dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix for JWT assignment 1 log in now works again.

Browse Source 
Reset button only triggers reset when admin is set to true in the token
This commit is contained in:
Nanne Baars 2018-05-29 11:20:40 +02:00
parent 5f4889cefe
commit 589872ad47
3 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/plugin/JWTVotesEndpoint.java
View File

@ -143,7 +143,6 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
Claims claims = (Claims) jwt.getBody(); Claims claims = (Claims) jwt.getBody();
boolean isAdmin = Boolean.valueOf((String) claims.get("admin")); boolean isAdmin = Boolean.valueOf((String) claims.get("admin"));
if (!isAdmin) { if (!isAdmin) {
votes.values().forEach(vote -> vote.reset());
return trackProgress(failed().feedback("jwt-only-admin").build()); return trackProgress(failed().feedback("jwt-only-admin").build());
} else { } else {
votes.values().forEach(vote -> vote.reset()); votes.values().forEach(vote -> vote.reset());

15
webgoat-lessons/jwt/src/main/resources/html/JWT.html
View File

@ -16,8 +16,10 @@
<link rel="stylesheet" type="text/css" th:href="@{/lesson_css/jwt.css}"/> <link rel="stylesheet" type="text/css" th:href="@{/lesson_css/jwt.css}"/>
<script th:src="@{/lesson_js/bootstrap.min.js}" language="JavaScript"></script> <script th:src="@{/lesson_js/bootstrap.min.js}" language="JavaScript"></script>
<script th:src="@{/lesson_js/jwt-signing.js}" language="JavaScript"></script> <script th:src="@{/lesson_js/jwt-voting.js}" language="JavaScript"></script>
<div class="attack-container"> <div class="attack-container">
<div class="attack-feedback"></div>
<div class="attack-output"></div>
<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div> <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
<form class="attack-form" accept-charset="UNKNOWN" <form class="attack-form" accept-charset="UNKNOWN"
method="POST" method="POST"
@ -37,16 +39,16 @@
</button> </button>
<ul class="dropdown-menu dropdown-menu-left"> <ul class="dropdown-menu dropdown-menu-left">
<li role="presentation"><a role="menuitem" tabindex="-1" <li role="presentation"><a role="menuitem" tabindex="-1"
onclick="javascript:login('Guest')" onclick="javascript:loginVotes('Guest')"
th:text="Guest">current</a></li> th:text="Guest">current</a></li>
<li role="presentation"><a role="menuitem" tabindex="-1" <li role="presentation"><a role="menuitem" tabindex="-1"
onclick="javascript:login('Tom')" onclick="javascript:loginVotes('Tom')"
th:text="Tom">current</a></li> th:text="Tom">current</a></li>
<li role="presentation"><a role="menuitem" tabindex="-1" <li role="presentation"><a role="menuitem" tabindex="-1"
onclick="javascript:login('Jerry')" onclick="javascript:loginVotes('Jerry')"
th:text="Jerry">current</a></li> th:text="Jerry">current</a></li>
<li role="presentation"><a role="menuitem" tabindex="-1" <li role="presentation"><a role="menuitem" tabindex="-1"
onclick="javascript:login('Sylvester')" onclick="javascript:loginVotes('Sylvester')"
th:text="Sylvester">current</a></li> th:text="Sylvester">current</a></li>
</ul> </ul>
<button type="button" class="btn btn-default fa fa-refresh" title="Refresh votes" <button type="button" class="btn btn-default fa fa-refresh" title="Refresh votes"
@ -70,8 +72,7 @@
</form> </form>
<br/> <br/>
<div class="attack-feedback"></div>
<div class="attack-output"></div>
</div> </div>
</div> </div>

4
webgoat-lessons/jwt/src/main/resources/js/jwt-signing.js → webgoat-lessons/jwt/src/main/resources/js/jwt-voting.js
View File

@ -1,8 +1,8 @@
$(document).ready(function () { $(document).ready(function () {
login('Guest'); loginVotes('Guest');
}) })
function login(user) { function loginVotes(user) {
$("#name").text(user); $("#name").text(user);
$.ajax({ $.ajax({
url: 'JWT/votings/login?user=' + user, url: 'JWT/votings/login?user=' + user,