From 8df1d5347197ba8e5bde5db2639d948cd6defb02 Mon Sep 17 00:00:00 2001 From: Jason White Date: Tue, 8 Aug 2017 09:28:09 -0600 Subject: [PATCH] interim missing function ac commit, traversing dev. env. --- .../org/owasp/webgoat/MvcConfiguration.java | 1 + .../owasp/webgoat/controller/ListUsers.java | 43 +++++ .../owasp/webgoat/users/UserRepository.java | 5 + .../org/owasp/webgoat/users/UserService.java | 12 ++ .../org/owasp/webgoat/users/WebGoatUser.java | 6 + .../main/resources/templates/list_users.html | 181 ++++++++++++++++++ .../main/resources/templates/main_new.html | 4 +- .../webgoat/plugin/MissingACListUsers.java | 54 ------ 8 files changed, 250 insertions(+), 56 deletions(-) create mode 100644 webgoat-container/src/main/java/org/owasp/webgoat/controller/ListUsers.java create mode 100644 webgoat-container/src/main/resources/templates/list_users.html delete mode 100644 webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/plugin/MissingACListUsers.java diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java b/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java index 349904de9..bf67aff33 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/MvcConfiguration.java @@ -72,6 +72,7 @@ public class MvcConfiguration extends WebMvcConfigurerAdapter { registry.addViewController("/lesson_content").setViewName("lesson_content"); registry.addViewController("/start.mvc").setViewName("main_new"); registry.addViewController("/scoreboard").setViewName("scoreboard"); + //registry.addViewController("/list_users").setViewName("list_users"); } diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/controller/ListUsers.java b/webgoat-container/src/main/java/org/owasp/webgoat/controller/ListUsers.java new file mode 100644 index 000000000..226bc5ec4 --- /dev/null +++ b/webgoat-container/src/main/java/org/owasp/webgoat/controller/ListUsers.java @@ -0,0 +1,43 @@ +package org.owasp.webgoat.controller; + +import com.sun.corba.se.spi.activation.EndPointInfo; +import org.owasp.webgoat.assignments.*; +import org.owasp.webgoat.session.UserSessionData; +import org.owasp.webgoat.users.UserService; +import org.owasp.webgoat.users.WebGoatUser; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.*; +import org.springframework.web.servlet.ModelAndView; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import java.io.IOException; +import java.util.HashMap; +import java.util.List; + +/** + * Created by jason on 1/5/17. + */ + +@Controller +public class ListUsers { + + @Autowired + private UserService userService; + + @RequestMapping(path = {"list_users", "/"}, method = {RequestMethod.GET,RequestMethod.POST}) + public ModelAndView listUsers(HttpServletRequest request) { + + ModelAndView model = new ModelAndView(); + model.setViewName("list_users"); + List allUsers = userService.getAllUsers(); + model.addObject("numUsers",allUsers.size()); + model.addObject("allUsers",allUsers); + + return model; + } + +} diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/users/UserRepository.java b/webgoat-container/src/main/java/org/owasp/webgoat/users/UserRepository.java index ae2f1063e..b836d5bfa 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/users/UserRepository.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/users/UserRepository.java @@ -2,6 +2,8 @@ package org.owasp.webgoat.users; import org.springframework.data.mongodb.repository.MongoRepository; +import java.util.List; + /** * @author nbaars * @since 3/19/17. @@ -9,4 +11,7 @@ import org.springframework.data.mongodb.repository.MongoRepository; public interface UserRepository extends MongoRepository { WebGoatUser findByUsername(String username); + + List findAll(); + } diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/users/UserService.java b/webgoat-container/src/main/java/org/owasp/webgoat/users/UserService.java index 7a1175c45..932dc6e98 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/users/UserService.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/users/UserService.java @@ -5,6 +5,8 @@ import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; +import java.util.List; + /** * @author nbaars * @since 3/19/17. @@ -31,4 +33,14 @@ public class UserService implements UserDetailsService { userRepository.save(new WebGoatUser(username, password)); userTrackerRepository.save(new UserTracker(username)); } + + public void addUser(String username, String password, String role) { + userRepository.save(new WebGoatUser(username,password,role)); + userTrackerRepository.save(new UserTracker(username)); + } + + public List getAllUsers () { + return userRepository.findAll(); + } + } diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/users/WebGoatUser.java b/webgoat-container/src/main/java/org/owasp/webgoat/users/WebGoatUser.java index 8b3c7c88c..e96f524e8 100644 --- a/webgoat-container/src/main/java/org/owasp/webgoat/users/WebGoatUser.java +++ b/webgoat-container/src/main/java/org/owasp/webgoat/users/WebGoatUser.java @@ -37,6 +37,12 @@ public class WebGoatUser implements UserDetails { createUser(); } + public WebGoatUser(String username, String password, String role) { + this.username = username; + this.password = password; + this.role = role; + } + public void createUser() { this.user = new User(username, password, getAuthorities()); } diff --git a/webgoat-container/src/main/resources/templates/list_users.html b/webgoat-container/src/main/resources/templates/list_users.html new file mode 100644 index 000000000..be67a9de4 --- /dev/null +++ b/webgoat-container/src/main/resources/templates/list_users.html @@ -0,0 +1,181 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + +