dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

more changes for showSource and showHints

Browse Source
This commit is contained in:
Rick Lawson
2014-09-19 21:06:46 -04:00
parent 5c1b3e1916
commit 3fd7b34536
4 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java
View File

@ -60,8 +60,8 @@ import org.slf4j.LoggerFactory;
*
* Getting Source ==============
*
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository
* for free software projects.
* Source for this application is maintained at
* https://github.com/WebGoat/WebGoat, a repository for free software projects.
*
* For details, please see http://webgoat.github.io
*
@ -70,7 +70,7 @@ import org.slf4j.LoggerFactory;
*/
public abstract class AbstractLesson extends Screen implements Comparable<Object> {
final Logger logger = LoggerFactory.getLogger(AbstractLesson.class);
private static final Logger logger = LoggerFactory.getLogger(AbstractLesson.class);
/**
* Description of the Field
@ -612,6 +612,7 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
* @return
*/
public boolean isAuthorized(WebSession s, String role, String functionId) {
logger.info("Checking if " + role + " authorized for: " + functionId);
boolean authorized = false;
try {
String query = "SELECT * FROM auth WHERE role = '" + role + "' and functionid = '" + functionId + "'";
@ -620,13 +621,14 @@ public abstract class AbstractLesson extends Screen implements Comparable<Object
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
ResultSet answer_results = answer_statement.executeQuery(query);
authorized = answer_results.first();
logger.info("authorized: "+ authorized);
} catch (SQLException sqle) {
s.setMessage("Error authorizing");
sqle.printStackTrace();
logger.error("Error authorizing", sqle);
}
} catch (Exception e) {
s.setMessage("Error authorizing");
e.printStackTrace();
logger.error("Error authorizing", e);
}
return authorized;
}

3
src/main/java/org/owasp/webgoat/service/BaseService.java
View File

@ -34,7 +34,6 @@ import java.io.PrintWriter;
import java.io.StringWriter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import org.owasp.webgoat.controller.Welcome;
import org.owasp.webgoat.session.WebSession;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@ -51,7 +50,7 @@ import org.springframework.web.bind.annotation.ResponseStatus;
@RequestMapping("/service")
public abstract class BaseService {
final Logger logger = LoggerFactory.getLogger(BaseService.class);
private static final Logger logger = LoggerFactory.getLogger(BaseService.class);
@ExceptionHandler(Exception.class)
@ResponseStatus(value = HttpStatus.I_AM_A_TEAPOT)

18
src/main/java/org/owasp/webgoat/service/LessonMenuService.java
View File

@ -40,6 +40,8 @@ import org.owasp.webgoat.lessons.model.LessonMenuItem;
import org.owasp.webgoat.lessons.model.LessonMenuItemType;
import org.owasp.webgoat.session.Course;
import org.owasp.webgoat.session.WebSession;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@ -51,6 +53,8 @@ import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public class LessonMenuService extends BaseService {
private static final Logger logger = LoggerFactory.getLogger(LessonMenuService.class);
/**
* Returns the lesson menu which is used to build the left nav
*
@ -72,6 +76,8 @@ public class LessonMenuService extends BaseService {
categoryItem.setType(LessonMenuItemType.CATEGORY);
// check for any lessons for this category
List<AbstractLesson> lessons = ws.getLessons(category);
String role = ws.getRole();
logger.info("Role: " + role);
for (AbstractLesson lesson : lessons) {
LessonMenuItem lessonItem = new LessonMenuItem();
lessonItem.setName(lesson.getTitle());
@ -80,13 +86,21 @@ public class LessonMenuService extends BaseService {
if (lesson.isCompleted(ws)) {
lessonItem.setComplete(true);
}
if (ws.isAuthorizedInLesson(ws.getRole(), WebSession.SHOWHINTS)) {
if (lesson.isAuthorized(ws, role, WebSession.SHOWHINTS)) {
lessonItem.setShowHints(true);
}
if (ws.isAuthorizedInLesson(ws.getRole(), WebSession.SHOWSOURCE)) {
if (lesson.isAuthorized(ws, role, WebSession.SHOWSOURCE)) {
lessonItem.setShowSource(true);
}
// special handling for challenge role
if (Category.CHALLENGE.equals(lesson.getCategory())) {
lessonItem.setShowHints(lesson.isAuthorized(ws, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS));
lessonItem.setShowSource(lesson.isAuthorized(ws, AbstractLesson.CHALLENGE_ROLE, WebSession.SHOWHINTS));
}
categoryItem.addChild(lessonItem);
// Does the lesson have stages
if (lesson instanceof RandomLessonAdapter) {

4
src/main/java/org/owasp/webgoat/session/WebSession.java
View File

@ -75,12 +75,12 @@ public class WebSession {
/**
* Tomcat role for a webgoat user
*/
public final static String WEBGOAT_USER = "webgoat_user";
public final static String WEBGOAT_USER = "ROLE_WEBGOAT_USER";
/**
* Tomcat role for a webgoat admin
*/
public final static String WEBGOAT_ADMIN = "webgoat_admin";
public final static String WEBGOAT_ADMIN = "ROLE_WEBGOAT_ADMIN";
/**
* Description of the Field