From d0b9305527ebb160decee391df1d189988b09655 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Felix=20D=C3=B6rre?= <felix@dogcraft.de>
Date: Sat, 21 Jun 2014 19:57:09 +0200
Subject: [PATCH] Adding password checking against Database

---
 src/org/cacert/gigi/Gigi.java              | 33 +++++++++++++++++-----
 src/org/cacert/gigi/User.java              | 14 +++++++++
 src/org/cacert/gigi/util/PasswordHash.java | 26 +++++++++++++++++
 3 files changed, 66 insertions(+), 7 deletions(-)
 create mode 100644 src/org/cacert/gigi/User.java
 create mode 100644 src/org/cacert/gigi/util/PasswordHash.java

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 0cf0c62c..29ed65c4 100644
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -6,6 +6,9 @@ import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.security.cert.X509Certificate;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
 import java.util.Calendar;
 import java.util.HashMap;
 
@@ -15,12 +18,16 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
+import org.cacert.gigi.database.DatabaseConnection;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
+import org.cacert.gigi.util.PasswordHash;
 import org.eclipse.jetty.util.log.Log;
 
 public class Gigi extends HttpServlet {
+	public static final String LOGGEDIN = "loggedin";
+	public static final String USER = "user";
 	private static final long serialVersionUID = -6386785421902852904L;
 	private String[] baseTemplate;
 	private HashMap<String, Page> pages = new HashMap<String, Page>();
@@ -51,7 +58,7 @@ public class Gigi extends HttpServlet {
 		X509Certificate[] cert = (X509Certificate[]) req
 				.getAttribute("javax.servlet.request.X509Certificate");
 		HttpSession hs = req.getSession(false);
-		if (hs == null || !((Boolean) hs.getAttribute("loggedin"))) {
+		if (hs == null || !((Boolean) hs.getAttribute(LOGGEDIN))) {
 			if (cert != null) {
 				tryAuthWithCertificate(req, cert[0]);
 				hs = req.getSession(false);
@@ -70,7 +77,7 @@ public class Gigi extends HttpServlet {
 		}
 		if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
 			if (hs != null) {
-				hs.setAttribute("loggedin", false);
+				hs.setAttribute(LOGGEDIN, false);
 				hs.invalidate();
 			}
 			resp.sendRedirect("/");
@@ -108,15 +115,27 @@ public class Gigi extends HttpServlet {
 	private void authWithUnpw(HttpServletRequest req) {
 		String un = req.getParameter("username");
 		String pw = req.getParameter("password");
-		// TODO dummy password check if (un.equals(pw)) {
-		HttpSession hs = req.getSession();
-		hs.setAttribute("loggedin", true);
+		try {
+			PreparedStatement ps = DatabaseConnection.getInstance().prepare(
+					"SELECT `password`, `id` FROM `users` WHERE `email`=?");
+			ps.setString(1, un);
+			ResultSet rs = ps.executeQuery();
+			if (rs.next()) {
+				if (PasswordHash.verifyHash(pw, rs.getString(1))) {
+					HttpSession hs = req.getSession();
+					hs.setAttribute(LOGGEDIN, true);
+					hs.setAttribute(USER, new User(rs.getInt(2)));
+				}
+			}
+			rs.close();
+		} catch (SQLException e) {
+			e.printStackTrace();
+		}
 	}
-
 	private void tryAuthWithCertificate(HttpServletRequest req,
 			X509Certificate x509Certificate) {
 		// TODO ckeck if certificate is valid
 		HttpSession hs = req.getSession();
-		hs.setAttribute("loggedin", true);
+		hs.setAttribute(LOGGEDIN, true);
 	}
 }
diff --git a/src/org/cacert/gigi/User.java b/src/org/cacert/gigi/User.java
new file mode 100644
index 00000000..4e366ba5
--- /dev/null
+++ b/src/org/cacert/gigi/User.java
@@ -0,0 +1,14 @@
+package org.cacert.gigi;
+
+public class User {
+
+	private int id;
+
+	public User(int id) {
+		this.id = id;
+	}
+	public int getId() {
+		return id;
+	}
+
+}
diff --git a/src/org/cacert/gigi/util/PasswordHash.java b/src/org/cacert/gigi/util/PasswordHash.java
new file mode 100644
index 00000000..1baf1370
--- /dev/null
+++ b/src/org/cacert/gigi/util/PasswordHash.java
@@ -0,0 +1,26 @@
+package org.cacert.gigi.util;
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class PasswordHash {
+	public static boolean verifyHash(String password, String hash) {
+		String newhash = sha1(password);
+		return newhash.equals(hash);
+	}
+
+	private static String sha1(String password) {
+		try {
+			MessageDigest md = MessageDigest.getInstance("SHA1");
+			byte[] digest = md.digest(password.getBytes());
+			StringBuffer res = new StringBuffer(digest.length * 2);
+			for (int i = 0; i < digest.length; i++) {
+				res.append(Integer.toHexString((digest[i] & 0xF0) >> 4));
+				res.append(Integer.toHexString(digest[i] & 0xF));
+			}
+			return res.toString();
+		} catch (NoSuchAlgorithmException e) {
+			throw new Error(e);
+		}
+	}
+}
-- 
2.39.2