Move initial forms into IssueCertificate form.

diff --git a/src/org/cacert/gigi/output/Form.java b/src/org/cacert/gigi/output/Form.java
index 063eb124eeaf668ac710734e622ddc82ad525f32..e5d05cb6c0e294fe80129aa19baf4e0f9c5211db 100644 (file)
--- a/src/org/cacert/gigi/output/Form.java
+++ b/src/org/cacert/gigi/output/Form.java
@@ -27,8 +27,12 @@ public abstract class Form implements Outputable {
 
     public abstract boolean submit(PrintWriter out, HttpServletRequest req);
 
+    protected String getCsrfFieldName() {
+        return CSRF_FIELD;
+    }
+
     @Override
-    public final void output(PrintWriter out, Language l, Map<String, Object> vars) {
+    public void output(PrintWriter out, Language l, Map<String, Object> vars) {
         out.println("<form method='POST' autocomplete='off'>");
         outputContent(out, l, vars);
         out.print("<input type='hidden' name='" + CSRF_FIELD + "' value='");

diff --git a/src/org/cacert/gigi/pages/account/IssueCertificateForm.java b/src/org/cacert/gigi/pages/account/IssueCertificateForm.java
index e470f21b515e9e6aa708ec9827c6c27c7eea2ba8..da57bec3a2e235244ef9b22ee5d0ee436c368468 100644 (file)
--- a/src/org/cacert/gigi/pages/account/IssueCertificateForm.java
+++ b/src/org/cacert/gigi/pages/account/IssueCertificateForm.java
@@ -25,6 +25,7 @@ import org.cacert.gigi.output.template.HashAlgorithms;
 import org.cacert.gigi.output.template.IterableDataset;
 import org.cacert.gigi.output.template.Template;
 import org.cacert.gigi.pages.LoginPage;
+import org.cacert.gigi.util.RandomToken;
 
 import sun.security.pkcs10.PKCS10;
 
@@ -44,9 +45,14 @@ public class IssueCertificateForm extends Form {
 
     private final static Template t = new Template(IssueCertificateForm.class.getResource("IssueCertificateForm.templ"));
 
+    private final static Template tIni = new Template(MailCertificateAdd.class.getResource("RequestCertificate.templ"));
+
+    String spkacChallange;
+
     public IssueCertificateForm(HttpServletRequest hsr) {
         super(hsr);
         u = LoginPage.getUser(hsr);
+        spkacChallange = RandomToken.generateToken(16);
     }
 
     Certificate result;
@@ -128,6 +134,20 @@ public class IssueCertificateForm extends Form {
         return new PKCS10(b);
     }
 
+    @Override
+    public void output(PrintWriter out, Language l, Map<String, Object> vars) {
+        if (csr == null) {
+            HashMap<String, Object> vars2 = new HashMap<String, Object>(vars);
+            vars2.put("csrf", getCSRFToken());
+            vars2.put("csrf_name", getCsrfFieldName());
+            vars2.put("spkacChallange", spkacChallange);
+            tIni.output(out, l, vars2);
+            return;
+        } else {
+            super.output(out, l, vars);
+        }
+    }
+
     @Override
     protected void outputContent(PrintWriter out, Language l, Map<String, Object> vars) {
         HashMap<String, Object> vars2 = new HashMap<String, Object>(vars);
@@ -152,5 +172,4 @@ public class IssueCertificateForm extends Form {
         vars2.put("hashs", new HashAlgorithms(selectedDigest));
         t.output(out, l, vars2);
     }
-
 }

diff --git a/src/org/cacert/gigi/pages/account/MailCertificateAdd.java b/src/org/cacert/gigi/pages/account/MailCertificateAdd.java
index 9541a5ad49c9d3db66c7082da217f75c83f1b0a2..5f281c9b3f0173c610fc63a8563ec4d9a9152b27 100644 (file)
--- a/src/org/cacert/gigi/pages/account/MailCertificateAdd.java
+++ b/src/org/cacert/gigi/pages/account/MailCertificateAdd.java
@@ -3,45 +3,34 @@ package org.cacert.gigi.pages.account;
 import java.io.IOException;
 import java.util.Collections;
 import java.util.HashMap;
+
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.cacert.gigi.Certificate;
 import org.cacert.gigi.output.Form;
-import org.cacert.gigi.output.template.Template;
 import org.cacert.gigi.pages.Page;
 
 public class MailCertificateAdd extends Page {
 
     public static final String PATH = "/account/certs/email/new";
 
-    Template t = new Template(MailCertificateAdd.class.getResource("RequestCertificate.templ"));
-
     public MailCertificateAdd() {
         super("Create Email certificate");
     }
 
     @Override
     public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
-        HashMap<String, Object> vars = new HashMap<String, Object>();
-        vars.put("CCA", "<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>");
-
-        t.output(resp.getWriter(), getLanguage(req), vars);
+        new IssueCertificateForm(req).output(resp.getWriter(), getLanguage(req), new HashMap<String, Object>());
     }
 
     @Override
     public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
-        IssueCertificateForm f;
-        if (req.getParameter(Form.CSRF_FIELD) != null) {
-            f = Form.getForm(req, IssueCertificateForm.class);
-            if (f.submit(resp.getWriter(), req)) {
-                Certificate c = f.getResult();
-                String ser = c.getSerial();
-                resp.sendRedirect(MailCertificates.PATH + "/" + ser);
-            }
-        } else {
-            f = new IssueCertificateForm(req);
-            f.submit(resp.getWriter(), req);
+        IssueCertificateForm f = Form.getForm(req, IssueCertificateForm.class);
+        if (f.submit(resp.getWriter(), req)) {
+            Certificate c = f.getResult();
+            String ser = c.getSerial();
+            resp.sendRedirect(MailCertificates.PATH + "/" + ser);
         }
         f.output(resp.getWriter(), getLanguage(req), Collections.<String,Object>emptyMap());
 

diff --git a/src/org/cacert/gigi/pages/account/RequestCertificate.templ b/src/org/cacert/gigi/pages/account/RequestCertificate.templ
index 2a3296304449f441dc1cc264e59eb5baaea9a6dc..d3a569188672009d08c651d7d7489a9f4efd2857 100644 (file)
--- a/src/org/cacert/gigi/pages/account/RequestCertificate.templ
+++ b/src/org/cacert/gigi/pages/account/RequestCertificate.templ
@@ -13,12 +13,14 @@
 
   <tr>
     <td>
-     <form method="post"> <textarea name="CSR"></textarea><br/><input type="submit" name="process" value="<?=_Next?>" /></form>
+     <form method="post"> <textarea name="CSR"></textarea><br/>
+     <input type="submit" name="process" value="<?=_Next?>" />
+     <input type='hidden' name='<?=$csrf_name?>' value='<?=$csrf?>'/></form>
     </td>
     <td align="left">
-     <form method="post"> <keygen name="SPKAC"/><br/><input type="submit" name="process" value="<?=_Next?>" /></form>
-      
-    </td>
+     <form method="post"> <keygen name="SPKAC"/><br/>
+     <input type="submit" name="process" value="<?=_Next?>" />
+     <input type='hidden' name='<?=$csrf_name?>' value='<?=$csrf?>'/></form>
   </tr>
   </tbody>
 </table>