From: Felix Dörre <felix@dogcraft.de>
Date: Tue, 3 Feb 2015 21:59:37 +0000 (+0100)
Subject: ADD: Verify, only act on POST (+CSRF)
X-Git-Url: https://code.wpia.club/?p=gigi.git;a=commitdiff_plain;h=182e0bf4bc672b3e92cbcee950383a2ad8fef7fb

ADD: Verify, only act on POST (+CSRF)
---

diff --git a/src/org/cacert/gigi/output/template/Form.java b/src/org/cacert/gigi/output/template/Form.java
index f469c21c..f330fe86 100644
--- a/src/org/cacert/gigi/output/template/Form.java
+++ b/src/org/cacert/gigi/output/template/Form.java
@@ -17,13 +17,19 @@ public abstract class Form implements Outputable {
 
     public static final String CSRF_FIELD = "csrf";
 
-    private String csrf;
+    private final String csrf;
+
+    private final String action;
 
     public Form(HttpServletRequest hsr) {
+        this(hsr, null);
+    }
+
+    public Form(HttpServletRequest hsr, String action) {
         csrf = RandomToken.generateToken(32);
+        this.action = action;
         HttpSession hs = hsr.getSession();
         hs.setAttribute("form/" + getClass().getName() + "/" + csrf, this);
-
     }
 
     public abstract boolean submit(PrintWriter out, HttpServletRequest req) throws GigiApiException;
@@ -34,7 +40,11 @@ public abstract class Form implements Outputable {
 
     @Override
     public void output(PrintWriter out, Language l, Map<String, Object> vars) {
-        out.println("<form method='POST'>");
+        if (action == null) {
+            out.println("<form method='POST'>");
+        } else {
+            out.println("<form method='POST' action='" + action + "'>");
+        }
         failed = false;
         outputContent(out, l, vars);
         out.print("<input type='hidden' name='" + CSRF_FIELD + "' value='");
diff --git a/src/org/cacert/gigi/pages/Verify.java b/src/org/cacert/gigi/pages/Verify.java
index 2ebd54c5..a1d613a7 100644
--- a/src/org/cacert/gigi/pages/Verify.java
+++ b/src/org/cacert/gigi/pages/Verify.java
@@ -2,6 +2,8 @@ package org.cacert.gigi.pages;
 
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.util.HashMap;
+import java.util.Map;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -9,9 +11,62 @@ import javax.servlet.http.HttpServletResponse;
 import org.cacert.gigi.GigiApiException;
 import org.cacert.gigi.dbObjects.Domain;
 import org.cacert.gigi.dbObjects.EmailAddress;
+import org.cacert.gigi.localisation.Language;
+import org.cacert.gigi.output.template.Form;
 
 public class Verify extends Page {
 
+    private class VerificationForm extends Form {
+
+        private String hash;
+
+        private String type;
+
+        private String id;
+
+        public VerificationForm(HttpServletRequest hsr) {
+            super(hsr, PATH);
+            hash = hsr.getParameter("hash");
+            type = hsr.getParameter("type");
+            id = hsr.getParameter("id");
+        }
+
+        @Override
+        public boolean submit(PrintWriter out, HttpServletRequest req) throws GigiApiException {
+            if ("email".equals(type)) {
+                try {
+                    EmailAddress ea = EmailAddress.getById(Integer.parseInt(id));
+                    ea.verify(hash);
+                    out.println("Email verification completed.");
+                } catch (IllegalArgumentException e) {
+                    out.println(translate(req, "The email address is invalid."));
+                } catch (GigiApiException e) {
+                    e.format(out, getLanguage(req));
+                }
+            } else if ("domain".equals(type)) {
+                try {
+                    Domain ea = Domain.getById(Integer.parseInt(id));
+                    ea.verify(hash);
+                    out.println("Domain verification completed.");
+                } catch (IllegalArgumentException e) {
+                    out.println(translate(req, "The domain address is invalid."));
+                } catch (GigiApiException e) {
+                    e.format(out, getLanguage(req));
+                }
+            }
+            return true;
+        }
+
+        @Override
+        protected void outputContent(PrintWriter out, Language l, Map<String, Object> vars) {
+            vars.put("hash", hash);
+            vars.put("id", id);
+            vars.put("type", type);
+            getDefaultTemplate().output(out, l, vars);
+        }
+
+    }
+
     public static final String PATH = "/verify";
 
     public Verify() {
@@ -24,32 +79,18 @@ public class Verify extends Page {
     }
 
     @Override
-    public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
-        PrintWriter out = resp.getWriter();
-        String hash = req.getParameter("hash");
-        String type = req.getParameter("type");
-        String id = req.getParameter("id");
-        if ("email".equals(type)) {
-            try {
-                EmailAddress ea = EmailAddress.getById(Integer.parseInt(id));
-                ea.verify(hash);
-                out.println("Email verification completed.");
-            } catch (IllegalArgumentException e) {
-                out.println(translate(req, "The email address is invalid."));
-            } catch (GigiApiException e) {
-                e.format(out, getLanguage(req));
-            }
-        } else if ("domain".equals(type)) {
-            try {
-                Domain ea = Domain.getById(Integer.parseInt(id));
-                ea.verify(hash);
-                out.println("Domain verification completed.");
-            } catch (IllegalArgumentException e) {
-                out.println(translate(req, "The domain address is invalid."));
-            } catch (GigiApiException e) {
-                e.format(out, getLanguage(req));
+    public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+        try {
+            if (Form.getForm(req, VerificationForm.class).submit(resp.getWriter(), req)) {
             }
+        } catch (GigiApiException e) {
+            e.format(resp.getWriter(), getLanguage(req));
         }
     }
 
+    @Override
+    public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+        new VerificationForm(req).output(resp.getWriter(), getLanguage(req), new HashMap<String, Object>());
+    }
+
 }
diff --git a/src/org/cacert/gigi/pages/Verify.templ b/src/org/cacert/gigi/pages/Verify.templ
new file mode 100644
index 00000000..68cfb775
--- /dev/null
+++ b/src/org/cacert/gigi/pages/Verify.templ
@@ -0,0 +1,5 @@
+<?=_Verify this element:?>
+<input type="hidden" name="hash" value="<?=$hash?>"/>
+<input type="hidden" name="type" value="<?=$type?>"/>
+<input type="hidden" name="id" value="<?=$id?>"/>
+<input type="submit" value="OK"/>
diff --git a/tests/org/cacert/gigi/ping/TestDNS.java b/tests/org/cacert/gigi/ping/TestDNS.java
index a298cdca..4f2404e9 100644
--- a/tests/org/cacert/gigi/ping/TestDNS.java
+++ b/tests/org/cacert/gigi/ping/TestDNS.java
@@ -78,8 +78,7 @@ public class TestDNS extends PingTest {
 
         TestMail mail = getMailReciever().recieve();
         if (emailVariant == 0) {
-            String link = mail.extractLink();
-            new URL(link).openConnection().getHeaderField("");
+            mail.verify();
         }
 
         waitForPings(2);
diff --git a/tests/org/cacert/gigi/ping/TestHTTP.java b/tests/org/cacert/gigi/ping/TestHTTP.java
index 64c9cd65..2cad443d 100644
--- a/tests/org/cacert/gigi/ping/TestHTTP.java
+++ b/tests/org/cacert/gigi/ping/TestHTTP.java
@@ -73,8 +73,7 @@ public class TestHTTP extends PingTest {
 
         TestMail mail = getMailReciever().recieve();
         if (emailVariant == 0) {
-            String link = mail.extractLink();
-            new URL(link).openConnection().getHeaderField("");
+            mail.verify();
         }
         waitForPings(2);
 
diff --git a/tests/org/cacert/gigi/ping/TestSSL.java b/tests/org/cacert/gigi/ping/TestSSL.java
index 610e1153..fccd97eb 100644
--- a/tests/org/cacert/gigi/ping/TestSSL.java
+++ b/tests/org/cacert/gigi/ping/TestSSL.java
@@ -121,8 +121,7 @@ public class TestSSL extends PingTest {
 
         TestMail mail = getMailReciever().recieve();
         if (emailVariant == 0) {
-            String link = mail.extractLink();
-            new URL(link).openConnection().getHeaderField("");
+            mail.verify();
         }
         waitForPings(3);
 
diff --git a/tests/org/cacert/gigi/testUtils/ManagedTest.java b/tests/org/cacert/gigi/testUtils/ManagedTest.java
index 6ca4c768..54cb21fb 100644
--- a/tests/org/cacert/gigi/testUtils/ManagedTest.java
+++ b/tests/org/cacert/gigi/testUtils/ManagedTest.java
@@ -276,11 +276,7 @@ public class ManagedTest extends ConfiguredTest {
         registerUser(firstName, lastName, email, password);
         try {
             TestMail tm = ter.recieve();
-            String verifyLink = tm.extractLink();
-            String[] parts = verifyLink.split("\\?");
-            URL u = new URL("https://" + getServerName() + "/verify?" + parts[1]);
-            u.openStream().close();
-
+            tm.verify();
             GigiPreparedStatement ps = DatabaseConnection.getInstance().prepare("SELECT id FROM users where email=?");
             ps.setString(1, email);
             GigiResultSet rs = ps.executeQuery();
@@ -329,7 +325,7 @@ public class ManagedTest extends ConfiguredTest {
         return uid;
     }
 
-    private static String stripCookie(String headerField) {
+    static String stripCookie(String headerField) {
         return headerField.substring(0, headerField.indexOf(';'));
     }
 
diff --git a/tests/org/cacert/gigi/testUtils/TestEmailReciever.java b/tests/org/cacert/gigi/testUtils/TestEmailReciever.java
index a68b1847..50e3aace 100644
--- a/tests/org/cacert/gigi/testUtils/TestEmailReciever.java
+++ b/tests/org/cacert/gigi/testUtils/TestEmailReciever.java
@@ -5,6 +5,8 @@ import java.io.DataOutputStream;
 import java.io.IOException;
 import java.net.Socket;
 import java.net.SocketAddress;
+import java.net.URL;
+import java.net.URLConnection;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import java.util.regex.Matcher;
@@ -61,6 +63,22 @@ public class TestEmailReciever extends EmailProvider implements Runnable {
             return m.group(0);
         }
 
+        public void verify() throws IOException {
+            String[] parts = extractLink().split("\\?");
+            URL u = new URL("https://" + ManagedTest.getServerName() + "/verify?" + parts[1]);
+
+            URLConnection csrfConn = u.openConnection();
+            String csrf = ManagedTest.getCSRF(csrfConn, 0);
+
+            u = new URL("https://" + ManagedTest.getServerName() + "/verify");
+            URLConnection uc = u.openConnection();
+            ManagedTest.cookie(uc, ManagedTest.stripCookie(csrfConn.getHeaderField("Set-Cookie")));
+            uc.setDoOutput(true);
+            uc.getOutputStream().write((parts[1] + "&csrf=" + csrf).getBytes());
+            uc.connect();
+            uc.getInputStream().close();
+        }
+
     }
 
     private Socket s;