Index: /main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/Authentication.java
===================================================================
--- /main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/Authentication.java	(revision 32450)
+++ /main/trunk/greenstone3/src/java/org/greenstone/gsdl3/service/Authentication.java	(revision 32451)
@@ -47,11 +47,12 @@
 	//Error codes
 	protected static final int NO_ERROR = 0;
-	protected static final int ERROR_NOT_LOGGED_IN = -2;
-	protected static final int ERROR_ADMIN_NOT_LOGGED_IN = -3;
-	protected static final int ERROR_COULD_NOT_GET_USER_INFO = -4;
-	protected static final int ERROR_USERNAME_NOT_SPECIFIED = -5;
-	protected static final int ERROR_USER_NOT_FOUND = -6;
-	protected static final int ERROR_SQL_EXCEPTION = -7;
-	protected static final int ERROR_INVALID_USERNAME = -8;
+	protected static final int ERROR_NOT_LOGGED_IN = -1;
+	protected static final int ERROR_ADMIN_NOT_LOGGED_IN = -2;
+	protected static final int ERROR_COULD_NOT_GET_USER_INFO = -3;
+	protected static final int ERROR_USERNAME_NOT_SPECIFIED = -4;
+	protected static final int ERROR_USER_NOT_FOUND = -5;
+	protected static final int ERROR_USER_NOT_AUTHORISED = -6;
+	protected static final int ERROR_INVALID_USERNAME = -7;
+	protected static final int ERROR_USER_ALREADY_EXISTS = -8;
 	protected static final int ERROR_PASSWORD_NOT_ENTERED = -9;
 	protected static final int ERROR_PASSWORD_TOO_SHORT = -10;
@@ -59,12 +60,11 @@
 	protected static final int ERROR_PASSWORD_USES_ILLEGAL_CHARACTERS = -12;
 	protected static final int ERROR_INCORRECT_PASSWORD = -13;
-	protected static final int ERROR_USER_ALREADY_EXISTS = -14;
-	protected static final int ERROR_ADDING_USER = -15;
-	protected static final int ERROR_REMOVING_USER = -16;
-	protected static final int ERROR_CAPTCHA_FAILED = -17;
-	protected static final int ERROR_CAPTCHA_MISSING = -18;
-	protected static final int ERROR_NOT_AUTHORISED = -19;
-  	protected static final int ERROR_MISSING_PARAMS = -20;
-  protected static final int ERROR_SOMETHING_WRONG = -21;
+	protected static final int ERROR_ADDING_USER = -14;
+	protected static final int ERROR_REMOVING_USER = -15;
+	protected static final int ERROR_CAPTCHA_FAILED = -16;
+	protected static final int ERROR_CAPTCHA_MISSING = -17;
+  protected static final int ERROR_CONNECTION_FAILED = -18;
+  protected static final int ERROR_MISSING_PARAMS = -19;
+  protected static final int ERROR_SOMETHING_WRONG = -20;
   
 	protected static final HashMap<Integer, String> _errorKeyMap;
@@ -78,6 +78,7 @@
 		errorKeyMap.put(ERROR_USERNAME_NOT_SPECIFIED, "auth.error.username_not_specified");
 		errorKeyMap.put(ERROR_USER_NOT_FOUND, "auth.error.user_not_found");
-		errorKeyMap.put(ERROR_SQL_EXCEPTION, "auth.error.sql_exception");
+		errorKeyMap.put(ERROR_USER_NOT_AUTHORISED, "auth.error.not_authorised");
 		errorKeyMap.put(ERROR_INVALID_USERNAME, "auth.error.invalid_username");
+		errorKeyMap.put(ERROR_USER_ALREADY_EXISTS, "auth.error.user_already_exists");
 		errorKeyMap.put(ERROR_PASSWORD_NOT_ENTERED, "auth.error.no_password");
 		errorKeyMap.put(ERROR_PASSWORD_TOO_SHORT, "auth.error.password_too_short");
@@ -85,10 +86,10 @@
 		errorKeyMap.put(ERROR_PASSWORD_USES_ILLEGAL_CHARACTERS, "auth.error.password_illegal_chars");
 		errorKeyMap.put(ERROR_INCORRECT_PASSWORD, "auth.error.incorrect_password");
-		errorKeyMap.put(ERROR_USER_ALREADY_EXISTS, "auth.error.user_already_exists");
 		errorKeyMap.put(ERROR_ADDING_USER, "auth.error.add_user_error");
 		errorKeyMap.put(ERROR_REMOVING_USER, "auth.error.remove_user_error");
 		errorKeyMap.put(ERROR_CAPTCHA_FAILED, "auth.error.captcha_failed");
 		errorKeyMap.put(ERROR_CAPTCHA_MISSING, "auth.error.captcha_missing");
-		errorKeyMap.put(ERROR_NOT_AUTHORISED, "auth.error.not_authorised");
+		errorKeyMap.put(ERROR_CONNECTION_FAILED, "auth.error.connection_failed");
+		
 		errorKeyMap.put(ERROR_MISSING_PARAMS, "auth.error.missing_params"); // ???
 		errorKeyMap.put(ERROR_SOMETHING_WRONG, "auth.error.something_wrong");
@@ -155,21 +156,31 @@
    protected static final String SECRET_KEY = "secret_key";
   protected static final String OPERATIONS = "operations";
-protected static final String OPERATION = "operation";
+  protected static final String OPERATION = "operation";
+  protected static final String USERNAME = "username";
+  protected static final String PASSWORD = "password";
+  protected static final String COLLECTION = "collection";
+  protected static final String GROUPS = "groups";
+  protected static final String STATUS = "status";
+  protected static final String RECAPTCHA_KEY = "recaptcha_key";
+  protected static final String COMMENT = "comment";
+  protected static final String EMAIL = "email";
   
-  protected static final String USERNAME = "username";
-  protected static final String PREV_USERNAME = "prevUsername";
-  protected static final String NEW_USERNAME = "newUsername";
-  protected static final String PASSWORD = "password";
-  protected static final String OLD_PASSWORD = "oldPassword";
-  protected static final String NEW_PASSWORD = "newPassword";
-
-  protected static final String GROUPS = "groups";
-  protected static final String ENABLED = "enabled";
-  protected static final String COMMENT = "comment";
-  protected static final String STATUS = "status";
-  protected static final String EMAIL = "email";
-  protected static final String NEW_EMAIL = "newEmail";
-  protected static final String ACCOUNT_STATUS = "accountstatus";
-  protected static final String EDIT_ENABLED = "editEnabled";
+  // cgi params
+  protected static final String USERNAME_PARAM = "username";
+  protected static final String PREV_USERNAME_PARAM = "prevUsername";
+  protected static final String NEW_USERNAME_PARAM = "newUsername";
+  protected static final String PASSWORD_PARAM = "password";
+  protected static final String OLD_PASSWORD_PARAM = "oldPassword";
+  protected static final String NEW_PASSWORD_PARAM = "newPassword";
+  protected static final String GROUPS_PARAM = "groups";
+  protected static final String ENABLED_PARAM = "enabled";
+  protected static final String COMMENT_PARAM = "comment";
+  protected static final String STATUS_PARAM = "status";
+  protected static final String EMAIL_PARAM = "email";
+  protected static final String NEW_EMAIL_PARAM = "newEmail";
+  protected static final String ACCOUNT_STATUS_PARAM = "accountstatus";
+  protected static final String EDIT_ENABLED_PARAM = "editEnabled";
+  protected static final String AUTHPAGE_PARAM = "authpage";
+  protected static final String RECAPTCHA_RESPONSE_PARAM = "g-recaptcha-response";
   
 	protected String _recaptchaSiteKey = null;
@@ -267,5 +278,13 @@
 		  _recaptchaOpList = null;
 		}
-		  
+
+		// while all of our params are "not saved" for the session, a few of them are also sensitive, so should not be listed in the page response XML
+		this.sensitive_params.add(PASSWORD_PARAM);
+		this.sensitive_params.add(NEW_PASSWORD_PARAM);
+		this.sensitive_params.add(OLD_PASSWORD_PARAM);
+		this.sensitive_params.add(RECAPTCHA_RESPONSE_PARAM);
+
+
+		
 		return true;
 	}
@@ -345,6 +364,6 @@
 		HashMap<String, Serializable> params = GSXML.extractParams(paramList, true);
 
-		String username = (String) params.get(USERNAME);
-		String editMode = (String) params.get(ENABLED);
+		String username = (String) params.get(USERNAME_PARAM);
+		String editMode = (String) params.get(ENABLED_PARAM);
 
 		if (!editMode.toLowerCase().equals("true") && !editMode.toLowerCase().equals("false"))
@@ -381,5 +400,5 @@
 		
 		// If we're not editing a collection then the user doesn't need to be in a particular group
-		String collection = system.hasAttribute("collection") ? system.getAttribute("collection") : "";
+		String collection = system.hasAttribute(COLLECTION) ? system.getAttribute(COLLECTION) : "";
 				
 		
@@ -451,5 +470,5 @@
 		HashMap<String, Serializable> params = GSXML.extractParams(paramList, true);
 
-		String username = (String) params.get(USERNAME);
+		String username = (String) params.get(USERNAME_PARAM);
 
 		if (username == null)
@@ -476,13 +495,13 @@
 		result.appendChild(userInfoList);
 
-		Element usernameField = GSXML.createParameter(result_doc, USERNAME, userInfo.username);
-		Element passwordField = GSXML.createParameter(result_doc, PASSWORD, userInfo.password);
-		Element groupsField = GSXML.createParameter(result_doc, GROUPS, userInfo.groups);
-		Element accountStatusField = GSXML.createParameter(result_doc, ACCOUNT_STATUS, userInfo.accountstatus);
-		Element commentField = GSXML.createParameter(result_doc, COMMENT, userInfo.comment);
+		Element usernameField = GSXML.createParameter(result_doc, USERNAME_PARAM, userInfo.username);
+		Element passwordField = GSXML.createParameter(result_doc, PASSWORD_PARAM, userInfo.password);
+		Element groupsField = GSXML.createParameter(result_doc, GROUPS_PARAM, userInfo.groups);
+		Element accountStatusField = GSXML.createParameter(result_doc, ACCOUNT_STATUS_PARAM, userInfo.accountstatus);
+		Element commentField = GSXML.createParameter(result_doc, COMMENT_PARAM, userInfo.comment);
 
 		if (editEnabled != null)
 		{
-			Element editEnabledElem = GSXML.createParameter(result_doc, EDIT_ENABLED, editEnabled);
+			Element editEnabledElem = GSXML.createParameter(result_doc, EDIT_ENABLED_PARAM, editEnabled);
 			userInfoList.appendChild(editEnabledElem);
 		}
@@ -528,5 +547,5 @@
 		}
 		HashMap<String, Serializable> paramMap = GSXML.extractParams(param_list, false);
-		String op = (String) paramMap.get("authpage");
+		String op = (String) paramMap.get(AUTHPAGE_PARAM);
 		serviceNode.setAttribute(OPERATION, op);
 
@@ -546,5 +565,5 @@
 			serviceNode.setAttribute(OPERATION, LOGIN);
 			if (_recaptchaOpList != null && _recaptchaOpList.contains(LOGIN)) {
-			  serviceNode.setAttribute("recaptcha_key", _recaptchaSiteKey);
+			  serviceNode.setAttribute(RECAPTCHA_KEY, _recaptchaSiteKey);
 			}
 			GSXML.addError(result, getErrorTextString(ERROR_NOT_LOGGED_IN, lang));
@@ -557,5 +576,5 @@
 			serviceNode.setAttribute(OPERATION, LOGIN);
 			if (_recaptchaOpList != null && _recaptchaOpList.contains(LOGIN)) {
-			  serviceNode.setAttribute("recaptcha_key", _recaptchaSiteKey);
+			  serviceNode.setAttribute(RECAPTCHA_KEY, _recaptchaSiteKey);
 			}
 			GSXML.addError(result, getErrorTextString(ERROR_ADMIN_NOT_LOGGED_IN, lang));
@@ -564,5 +583,5 @@
 
 		if (_recaptchaOpList != null && _recaptchaOpList.contains(op)) {
-		  serviceNode.setAttribute("recaptcha_key", _recaptchaSiteKey);
+		  serviceNode.setAttribute(RECAPTCHA_KEY, _recaptchaSiteKey);
 		}
 		
@@ -581,13 +600,13 @@
 		if (op.equals(PERFORM_ADD))
 		{
-			String newUsername = (String) paramMap.get(USERNAME);
-			String newPassword = (String) paramMap.get(PASSWORD);
-			String newGroups = (String) paramMap.get(GROUPS);
-			String newStatus = (String) paramMap.get(STATUS);
-			String newComment = (String) paramMap.get(COMMENT);
-			String newEmail = (String) paramMap.get(EMAIL);
+			String newUsername = (String) paramMap.get(USERNAME_PARAM);
+			String newPassword = (String) paramMap.get(PASSWORD_PARAM);
+			String newGroups = (String) paramMap.get(GROUPS_PARAM);
+			String newStatus = (String) paramMap.get(STATUS_PARAM);
+			String newComment = (String) paramMap.get(COMMENT_PARAM);
+			String newEmail = (String) paramMap.get(EMAIL_PARAM);
 
 			if (_recaptchaOpList != null && _recaptchaOpList.contains(ADD_USER)) {	  
-			  serviceNode.setAttribute("recaptcha_key", _recaptchaSiteKey);
+			  serviceNode.setAttribute(RECAPTCHA_KEY, _recaptchaSiteKey);
 			}
 			//Check the given user name
@@ -635,7 +654,7 @@
 		if (op.equals(PERFORM_REGISTER))
 		{
-			String newUsername = (String) paramMap.get(USERNAME);
-			String newPassword = (String) paramMap.get(PASSWORD);
-			String newEmail = (String) paramMap.get(EMAIL);
+			String newUsername = (String) paramMap.get(USERNAME_PARAM);
+			String newPassword = (String) paramMap.get(PASSWORD_PARAM);
+			String newEmail = (String) paramMap.get(EMAIL_PARAM);
 
 			//Check the given details
@@ -650,5 +669,5 @@
 			    newPassword = hashPassword(newPassword);
 			    if (_recaptchaOpList != null && _recaptchaOpList.contains(REGISTER)) {
-			      String user_response = (String) paramMap.get("g-recaptcha-response");
+			      String user_response = (String) paramMap.get(RECAPTCHA_RESPONSE_PARAM);
 			      if ((error= verifyRecaptcha(_recaptchaSecretKey, user_response)) == NO_ERROR) {
 				error = addUser(newUsername, newPassword, "", "true", "", newEmail);
@@ -662,5 +681,5 @@
 				serviceNode.setAttribute(OPERATION, REGISTER);
 				if (_recaptchaOpList != null && _recaptchaOpList.contains(REGISTER)) {
-				  serviceNode.setAttribute("recaptcha_key", _recaptchaSiteKey);
+				  serviceNode.setAttribute(RECAPTCHA_KEY, _recaptchaSiteKey);
 				}
 				GSXML.addError(result, getErrorTextString(error, lang));
@@ -677,6 +696,6 @@
 		    parent_op = ACCOUNT_SETTINGS;
 		  }
-		  String previousUsername = (String) paramMap.get(PREV_USERNAME);
-		  String newUsername = (String) paramMap.get(NEW_USERNAME);
+		  String previousUsername = (String) paramMap.get(PREV_USERNAME_PARAM);
+		  String newUsername = (String) paramMap.get(NEW_USERNAME_PARAM);
 		  int error;
 		  // Has the user name been changed? Make sure it doesn't already exist and is a valid username
@@ -707,7 +726,7 @@
 		  String newPassword;
 		  if (op.equals(PERFORM_EDIT)) {
-		    newPassword = (String) paramMap.get(PASSWORD);
+		    newPassword = (String) paramMap.get(PASSWORD_PARAM);
 		  } else {
-		    newPassword = (String) paramMap.get(NEW_PASSWORD);
+		    newPassword = (String) paramMap.get(NEW_PASSWORD_PARAM);
 		  }
 		  if (newPassword == null) {
@@ -719,5 +738,5 @@
 		      // check that they entered their old password correctly
 		      String prevPassword = retrieveDataForUser(previousUsername, PASSWORD);
-		      String oldPassword = (String) paramMap.get(OLD_PASSWORD);
+		      String oldPassword = (String) paramMap.get(OLD_PASSWORD_PARAM);
 		      oldPassword = hashPassword(oldPassword);
 		      if (oldPassword == null || !oldPassword.equals(prevPassword)) {
@@ -743,9 +762,9 @@
 		  // are we using recaptcha for AccountSettings or EditUser?
 		  if (_recaptchaOpList != null && _recaptchaOpList.contains(parent_op)) {
-		    String user_response = (String) paramMap.get("g-recaptcha-response");
+		    String user_response = (String) paramMap.get(RECAPTCHA_RESPONSE_PARAM);
 		    if ((error= verifyRecaptcha(_recaptchaSecretKey, user_response)) != NO_ERROR) {
 		      addUserInformationToNode(previousUsername, serviceNode);
 		      serviceNode.setAttribute(OPERATION, parent_op);
-		      serviceNode.setAttribute("recaptcha_key", _recaptchaSiteKey);
+		      serviceNode.setAttribute(RECAPTCHA_KEY, _recaptchaSiteKey);
 		      GSXML.addError(result, getErrorTextString(error, lang));
 		      return result;
@@ -756,9 +775,9 @@
 		  String status = null;
 		  String comment = null;
-		  String email = (String) paramMap.get(NEW_EMAIL);
+		  String email = (String) paramMap.get(NEW_EMAIL_PARAM);
 		  if (op.equals(PERFORM_EDIT)) {
-			groups = (String) paramMap.get(GROUPS);
-			status = (String) paramMap.get(STATUS);
-			comment = (String) paramMap.get(COMMENT);
+			groups = (String) paramMap.get(GROUPS_PARAM);
+			status = (String) paramMap.get(STATUS_PARAM);
+			comment = (String) paramMap.get(COMMENT_PARAM);
 
 		  } else {
@@ -789,5 +808,5 @@
 		      serviceNode.setAttribute(OPERATION, parent_op);
 		      if (_recaptchaOpList != null && _recaptchaOpList.contains(parent_op)) {
-			serviceNode.setAttribute("recaptcha_key", _recaptchaSiteKey);
+			serviceNode.setAttribute(RECAPTCHA_KEY, _recaptchaSiteKey);
 		      }
 		      GSXML.addError(result, getTextString("auth.success.account_settings", lang));
@@ -811,7 +830,7 @@
 		{
 			serviceNode.setAttribute(OPERATION, PERFORM_CHANGE_PASSWORD);
-			String user_name = (String) paramMap.get(USERNAME);
-			String oldPassword = (String) paramMap.get(OLD_PASSWORD);
-			String newPassword = (String) paramMap.get(NEW_PASSWORD);
+			String user_name = (String) paramMap.get(USERNAME_PARAM);
+			String oldPassword = (String) paramMap.get(OLD_PASSWORD_PARAM);
+			String newPassword = (String) paramMap.get(NEW_PASSWORD_PARAM);
 			if (user_name == null || oldPassword == null || newPassword == null)
 			{
@@ -850,5 +869,5 @@
 		if (op.equals(EDIT_USER))
 		{
-			String editUsername = (String) paramMap.get(USERNAME);
+			String editUsername = (String) paramMap.get(USERNAME_PARAM);
 			int error = addUserInformationToNode(editUsername, serviceNode);
 			if (error != NO_ERROR)
@@ -860,5 +879,5 @@
 		if (op.equals(ACCOUNT_SETTINGS))
 		{
-			String editUsername = (String) paramMap.get(USERNAME);
+			String editUsername = (String) paramMap.get(USERNAME_PARAM);
 
 			if (editUsername == null)
@@ -872,5 +891,5 @@
 			{
 				serviceNode.setAttribute(OPERATION, LOGIN);
-				GSXML.addError(result, getErrorTextString(ERROR_NOT_AUTHORISED, lang));
+				GSXML.addError(result, getErrorTextString(ERROR_USER_NOT_AUTHORISED, lang));
 				return result;
 			}
@@ -884,5 +903,5 @@
 		if (op.equals(PERFORM_RESET_PASSWORD))
 		{
-			String passwordResetUser = (String) paramMap.get(USERNAME);
+			String passwordResetUser = (String) paramMap.get(USERNAME_PARAM);
 
 			String newPassword = UUID.randomUUID().toString();
@@ -898,5 +917,5 @@
 		if (op.equals(PERFORM_DELETE_USER))
 		{
-			String usernameToDelete = (String) paramMap.get(USERNAME);
+			String usernameToDelete = (String) paramMap.get(USERNAME_PARAM);
 			int error = removeUser(usernameToDelete);
 			if (error != NO_ERROR)
@@ -1011,5 +1030,5 @@
     }catch(Exception e){
       e.printStackTrace();
-      return ERROR_CAPTCHA_FAILED;
+      return ERROR_CONNECTION_FAILED;
     }
 
