Changeset 32366

Timestamp:

2018-08-23T13:37:52+12:00 (6 years ago)

Author:

kjdon

Message:

instead of blindly copying the paramList into the new pageRequest element going into the page response, look through the paramLIst/param elements - if any have SENSITIVE attribute, remove them from the list. prevent password info being stored in the page response.

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/Receptionist.java (modified) (3 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/Receptionist.java

@@ -17 +17 @@
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
+import org.w3c.dom.NamedNodeMap;
 
 /**
@@ -273 +274 @@
 
         // the request is part of the page
-        page.appendChild(GSXML.duplicateWithNewName(doc, request, GSXML.PAGE_REQUEST_ELEM, true));
+        page.appendChild(duplicateRequest(doc, request));
         // add the response too
         Element page_response = GSXML.duplicateWithNewName(doc, (Element) GSXML.getChildByTagName(action_response, GSXML.RESPONSE_ELEM), GSXML.PAGE_RESPONSE_ELEM, true);
@@ -293 +294 @@
     }
 
+  // This is pretty much a straight copy of the Element, with a new top root node name, but also, removing any NOSAVE parameters.
+  protected Element duplicateRequest(Document owner, Element request) {
+    
+    Element duplicate;
+    duplicate = owner.createElement(GSXML.PAGE_REQUEST_ELEM);
+    // Copy element attributes
+    NamedNodeMap attributes = request.getAttributes();
+    for (int i = 0; i < attributes.getLength(); i++)
+      {
+    Node attribute = attributes.item(i);
+    duplicate.setAttribute(attribute.getNodeName(), attribute.getNodeValue());
+      }
+    // Copy element children
+    NodeList children = request.getChildNodes();
+    for (int i = 0; i < children.getLength(); i++)
+      {
+    Node child = children.item(i);
+    if (child.getNodeName().equals(GSXML.PARAM_ELEM + GSXML.LIST_MODIFIER)) {
+      Element param_list = (Element)owner.importNode(child, true);
+      NodeList params = param_list.getElementsByTagName(GSXML.PARAM_ELEM);
+      for (int j=params.getLength()-1; j>=0; j--) {
+        Element p = (Element)params.item(j);
+        if (!p.getAttribute(GSXML.SENSITIVE_ATT).equals("")) {
+          logger.error("removing param "+p.getAttribute("name"));
+          param_list.removeChild(p);
+        }
+      }
+        duplicate.appendChild(param_list);
+    } else {
+      duplicate.appendChild(owner.importNode(child, true));
+    }
+      }
+      
+    
+    return duplicate;
+ 
+
+ 
+
+  }
     protected boolean setUpBaseInterface(String base_interface)
     {