` FROM `users` INNER JOIN `certOwners` ON `certOwners`.`id`=`users`.`id` WHERE `email`=? AND `dob`=? AND `deleted` IS NULL")) { + ds.update(req); + + ps.setString(1, req.getParameter("email")); + ps.setDate(2, ds.getDate().toSQLDate()); + GigiResultSet rs = ps.executeQuery(); + int id = 0; + if (rs.next()) { + id = rs.getInt(1); + boolean verified = rs.getBoolean(2); + if (rs.next()) { + out.println("Error, ambigous user. Please contact support@cacert.org."); + } else { + if ( !verified) { + out.println(translate(req, "User is not yet verified. Please try again in 24 hours!")); + } else if (getUser(req).getId() == id) { + + } else { + User assuree = User.getById(id); + try { + new AssuranceForm(req, assuree).output(out, getLanguage(req), new HashMap()); + } catch (GigiApiException e) { + e.format(out, Page.getLanguage(req)); + } + } + } + } else { + throw new GigiApiException("I'm sorry, there was no email and date of birth matching" // + + " what you entered in the system. Please double check your information."); + } + + } catch (GigiApiException e) { + e.format(out, getLanguage(req)); + } + } }