dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

more changes for showSource and showHints

Browse Source
This commit is contained in:
Rick Lawson 2014-09-19 21:06:46 -04:00
parent 5c1b3e1916
commit 3fd7b34536
4 changed files with 26 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java
View File

@ -60,8 +60,8 @@ import org.slf4j.LoggerFactory;
* *
* Getting Source ============== * Getting Source ==============
* *
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository * Source for this application is maintained at
* for free software projects. * https://github.com/WebGoat/WebGoat, a repository for free software projects.
* *
* For details, please see http://webgoat.github.io * For details, please see http://webgoat.github.io
* *
@ -70,7 +70,7 @@ import org.slf4j.LoggerFactory;
*/ */
public abstract class AbstractLesson extends Screen implements Comparable<Object> { public abstract class AbstractLesson extends Screen implements Comparable<Object> {
final Logger logger = LoggerFactory.getLogger(AbstractLesson.class); private static final Logger logger = LoggerFactory.getLogger(AbstractLesson.class);
/** /**
* Description of the Field * Description of the Field
@ -612,6 +612,7 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
* @return * @return
*/ */
public boolean isAuthorized(WebSession s, String role, String functionId) { public boolean isAuthorized(WebSession s, String role, String functionId) {
logger.info("Checking if " + role + " authorized for: " + functionId);
boolean authorized = false; boolean authorized = false;
try { try {
String query = "SELECT * FROM auth WHERE role = '" + role + "' and functionid = '" + functionId + "'"; String query = "SELECT * FROM auth WHERE role = '" + role + "' and functionid = '" + functionId + "'";
@ -620,13 +621,14 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY); .createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
ResultSet answer_results = answer_statement.executeQuery(query); ResultSet answer_results = answer_statement.executeQuery(query);
authorized = answer_results.first(); authorized = answer_results.first();
logger.info("authorized: "+ authorized);
} catch (SQLException sqle) { } catch (SQLException sqle) {
s.setMessage("Error authorizing"); s.setMessage("Error authorizing");
sqle.printStackTrace(); logger.error("Error authorizing", sqle);
} }
} catch (Exception e) { } catch (Exception e) {
s.setMessage("Error authorizing"); s.setMessage("Error authorizing");
e.printStackTrace(); logger.error("Error authorizing", e);
} }
return authorized; return authorized;
} }

3
src/main/java/org/owasp/webgoat/service/BaseService.java
View File

@ -34,7 +34,6 @@ import java.io.PrintWriter;
import java.io.StringWriter; import java.io.StringWriter;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession; import javax.servlet.http.HttpSession;
import org.owasp.webgoat.controller.Welcome;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.slf4j.Logger; import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
@ -51,7 +50,7 @@ import org.springframework.web.bind.annotation.ResponseStatus;
@RequestMapping("/service") @RequestMapping("/service")
public abstract class BaseService { public abstract class BaseService {
final Logger logger = LoggerFactory.getLogger(BaseService.class); private static final Logger logger = LoggerFactory.getLogger(BaseService.class);
@ExceptionHandler(Exception.class) @ExceptionHandler(Exception.class)
@ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT) @ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT)

18
src/main/java/org/owasp/webgoat/service/LessonMenuService.java
View File

@ -40,6 +40,8 @@ import org.owasp.webgoat.lessons.model.LessonMenuItem;
import org.owasp.webgoat.lessons.model.LessonMenuItemType; import org.owasp.webgoat.lessons.model.LessonMenuItemType;
import org.owasp.webgoat.session.Course; import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.session.WebSession; import org.owasp.webgoat.session.WebSession;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller; import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.bind.annotation.ResponseBody;
@ -51,6 +53,8 @@ import org.springframework.web.bind.annotation.ResponseBody;
@Controller @Controller
public class LessonMenuService extends BaseService { public class LessonMenuService extends BaseService {
private static final Logger logger = LoggerFactory.getLogger(LessonMenuService.class);
/** /**
* Returns the lesson menu which is used to build the left nav * Returns the lesson menu which is used to build the left nav
* *
@ -72,6 +76,8 @@ public class LessonMenuService extends BaseService {
categoryItem.setType(LessonMenuItemType.CATEGORY); categoryItem.setType(LessonMenuItemType.CATEGORY);
// check for any lessons for this category // check for any lessons for this category
List<AbstractLesson> lessons = ws.getLessons(category); List<AbstractLesson> lessons = ws.getLessons(category);
String role = ws.getRole();
logger.info("Role: " + role);
for (AbstractLesson lesson : lessons) { for (AbstractLesson lesson : lessons) {
LessonMenuItem lessonItem = new LessonMenuItem(); LessonMenuItem lessonItem = new LessonMenuItem();
lessonItem.setName(lesson.getTitle()); lessonItem.setName(lesson.getTitle());
@ -80,13 +86,21 @@ public class LessonMenuService extends BaseService {
if (lesson.isCompleted(ws)) { if (lesson.isCompleted(ws)) {
lessonItem.setComplete(true); lessonItem.setComplete(true);
} }
if (ws.isAuthorizedInLesson(ws.getRole(), WebSession.SHOWHINTS)) {
if (lesson.isAuthorized(ws, role, WebSession.SHOWHINTS)) {
lessonItem.setShowHints(true); lessonItem.setShowHints(true);
} }
if (ws.isAuthorizedInLesson(ws.getRole(), WebSession.SHOWSOURCE)) { if (lesson.isAuthorized(ws, role, WebSession.SHOWSOURCE)) {
lessonItem.setShowSource(true); lessonItem.setShowSource(true);
} }
// special handling for challenge role
if (Category.CHALLENGE.equals(lesson.getCategory())) {
lessonItem.setShowHints(lesson.isAuthorized(ws, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS));
lessonItem.setShowSource(lesson.isAuthorized(ws, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS));
}
categoryItem.addChild(lessonItem); categoryItem.addChild(lessonItem);
// Does the lesson have stages // Does the lesson have stages
if (lesson instanceof RandomLessonAdapter) { if (lesson instanceof RandomLessonAdapter) {

4
src/main/java/org/owasp/webgoat/session/WebSession.java
View File

@ -75,12 +75,12 @@ public class WebSession {
/** /**
* Tomcat role for a webgoat user * Tomcat role for a webgoat user
*/ */
public final static String WEBGOAT_USER = "webgoat_user"; public final static String WEBGOAT_USER = "ROLE_WEBGOAT_USER";
/** /**
* Tomcat role for a webgoat admin * Tomcat role for a webgoat admin
*/ */
public final static String WEBGOAT_ADMIN = "webgoat_admin"; public final static String WEBGOAT_ADMIN = "ROLE_WEBGOAT_ADMIN";
/** /**
* Description of the Field * Description of the Field