Changeset 33212 for main/trunk/greenstone3

Timestamp:

2019-06-24T14:13:12+12:00 (5 years ago)

Author:

kjdon

Message:

changed how we remember who has verified. Can't store in hte session as it just gets wiped by our session caching code - as hmvf never actually makes it though to LIbraryServlet via a command line, it just ges wiped and never put back. Anyway it wasn't a good choice as anyone could just ass hmvf=1 to URL to bypass T&C. Now we store in a hashtable session id for those who have verified - accompanied by a timer which will remove the entry after 24 hours. also, renamed _logger to logger to match all other classes as its a pain to have to remember to type the _. Debug messages left in for now. TODO: remove these once tested.

File:

• main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/URLFilter.java (modified) (16 diffs)

main/trunk/greenstone3/src/java/org/greenstone/gsdl3/core/URLFilter.java

@@ -6 +6 @@
 import java.util.Arrays;
 import java.util.HashMap;
+import java.util.Hashtable;
 import java.util.Map;
 
@@ -21 +22 @@
 import javax.servlet.http.HttpServletResponse;
 
+import java.awt.event.ActionEvent;
+import java.awt.event.ActionListener;
+import javax.swing.Timer;
+
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.lang3.StringUtils;
@@ -38 +43 @@
 {
   private FilterConfig _filterConfig = null;
-  private static Logger _logger = Logger.getLogger(org.greenstone.gsdl3.core.URLFilter.class.getName());
+  private static Logger logger = Logger.getLogger(org.greenstone.gsdl3.core.URLFilter.class.getName());
 
   //Restricted URLs
@@ -72 +77 @@
   protected static final String SYSTEM_SUBACTION_DEACTIVATE = "deactivate";
 
+  // if we are showing terms and conditions to user, this remembers who has accepted already
+  protected Hashtable<String, UserTimer> verifiedUserMap = null;
+  protected static final int verifiedUserTimeout = 24 * 60 * 60 * 1000; 
+  
   public void init(FilterConfig filterConfig) throws ServletException
   {
@@ -87 +96 @@
     if (!(request instanceof HttpServletRequest)) {
       // Can this ever happen?
-      _logger.error("The request was not an HttpServletRequest");
+      logger.error("The request was not an HttpServletRequest");
       return;
     }
@@ -94 +103 @@
     HttpServletRequest hRequest = ((HttpServletRequest) request);
     HttpSession hSession = hRequest.getSession();
+    String session_id = hSession.getId();
     ServletContext context = hSession.getServletContext();
     
@@ -106 +116 @@
       return;
     }
-
+    logger.error("in do Filter: "+url);
 
     // Run security checks on files requested from a collection's index/assoc folder
@@ -125 +135 @@
                 
     if (gsRouter == null) {  
-      _logger.error("Receptionist is null, stopping filter");
+      logger.error("Receptionist is null, stopping filter");
       return;
     }
     // Sometimes we have a // before the filename - that mucks up the following code, so lets remove them
     url = url.replaceAll("//","/");
+    
     String dir = null;
     int dirStart = url.indexOf(ASSOCIATED_FILE_PATH) + ASSOCIATED_FILE_PATH.length();
@@ -205 +216 @@
                     
     Element mr_response = (Element)gsRouter.process(securityMessage);
-    _logger.debug("security response = "+XMLConverter.getPrettyString(mr_response));
+    logger.debug("security response = "+XMLConverter.getPrettyString(mr_response));
 
     boolean verifiable_file = true;
@@ -242 +253 @@
           }
       }
-    // if got here have no groups.
+    // if got here have no groups that we need to belong to
     // do we have human verify thing?
     if (verifiable_file) {
       // we are asking for the main document - lets check human verify
-                      
+      logger.error("KATH verifiable file is true");
       if (!securityResponse.getAttribute(GSXML.VERIFY_ATT).equals("")) {
         // have we done the test previously?
-        HttpSession this_session =  ((HttpServletRequest) request).getSession();
-        if (this_session == null) {
-          _logger.error("KATH session is null");
+        boolean already_verified = false;
+        if (verifiedUserMap == null) {
+          // we haven't done this at all, set up the map
+          verifiedUserMap = new Hashtable<String, UserTimer>();
+          logger.error("KATH setting up new user map");
         } else {
-          _logger.error("KATH session id = "+this_session.getId());
+          // check this map
+          if (verifiedUserMap.containsKey(session_id)) {
+        already_verified = true;
+          }
         }
-        if (this_session.getAttribute(GSParams.VERIFIED) != null ) {
-          _logger.error("KATH have verified in the session");
-          // we don't need to re-verify
-        } else {
-          _logger.error("KATH verfied not in session");
-                          
+        logger.error("KATH already verified = "+already_verified);
+
+        if (!already_verified) {
           // have we just  done the test?
           String hmvf_response = gRequest.getParameter(GSParams.VERIFIED);
           // hmvf param will be set by form if the verify page was submitted
           if (hmvf_response != null && hmvf_response.equals("1")) {
+        logger.error("user has submitted the form, check recaptcha response");
         if (!securityResponse.getAttribute(GSXML.SITE_KEY_ATT).equals("")) {
           String recaptcha_response = gRequest.getParameter(Authentication.RECAPTCHA_RESPONSE_PARAM);
           String secret_key = securityResponse.getAttribute(GSXML.SECRET_KEY_ATT);
           int result = Authentication.verifyRecaptcha(secret_key, recaptcha_response);
-          _logger.debug("recaptcha result code = "+result);
+          logger.error("recaptcha result code = "+result);
           if (result == Authentication.NO_ERROR) {
-            _logger.debug("RECAPTCHA SUCCESS, hopefully going to the document");
-
-            this_session.setAttribute(GSParams.VERIFIED, "1");
+            logger.error("RECAPTCHA SUCCESS, hopefully going to the document");
+
+            
           } else {
-            _logger.error("something went wrong with recaptcha, error="+result);
-            _logger.error(Authentication.getErrorKey(result));
+            logger.error("something went wrong with recaptcha, error="+result);
+            logger.error(Authentication.getErrorKey(result));
             // display error page
-            //String new_url = context.getContextPath()+"/"+ context.getAttribute("LibraryName")+"?a=p&sa=error&c="+collection+"&ec=recap_fail";
             String new_url = context.getContextPath()+"/"+ library_name+"?a=p&sa=error&c="+collection+"&ec=recap_fail";             
             ((HttpServletResponse)response).sendRedirect(new_url);
@@ -284 +297 @@
             return;
           }
+
+          // store the fact that user has verified
+          UserTimer timer = new UserTimer(verifiedUserTimeout, session_id);
+          verifiedUserMap.put(session_id, timer);
+          timer.start();
+          
         }
                         
@@ -289 +308 @@
         // hmvf param is not set - we haven't shown them the form yet
         // we need to display the verify page
+        logger.error("KATH display verify page");
         //String new_url = context.getContextPath()+"/"+ context.getAttribute("LibraryName")+"?a=p&sa=verify&c="+collection+"&url="+url;
         String new_url = context.getContextPath()+"/"+ library_name+"?a=p&sa=verify&c="+collection+"&url="+url;             
@@ -295 +315 @@
           }
         }
-      }
-    }
+      } // end if we are asked to verify it
+    } // end if verifiable file
     
             
@@ -302 +322 @@
     // However, we need to remove the library_name from the URL. As can't change the
     // existing URL, we need to forward to the new one.
+    // (Can't do redirect as it will come back into this code and fail as there won't be library in the url)
     // Remove the context and library name parts.
     // don't know what happens with the rest of the filter chain? Does this bypass that??
@@ -592 +613 @@
     if (metadataList.getLength() == 0) {
       
-      _logger.error("Could not find the document related to this url");
+      logger.error("Could not find the document related to this url");
       return null;
     }
@@ -605 +626 @@
  
   }
+
+  private class UserTimer extends Timer implements ActionListener
+  {
+    String id = "";
+    
+    public UserTimer(int delay, String id)
+    {
+      super(delay, (ActionListener) null);
+      addActionListener(this);
+      this.id = id;
+    }
+    
+    public void actionPerformed(ActionEvent e)
+    {
+      verifiedUserMap.remove(id);
+      stop();
+    }
+    
+  }
+  
   
 }