Miscellaneous bug fixes
divide by zero, inaccurate discount and totals, reflection of user input git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@273 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
rogan.dawes
@ -0,0 +1,334 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
|
||||
import org.owasp.webgoat.lessons.RoleBasedAccessControl.RoleBasedAccessControl;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public abstract class DefaultLessonAction implements LessonAction
|
||||
{
|
||||
// FIXME: We could parse this class name to get defaults for these fields.
|
||||
private String lessonName;
|
||||
private String actionName;
|
||||
|
||||
private GoatHillsFinancial lesson;
|
||||
|
||||
public DefaultLessonAction(GoatHillsFinancial lesson, String lessonName, String actionName)
|
||||
{
|
||||
this.lesson = lesson;
|
||||
this.lessonName = lessonName;
|
||||
this.actionName = actionName;
|
||||
}
|
||||
|
||||
public void handleRequest( WebSession s )
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException, ValidationException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public abstract String getNextPage(WebSession s);
|
||||
|
||||
public GoatHillsFinancial getLesson()
|
||||
{
|
||||
return lesson;
|
||||
}
|
||||
|
||||
public String getLessonName()
|
||||
{
|
||||
return lessonName;
|
||||
}
|
||||
|
||||
public String getActionName()
|
||||
{
|
||||
return actionName;
|
||||
}
|
||||
|
||||
public void setSessionAttribute(WebSession s, String name, Object value)
|
||||
{
|
||||
s.getRequest().getSession().setAttribute(name, value);
|
||||
}
|
||||
|
||||
public void setRequestAttribute(WebSession s, String name, Object value)
|
||||
{
|
||||
s.getRequest().setAttribute(name, value);
|
||||
}
|
||||
|
||||
public void removeSessionAttribute(WebSession s, String name)
|
||||
{
|
||||
s.getRequest().getSession().removeAttribute(name);
|
||||
}
|
||||
|
||||
protected String getSessionAttribute(WebSession s, String name) throws ParameterNotFoundException
|
||||
{
|
||||
String value = (String) s.getRequest().getSession().getAttribute(name);
|
||||
if (value == null)
|
||||
{
|
||||
throw new ParameterNotFoundException();
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
protected boolean getBooleanSessionAttribute(WebSession s, String name) throws ParameterNotFoundException
|
||||
{
|
||||
boolean value = false;
|
||||
|
||||
Object attribute = s.getRequest().getSession().getAttribute(name);
|
||||
if (attribute == null)
|
||||
{
|
||||
throw new ParameterNotFoundException();
|
||||
}
|
||||
else
|
||||
{
|
||||
//System.out.println("Attribute " + name + " is of type " + s.getRequest().getSession().getAttribute(name).getClass().getName());
|
||||
//System.out.println("Attribute value: " + s.getRequest().getSession().getAttribute(name));
|
||||
value = ((Boolean) attribute).booleanValue();
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
protected int getIntSessionAttribute(WebSession s, String name) throws ParameterNotFoundException
|
||||
{
|
||||
int value = -1;
|
||||
String ss = (String) s.getRequest().getSession().getAttribute(name);
|
||||
if (ss == null)
|
||||
{
|
||||
throw new ParameterNotFoundException();
|
||||
}
|
||||
else
|
||||
{
|
||||
try
|
||||
{
|
||||
value = Integer.parseInt(ss);
|
||||
}
|
||||
catch (NumberFormatException nfe)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
protected String getRequestAttribute(WebSession s, String name) throws ParameterNotFoundException
|
||||
{
|
||||
String value = (String) s.getRequest().getAttribute(name);
|
||||
if (value == null)
|
||||
{
|
||||
throw new ParameterNotFoundException();
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
protected int getIntRequestAttribute(WebSession s, String name) throws ParameterNotFoundException
|
||||
{
|
||||
int value = -1;
|
||||
String ss = (String) s.getRequest().getAttribute(name);
|
||||
if (ss == null)
|
||||
{
|
||||
throw new ParameterNotFoundException();
|
||||
}
|
||||
else
|
||||
{
|
||||
try
|
||||
{
|
||||
value = Integer.parseInt(ss);
|
||||
}
|
||||
catch (NumberFormatException nfe)
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
public int getUserId(WebSession s) throws ParameterNotFoundException
|
||||
{
|
||||
return getIntSessionAttribute(s, getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
}
|
||||
|
||||
public String getUserName(WebSession s) throws ParameterNotFoundException
|
||||
{
|
||||
String name = null;
|
||||
|
||||
int employeeId = getUserId(s);
|
||||
try
|
||||
{
|
||||
String query = "SELECT first_name FROM employee WHERE userid = " + employeeId;
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
if (answer_results.next())
|
||||
name = answer_results.getString("first_name");
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error getting user name" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error getting user name" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return name;
|
||||
}
|
||||
|
||||
public boolean requiresAuthentication()
|
||||
{
|
||||
// Default to true
|
||||
return true;
|
||||
}
|
||||
|
||||
public boolean isAuthenticated(WebSession s)
|
||||
{
|
||||
boolean authenticated = false;
|
||||
|
||||
try
|
||||
{
|
||||
authenticated = getBooleanSessionAttribute(s, getLessonName() + ".isAuthenticated");
|
||||
}
|
||||
catch (ParameterNotFoundException e)
|
||||
{
|
||||
}
|
||||
|
||||
return authenticated;
|
||||
}
|
||||
|
||||
public boolean isAuthorized(WebSession s, int employeeId, String functionId)
|
||||
{
|
||||
String employer_id = (String)s.getRequest().getSession().getAttribute(getLessonName() + "." + RoleBasedAccessControl.USER_ID);
|
||||
//System.out.println("Authorizing " + employeeId + " for use of function: " + functionId + " having USER_ID = " + employer_id );
|
||||
boolean authorized = false;
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM auth WHERE auth.role in (SELECT roles.role FROM roles WHERE userid = " + employeeId + ") and functionid = '" + functionId + "'";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s).createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
ResultSet answer_results = answer_statement.executeQuery( query );
|
||||
authorized = answer_results.first();
|
||||
|
||||
/* User is validated for function, but can the user perform that function on the specified user? */
|
||||
if(authorized)
|
||||
{
|
||||
authorized = isAuthorizedForEmployee(s, Integer.parseInt(employer_id), employeeId);
|
||||
}
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error authorizing" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error authorizing" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
//System.out.println("Authorized? " + authorized);
|
||||
return authorized;
|
||||
}
|
||||
|
||||
public boolean isAuthorizedForEmployee(WebSession s, int userId, int employeeId)
|
||||
{
|
||||
//System.out.println("Authorizing " + userId + " for access to employee: " + employeeId);
|
||||
boolean authorized = false;
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM ownership WHERE employer_id = ? AND employee_id = ?";
|
||||
|
||||
try
|
||||
{
|
||||
|
||||
PreparedStatement answer_statement = WebSession.getConnection(s).prepareStatement( query,
|
||||
ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
|
||||
answer_statement.setInt(1, userId);
|
||||
answer_statement.setInt(2, employeeId);
|
||||
ResultSet answer_results = answer_statement.executeQuery();
|
||||
authorized = answer_results.first();
|
||||
}
|
||||
catch ( SQLException sqle )
|
||||
{
|
||||
s.setMessage( "Error authorizing" );
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch ( Exception e )
|
||||
{
|
||||
s.setMessage( "Error authorizing" );
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return authorized;
|
||||
}
|
||||
|
||||
protected void setStage(WebSession s, String stage)
|
||||
{
|
||||
getLesson().setStage(s, stage);
|
||||
}
|
||||
|
||||
protected void setStageComplete(WebSession s, String stage) {
|
||||
getLesson().setStageComplete(s, stage);
|
||||
}
|
||||
|
||||
protected String getStage(WebSession s)
|
||||
{
|
||||
return getLesson().getStage(s);
|
||||
}
|
||||
|
||||
public String toString()
|
||||
{
|
||||
return getActionName();
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,122 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class DeleteProfile extends DefaultLessonAction
|
||||
{
|
||||
|
||||
private LessonAction chainedAction;
|
||||
|
||||
public DeleteProfile(GoatHillsFinancial lesson, String lessonName,
|
||||
String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
UnauthenticatedException, UnauthorizedException,
|
||||
ValidationException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.USER_ID);
|
||||
int employeeId = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.EMPLOYEE_ID);
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
deleteEmployeeProfile(s, userId, employeeId);
|
||||
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return GoatHillsFinancial.LISTSTAFF_ACTION;
|
||||
}
|
||||
|
||||
public void deleteEmployeeProfile(WebSession s, int userId, int employeeId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
// Note: The password field is ONLY set by ChangePassword
|
||||
String query = "DELETE FROM employee WHERE userid = " + employeeId;
|
||||
//System.out.println("Query: " + query);
|
||||
try
|
||||
{
|
||||
Statement statement = WebSession.getConnection(s)
|
||||
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
statement.executeUpdate(query);
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error deleting employee profile");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error deleting employee profile");
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,132 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class EditProfile extends DefaultLessonAction
|
||||
{
|
||||
|
||||
public EditProfile(GoatHillsFinancial lesson, String lessonName,
|
||||
String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
UnauthenticatedException, UnauthorizedException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getUserId(s);
|
||||
int employeeId = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.EMPLOYEE_ID);
|
||||
|
||||
Employee employee = getEmployeeProfile(s, userId, employeeId);
|
||||
setSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.EMPLOYEE_ATTRIBUTE_KEY, employee);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return GoatHillsFinancial.EDITPROFILE_ACTION;
|
||||
}
|
||||
|
||||
public Employee getEmployeeProfile(WebSession s, int userId,
|
||||
int subjectUserId) throws UnauthorizedException
|
||||
{
|
||||
Employee profile = null;
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = ?";
|
||||
|
||||
try
|
||||
{
|
||||
PreparedStatement answer_statement = WebSession
|
||||
.getConnection(s).prepareStatement(query,
|
||||
ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
answer_statement.setInt(1, subjectUserId);
|
||||
ResultSet answer_results = answer_statement.executeQuery();
|
||||
if (answer_results.next())
|
||||
{
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(answer_results.getInt("userid"),
|
||||
answer_results.getString("first_name"),
|
||||
answer_results.getString("last_name"),
|
||||
answer_results.getString("ssn"), answer_results
|
||||
.getString("title"), answer_results
|
||||
.getString("phone"), answer_results
|
||||
.getString("address1"), answer_results
|
||||
.getString("address2"), answer_results
|
||||
.getInt("manager"), answer_results
|
||||
.getString("start_date"), answer_results
|
||||
.getInt("salary"), answer_results
|
||||
.getString("ccn"), answer_results
|
||||
.getInt("ccn_limit"), answer_results
|
||||
.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/}
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error getting employee profile");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error getting employee profile");
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,190 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class FindProfile extends DefaultLessonAction
|
||||
{
|
||||
|
||||
private LessonAction chainedAction;
|
||||
|
||||
|
||||
public FindProfile(GoatHillsFinancial lesson, String lessonName,
|
||||
String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
UnauthenticatedException, UnauthorizedException,
|
||||
ValidationException
|
||||
{
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.USER_ID);
|
||||
|
||||
String pattern = s.getParser().getRawParameter(
|
||||
GoatHillsFinancial.SEARCHNAME);
|
||||
|
||||
findEmployeeProfile(s, userId, pattern);
|
||||
|
||||
// Execute the chained Action if the employee was found.
|
||||
if (foundEmployee(s))
|
||||
{
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
String page = GoatHillsFinancial.SEARCHSTAFF_ACTION;
|
||||
|
||||
if (foundEmployee(s))
|
||||
page = GoatHillsFinancial.VIEWPROFILE_ACTION;
|
||||
|
||||
return page;
|
||||
}
|
||||
|
||||
|
||||
private boolean foundEmployee(WebSession s)
|
||||
{
|
||||
boolean found = false;
|
||||
try
|
||||
{
|
||||
getIntRequestAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.EMPLOYEE_ID);
|
||||
found = true;
|
||||
}
|
||||
catch (ParameterNotFoundException e)
|
||||
{}
|
||||
|
||||
return found;
|
||||
}
|
||||
|
||||
|
||||
public Employee findEmployeeProfile(WebSession s, int userId, String pattern)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
Employee profile = null;
|
||||
// Clear any residual employee id's in the session now.
|
||||
removeSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.EMPLOYEE_ID);
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE first_name LIKE ? OR last_name LIKE ?";
|
||||
|
||||
try
|
||||
{
|
||||
PreparedStatement answer_statement = WebSession
|
||||
.getConnection(s).prepareStatement(query,
|
||||
ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
answer_statement.setString(1, "%" + pattern + "%");
|
||||
answer_statement.setString(2, "%" + pattern + "%");
|
||||
ResultSet answer_results = answer_statement.executeQuery();
|
||||
|
||||
// Just use the first hit.
|
||||
if (answer_results.next())
|
||||
{
|
||||
int id = answer_results.getInt("userid");
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(id, answer_results
|
||||
.getString("first_name"), answer_results
|
||||
.getString("last_name"), answer_results
|
||||
.getString("ssn"), answer_results
|
||||
.getString("title"), answer_results
|
||||
.getString("phone"), answer_results
|
||||
.getString("address1"), answer_results
|
||||
.getString("address2"), answer_results
|
||||
.getInt("manager"), answer_results
|
||||
.getString("start_date"), answer_results
|
||||
.getInt("salary"), answer_results.getString("ccn"),
|
||||
answer_results.getInt("ccn_limit"), answer_results
|
||||
.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/
|
||||
setRequestAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.EMPLOYEE_ID, Integer
|
||||
.toString(id));
|
||||
}
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error finding employee profile");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error finding employee profile");
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,332 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Hashtable;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
|
||||
import org.apache.ecs.Element;
|
||||
import org.apache.ecs.ElementContainer;
|
||||
import org.apache.ecs.html.A;
|
||||
import org.apache.ecs.html.IMG;
|
||||
import org.owasp.webgoat.lessons.RandomLessonAdapter;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class GoatHillsFinancial extends RandomLessonAdapter
|
||||
{
|
||||
public final static A ASPECT_LOGO = new A().setHref("http://www.aspectsecurity.com").addElement(new IMG("images/logos/aspect.jpg").setAlt("Aspect Security").setBorder(0).setHspace(0).setVspace(0));
|
||||
|
||||
public final static String DESCRIPTION = "description";
|
||||
|
||||
public final static String DISCIPLINARY_DATE = "disciplinaryDate";
|
||||
|
||||
public final static String DISCIPLINARY_NOTES = "disciplinaryNotes";
|
||||
|
||||
public final static String CCN_LIMIT = "ccnLimit";
|
||||
|
||||
public final static String CCN = "ccn";
|
||||
|
||||
public final static String SALARY = "salary";
|
||||
|
||||
public final static String START_DATE = "startDate";
|
||||
|
||||
public final static String MANAGER = "manager";
|
||||
|
||||
public final static String ADDRESS1 = "address1";
|
||||
|
||||
public final static String ADDRESS2 = "address2";
|
||||
|
||||
public final static String PHONE_NUMBER = "phoneNumber";
|
||||
|
||||
public final static String TITLE = "title";
|
||||
|
||||
public final static String SSN = "ssn";
|
||||
|
||||
public final static String LAST_NAME = "lastName";
|
||||
|
||||
public final static String FIRST_NAME = "firstName";
|
||||
|
||||
public final static String PASSWORD = "password";
|
||||
|
||||
public final static String EMPLOYEE_ID = "employee_id";
|
||||
|
||||
public final static String USER_ID = "user_id";
|
||||
|
||||
public final static String SEARCHNAME = "search_name";
|
||||
|
||||
public final static String SEARCHRESULT_ATTRIBUTE_KEY = "SearchResult";
|
||||
|
||||
public final static String EMPLOYEE_ATTRIBUTE_KEY = "Employee";
|
||||
|
||||
public final static String STAFF_ATTRIBUTE_KEY = "Staff";
|
||||
|
||||
public final static String LOGIN_ACTION = "Login";
|
||||
|
||||
public final static String LOGOUT_ACTION = "Logout";
|
||||
|
||||
public final static String LISTSTAFF_ACTION = "ListStaff";
|
||||
|
||||
public final static String SEARCHSTAFF_ACTION = "SearchStaff";
|
||||
|
||||
public final static String FINDPROFILE_ACTION = "FindProfile";
|
||||
|
||||
public final static String VIEWPROFILE_ACTION = "ViewProfile";
|
||||
|
||||
public final static String EDITPROFILE_ACTION = "EditProfile";
|
||||
|
||||
public final static String UPDATEPROFILE_ACTION = "UpdateProfile";
|
||||
|
||||
public final static String CREATEPROFILE_ACTION = "CreateProfile";
|
||||
|
||||
public final static String DELETEPROFILE_ACTION = "DeleteProfile";
|
||||
|
||||
public final static String ERROR_ACTION = "error";
|
||||
|
||||
private final static Integer DEFAULT_RANKING = new Integer(125);
|
||||
|
||||
private Map<String, LessonAction> lessonFunctions = new Hashtable<String, LessonAction>();
|
||||
|
||||
public GoatHillsFinancial()
|
||||
{
|
||||
String myClassName = parseClassName(this.getClass().getName());
|
||||
registerActions(myClassName);
|
||||
}
|
||||
|
||||
protected void registerActions(String className) {
|
||||
registerAction(new ListStaff(this, className, LISTSTAFF_ACTION));
|
||||
registerAction(new SearchStaff(this, className, SEARCHSTAFF_ACTION));
|
||||
registerAction(new ViewProfile(this, className, VIEWPROFILE_ACTION));
|
||||
registerAction(new EditProfile(this, className, EDITPROFILE_ACTION));
|
||||
registerAction(new EditProfile(this, className, CREATEPROFILE_ACTION));
|
||||
|
||||
// These actions are special in that they chain to other actions.
|
||||
registerAction(new Login(this, className, LOGIN_ACTION,
|
||||
getAction(LISTSTAFF_ACTION)));
|
||||
registerAction(new Logout(this, className, LOGOUT_ACTION,
|
||||
getAction(LOGIN_ACTION)));
|
||||
registerAction(new FindProfile(this, className, FINDPROFILE_ACTION,
|
||||
getAction(VIEWPROFILE_ACTION)));
|
||||
registerAction(new UpdateProfile(this, className,
|
||||
UPDATEPROFILE_ACTION, getAction(VIEWPROFILE_ACTION)));
|
||||
registerAction(new DeleteProfile(this, className,
|
||||
DELETEPROFILE_ACTION, getAction(LISTSTAFF_ACTION)));
|
||||
}
|
||||
|
||||
protected final String parseClassName(String fqcn)
|
||||
{
|
||||
String className = fqcn;
|
||||
|
||||
int lastDotIndex = fqcn.lastIndexOf('.');
|
||||
if (lastDotIndex > -1)
|
||||
className = fqcn.substring(lastDotIndex + 1);
|
||||
|
||||
return className;
|
||||
}
|
||||
|
||||
protected void registerAction(LessonAction action)
|
||||
{
|
||||
lessonFunctions.put(action.getActionName(), action);
|
||||
}
|
||||
|
||||
public String[] getStages() {
|
||||
return new String[] {};
|
||||
}
|
||||
|
||||
protected List<String> getHints(WebSession s)
|
||||
{
|
||||
return new ArrayList<String>();
|
||||
}
|
||||
|
||||
public String getInstructions(WebSession s)
|
||||
{
|
||||
return "";
|
||||
}
|
||||
|
||||
protected LessonAction getAction(String actionName)
|
||||
{
|
||||
return lessonFunctions.get(actionName);
|
||||
}
|
||||
|
||||
public void handleRequest(WebSession s)
|
||||
{
|
||||
if (s.getLessonSession(this) == null)
|
||||
s.openLessonSession(this);
|
||||
|
||||
String requestedActionName = null;
|
||||
try
|
||||
{
|
||||
requestedActionName = s.getParser().getStringParameter("action");
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
// Let them eat login page.
|
||||
requestedActionName = LOGIN_ACTION;
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
LessonAction action = getAction(requestedActionName);
|
||||
if (action == null)
|
||||
{
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
} else
|
||||
{
|
||||
//System.out.println("GoatHillsFinancial.handleRequest() dispatching to: " + action.getActionName());
|
||||
if (action.requiresAuthentication())
|
||||
{
|
||||
if (action.isAuthenticated(s))
|
||||
{
|
||||
action.handleRequest(s);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
else
|
||||
{
|
||||
// Access to Login does not require authentication.
|
||||
action.handleRequest(s);
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
System.out.println("Missing parameter");
|
||||
pnfe.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (ValidationException ve)
|
||||
{
|
||||
System.out.println("Validation failed");
|
||||
ve.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
catch (UnauthenticatedException ue)
|
||||
{
|
||||
s.setMessage("Login failed");
|
||||
System.out.println("Authentication failure");
|
||||
ue.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
s.setMessage("You are not authorized to perform this function");
|
||||
System.out.println("Authorization failure");
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
// All other errors send the user to the generic error page
|
||||
System.out.println("handleRequest() error");
|
||||
e.printStackTrace();
|
||||
setCurrentAction(s, ERROR_ACTION);
|
||||
}
|
||||
|
||||
// All this does for this lesson is ensure that a non-null content exists.
|
||||
setContent(new ElementContainer());
|
||||
}
|
||||
|
||||
public boolean isAuthorized(WebSession s, int userId, String functionId)
|
||||
{
|
||||
//System.out.println("Checking authorization from " + getCurrentAction(s));
|
||||
LessonAction action = getAction(getCurrentAction(s));
|
||||
return action.isAuthorized(s, userId, functionId);
|
||||
}
|
||||
|
||||
public int getUserId(WebSession s) throws ParameterNotFoundException
|
||||
{
|
||||
LessonAction action = getAction(getCurrentAction(s));
|
||||
return action.getUserId(s);
|
||||
}
|
||||
|
||||
public String getUserName(WebSession s) throws ParameterNotFoundException
|
||||
{
|
||||
LessonAction action = getAction(getCurrentAction(s));
|
||||
return action.getUserName(s);
|
||||
}
|
||||
|
||||
protected String getJspPath() {
|
||||
return "/lessons/" + getLessonName() + "/";
|
||||
}
|
||||
|
||||
public String getTemplatePage(WebSession s)
|
||||
{
|
||||
return getJspPath() + getLessonName() + ".jsp";
|
||||
}
|
||||
|
||||
public String getPage(WebSession s)
|
||||
{
|
||||
String page = getJspPath() + getCurrentAction(s) + ".jsp";
|
||||
|
||||
return page;
|
||||
}
|
||||
|
||||
protected Integer getDefaultRanking()
|
||||
{
|
||||
return DEFAULT_RANKING;
|
||||
}
|
||||
|
||||
public String getTitle()
|
||||
{
|
||||
return "Goat Hills Financials";
|
||||
}
|
||||
|
||||
public String getSourceFileName()
|
||||
{
|
||||
// FIXME: Need to generalize findSourceResource() and use it on the currently active
|
||||
// LessonAction delegate to get its source file.
|
||||
//return findSourceResource(getCurrentLessonScreen()....);
|
||||
return super.getSourceFileName();
|
||||
}
|
||||
|
||||
@Override
|
||||
protected boolean getDefaultHidden() {
|
||||
return getClass().equals(GoatHillsFinancial.class);
|
||||
}
|
||||
|
||||
public Element getCredits()
|
||||
{
|
||||
return super.getCustomCredits("", ASPECT_LOGO);
|
||||
}
|
||||
|
||||
@Override
|
||||
protected String getLessonName() {
|
||||
String className = getClass().getName();
|
||||
int index = className.lastIndexOf('.');
|
||||
if (index > -1)
|
||||
return className.substring(index+1);
|
||||
return super.getLessonName();
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,27 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
public interface LessonAction
|
||||
{
|
||||
public void handleRequest(WebSession s)
|
||||
throws ParameterNotFoundException, UnauthenticatedException, UnauthorizedException, ValidationException;
|
||||
|
||||
public String getNextPage(WebSession s);
|
||||
|
||||
public String getActionName();
|
||||
|
||||
public boolean requiresAuthentication();
|
||||
|
||||
public boolean isAuthenticated(WebSession s);
|
||||
|
||||
public boolean isAuthorized(WebSession s, int employeeId, String functionId);
|
||||
|
||||
public int getUserId(WebSession s) throws ParameterNotFoundException;
|
||||
|
||||
public String getUserName(WebSession s) throws ParameterNotFoundException;
|
||||
}
|
||||
@ -0,0 +1,121 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
import java.util.List;
|
||||
import java.util.Vector;
|
||||
|
||||
import org.owasp.webgoat.session.EmployeeStub;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class ListStaff extends DefaultLessonAction
|
||||
{
|
||||
|
||||
public ListStaff(GoatHillsFinancial lesson, String lessonName, String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
UnauthenticatedException, UnauthorizedException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.USER_ID);
|
||||
|
||||
List<EmployeeStub> employees = getAllEmployees(s, userId);
|
||||
setSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.STAFF_ATTRIBUTE_KEY, employees);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return GoatHillsFinancial.LISTSTAFF_ACTION;
|
||||
}
|
||||
|
||||
public List<EmployeeStub> getAllEmployees(WebSession s, int userId)
|
||||
throws UnauthorizedException
|
||||
{
|
||||
// Query the database for all employees "owned" by the given employee
|
||||
|
||||
List<EmployeeStub> employees = new Vector<EmployeeStub>();
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT employee.userid,first_name,last_name,role FROM employee,roles WHERE employee.userid=roles.userid and employee.userid in "
|
||||
+ "(SELECT employee_id FROM ownership WHERE employer_id = "
|
||||
+ userId + ")";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s)
|
||||
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet answer_results = answer_statement.executeQuery(query);
|
||||
answer_results.beforeFirst();
|
||||
while (answer_results.next())
|
||||
{
|
||||
int employeeId = answer_results.getInt("userid");
|
||||
String firstName = answer_results.getString("first_name");
|
||||
String lastName = answer_results.getString("last_name");
|
||||
String role = answer_results.getString("role");
|
||||
//System.out.println("Retrieving employee stub for role " + role);
|
||||
EmployeeStub stub = new EmployeeStub(employeeId, firstName,
|
||||
lastName, role);
|
||||
employees.add(stub);
|
||||
}
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error getting employees");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error getting employees");
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return employees;
|
||||
}
|
||||
}
|
||||
219
main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Login.java
Executable file
219
main/project/JavaSource/org/owasp/webgoat/lessons/GoatHillsFinancial/Login.java
Executable file
@ -0,0 +1,219 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
import java.util.List;
|
||||
import java.util.Vector;
|
||||
|
||||
import org.owasp.webgoat.session.EmployeeStub;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class Login extends DefaultLessonAction
|
||||
{
|
||||
|
||||
private LessonAction chainedAction;
|
||||
|
||||
|
||||
public Login(GoatHillsFinancial lesson, String lessonName, String actionName,
|
||||
LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
ValidationException
|
||||
{
|
||||
//System.out.println("Login.handleRequest()");
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
List employees = getAllEmployees(s);
|
||||
setSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.STAFF_ATTRIBUTE_KEY, employees);
|
||||
|
||||
int employeeId = -1;
|
||||
try
|
||||
{
|
||||
employeeId = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.EMPLOYEE_ID);
|
||||
String password = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.PASSWORD);
|
||||
|
||||
// Attempt authentication
|
||||
if (login(s, employeeId, password))
|
||||
{
|
||||
// Execute the chained Action if authentication succeeded.
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
else
|
||||
s.setMessage("Login failed");
|
||||
}
|
||||
catch (ParameterNotFoundException pnfe)
|
||||
{
|
||||
// No credentials offered, so we log them out
|
||||
setSessionAttribute(s, getLessonName() + ".isAuthenticated",
|
||||
Boolean.FALSE);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* After this.handleRequest() is called, when the View asks for the current JSP to load,
|
||||
* it will get one initialized by this call.
|
||||
*/
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
String nextPage = GoatHillsFinancial.LOGIN_ACTION;
|
||||
|
||||
if (isAuthenticated(s))
|
||||
nextPage = chainedAction.getNextPage(s);
|
||||
|
||||
return nextPage;
|
||||
|
||||
}
|
||||
|
||||
|
||||
public boolean requiresAuthentication()
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
public boolean login(WebSession s, int userId, String password)
|
||||
{
|
||||
//System.out.println("Logging in to lesson");
|
||||
boolean authenticated = false;
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = " + userId
|
||||
+ " and password = '" + password + "'";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s)
|
||||
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet answer_results = answer_statement.executeQuery(query);
|
||||
if (answer_results.first())
|
||||
{
|
||||
setSessionAttribute(s,
|
||||
getLessonName() + ".isAuthenticated", Boolean.TRUE);
|
||||
setSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.USER_ID, Integer
|
||||
.toString(userId));
|
||||
authenticated = true;
|
||||
}
|
||||
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error logging in");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error logging in");
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
//System.out.println("Lesson login result: " + authenticated);
|
||||
return authenticated;
|
||||
}
|
||||
|
||||
|
||||
public List<EmployeeStub> getAllEmployees(WebSession s)
|
||||
{
|
||||
List<EmployeeStub> employees = new Vector<EmployeeStub>();
|
||||
|
||||
// Query the database for all roles the given employee belongs to
|
||||
// Query the database for all employees "owned" by these roles
|
||||
|
||||
try
|
||||
{
|
||||
String query = "SELECT employee.userid,first_name,last_name,role FROM employee,roles "
|
||||
+ "where employee.userid=roles.userid";
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s)
|
||||
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet answer_results = answer_statement.executeQuery(query);
|
||||
answer_results.beforeFirst();
|
||||
while (answer_results.next())
|
||||
{
|
||||
int employeeId = answer_results.getInt("userid");
|
||||
String firstName = answer_results.getString("first_name");
|
||||
String lastName = answer_results.getString("last_name");
|
||||
String role = answer_results.getString("role");
|
||||
EmployeeStub stub = new EmployeeStub(employeeId, firstName,
|
||||
lastName, role);
|
||||
employees.add(stub);
|
||||
}
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error getting employees");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error getting employees");
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return employees;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,84 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class Logout extends DefaultLessonAction
|
||||
{
|
||||
|
||||
private LessonAction chainedAction;
|
||||
|
||||
|
||||
public Logout(GoatHillsFinancial lesson, String lessonName, String actionName,
|
||||
LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
ValidationException
|
||||
{
|
||||
//System.out.println("Logging out");
|
||||
|
||||
setSessionAttribute(s, getLessonName() + ".isAuthenticated",
|
||||
Boolean.FALSE);
|
||||
|
||||
// FIXME: Maybe we should forward to Login.
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return chainedAction.getNextPage(s);
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,49 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class SearchStaff extends DefaultLessonAction
|
||||
{
|
||||
|
||||
public SearchStaff(GoatHillsFinancial lesson, String lessonName,
|
||||
String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return GoatHillsFinancial.SEARCHSTAFF_ACTION;
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,247 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.ValidationException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class UpdateProfile extends DefaultLessonAction
|
||||
{
|
||||
|
||||
private LessonAction chainedAction;
|
||||
|
||||
public UpdateProfile(GoatHillsFinancial lesson, String lessonName,
|
||||
String actionName, LessonAction chainedAction)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
this.chainedAction = chainedAction;
|
||||
}
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
UnauthenticatedException, UnauthorizedException,
|
||||
ValidationException
|
||||
{
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.USER_ID);
|
||||
|
||||
int subjectId = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.EMPLOYEE_ID, 0);
|
||||
|
||||
String firstName = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.FIRST_NAME);
|
||||
String lastName = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.LAST_NAME);
|
||||
String ssn = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.SSN);
|
||||
String title = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.TITLE);
|
||||
String phone = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.PHONE_NUMBER);
|
||||
String address1 = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.ADDRESS1);
|
||||
String address2 = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.ADDRESS2);
|
||||
int manager = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.MANAGER);
|
||||
String startDate = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.START_DATE);
|
||||
int salary = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.SALARY);
|
||||
String ccn = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.CCN);
|
||||
int ccnLimit = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.CCN_LIMIT);
|
||||
String disciplinaryActionDate = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.DISCIPLINARY_DATE);
|
||||
String disciplinaryActionNotes = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.DISCIPLINARY_NOTES);
|
||||
String personalDescription = s.getParser().getStringParameter(
|
||||
GoatHillsFinancial.DESCRIPTION);
|
||||
|
||||
Employee employee = new Employee(subjectId, firstName, lastName,
|
||||
ssn, title, phone, address1, address2, manager, startDate,
|
||||
salary, ccn, ccnLimit, disciplinaryActionDate,
|
||||
disciplinaryActionNotes, personalDescription);
|
||||
|
||||
if (subjectId > 0)
|
||||
{
|
||||
this.changeEmployeeProfile(s, userId, subjectId, employee);
|
||||
setRequestAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.EMPLOYEE_ID, Integer
|
||||
.toString(subjectId));
|
||||
}
|
||||
else
|
||||
this.createEmployeeProfile(s, userId, employee);
|
||||
|
||||
try
|
||||
{
|
||||
chainedAction.handleRequest(s);
|
||||
}
|
||||
catch (UnauthenticatedException ue1)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue1.printStackTrace();
|
||||
}
|
||||
catch (UnauthorizedException ue2)
|
||||
{
|
||||
System.out.println("Internal server error");
|
||||
ue2.printStackTrace();
|
||||
}
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return GoatHillsFinancial.VIEWPROFILE_ACTION;
|
||||
}
|
||||
|
||||
public void changeEmployeeProfile(WebSession s, int userId, int subjectId,
|
||||
Employee employee) throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
// Note: The password field is ONLY set by ChangePassword
|
||||
String query = "UPDATE employee SET first_name = ?, last_name = ?, ssn = ?, title = ?, phone = ?, address1 = ?, address2 = ?,"
|
||||
+ " manager = ?, start_date = ?, ccn = ?, ccn_limit = ?,"
|
||||
+ " personal_description = ? WHERE userid = ?;";
|
||||
try
|
||||
{
|
||||
PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
|
||||
|
||||
ps.setString(1, employee.getFirstName());
|
||||
ps.setString(2, employee.getLastName());
|
||||
ps.setString(3, employee.getSsn());
|
||||
ps.setString(4, employee.getTitle());
|
||||
ps.setString(5, employee.getPhoneNumber());
|
||||
ps.setString(6, employee.getAddress1());
|
||||
ps.setString(7, employee.getAddress2());
|
||||
ps.setInt(8, employee.getManager());
|
||||
ps.setString(9, employee.getStartDate());
|
||||
ps.setString(10, employee.getCcn());
|
||||
ps.setInt(11, employee.getCcnLimit());
|
||||
ps.setString(12, employee.getPersonalDescription());
|
||||
ps.setInt(13, subjectId);
|
||||
ps.execute();
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error updating employee profile");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error updating employee profile");
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
private int getNextUID(WebSession s)
|
||||
{
|
||||
int uid = -1;
|
||||
try
|
||||
{
|
||||
Statement statement = WebSession.getConnection(s).createStatement(
|
||||
ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet results = statement
|
||||
.executeQuery("select max(userid) as uid from employee");
|
||||
results.first();
|
||||
uid = results.getInt("uid");
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
sqle.printStackTrace();
|
||||
s.setMessage("Error updating employee profile");
|
||||
}
|
||||
catch (ClassNotFoundException e)
|
||||
{
|
||||
// TODO Auto-generated catch block
|
||||
e.printStackTrace();
|
||||
}
|
||||
return uid + 1;
|
||||
}
|
||||
|
||||
public void createEmployeeProfile(WebSession s, int userId,
|
||||
Employee employee) throws UnauthorizedException
|
||||
{
|
||||
try
|
||||
{
|
||||
int nextId = getNextUID(s);
|
||||
String query = "INSERT INTO employee VALUES ( " + nextId + ", ?,?,?,?,?,?,?,?,?,?,?,?,?,?)";
|
||||
|
||||
try
|
||||
{
|
||||
PreparedStatement ps = WebSession.getConnection(s).prepareStatement(query);
|
||||
|
||||
ps.setString(1, employee.getFirstName().toLowerCase());
|
||||
ps.setString(2, employee.getLastName());
|
||||
ps.setString(3, employee.getSsn());
|
||||
ps.setString(4, employee.getTitle());
|
||||
ps.setString(5, employee.getPhoneNumber());
|
||||
ps.setString(6, employee.getAddress1());
|
||||
ps.setString(7, employee.getAddress2());
|
||||
ps.setInt(8, employee.getManager());
|
||||
ps.setString(9, employee.getStartDate());
|
||||
ps.setString(10, employee.getCcn());
|
||||
ps.setInt(11, employee.getCcnLimit());
|
||||
ps.setString(12, employee.getDisciplinaryActionDate());
|
||||
ps.setString(13, employee.getDisciplinaryActionNotes());
|
||||
ps.setString(14, employee.getPersonalDescription());
|
||||
|
||||
ps.execute();
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error updating employee profile");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error updating employee profile");
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,146 @@
|
||||
package org.owasp.webgoat.lessons.GoatHillsFinancial;
|
||||
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.sql.Statement;
|
||||
|
||||
import org.owasp.webgoat.session.Employee;
|
||||
import org.owasp.webgoat.session.ParameterNotFoundException;
|
||||
import org.owasp.webgoat.session.UnauthenticatedException;
|
||||
import org.owasp.webgoat.session.UnauthorizedException;
|
||||
import org.owasp.webgoat.session.WebSession;
|
||||
|
||||
/*******************************************************************************
|
||||
*
|
||||
*
|
||||
* This file is part of WebGoat, an Open Web Application Security Project
|
||||
* utility. For details, please see http://www.owasp.org/
|
||||
*
|
||||
* Copyright (c) 2002 - 2007 Bruce Mayhew
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it under
|
||||
* the terms of the GNU General Public License as published by the Free Software
|
||||
* Foundation; either version 2 of the License, or (at your option) any later
|
||||
* version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
* FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* this program; if not, write to the Free Software Foundation, Inc., 59 Temple
|
||||
* Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*
|
||||
* Getting Source ==============
|
||||
*
|
||||
* Source for this application is maintained at code.google.com, a repository
|
||||
* for free software projects.
|
||||
*
|
||||
* For details, please see http://code.google.com/p/webgoat/
|
||||
*/
|
||||
public class ViewProfile extends DefaultLessonAction
|
||||
{
|
||||
|
||||
public ViewProfile(GoatHillsFinancial lesson, String lessonName,
|
||||
String actionName)
|
||||
{
|
||||
super(lesson, lessonName, actionName);
|
||||
}
|
||||
|
||||
|
||||
public void handleRequest(WebSession s) throws ParameterNotFoundException,
|
||||
UnauthenticatedException, UnauthorizedException
|
||||
{
|
||||
getLesson().setCurrentAction(s, getActionName());
|
||||
|
||||
if (isAuthenticated(s))
|
||||
{
|
||||
int userId = getIntSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.USER_ID);
|
||||
int employeeId = -1;
|
||||
try
|
||||
{
|
||||
// User selected employee
|
||||
employeeId = s.getParser().getIntParameter(
|
||||
GoatHillsFinancial.EMPLOYEE_ID);
|
||||
}
|
||||
catch (ParameterNotFoundException e)
|
||||
{
|
||||
// May be an internally selected employee
|
||||
employeeId = getIntRequestAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.EMPLOYEE_ID);
|
||||
}
|
||||
|
||||
Employee employee = getEmployeeProfile(s, userId, employeeId);
|
||||
setSessionAttribute(s, getLessonName() + "."
|
||||
+ GoatHillsFinancial.EMPLOYEE_ATTRIBUTE_KEY, employee);
|
||||
}
|
||||
else
|
||||
throw new UnauthenticatedException();
|
||||
|
||||
}
|
||||
|
||||
public String getNextPage(WebSession s)
|
||||
{
|
||||
return GoatHillsFinancial.VIEWPROFILE_ACTION;
|
||||
}
|
||||
|
||||
|
||||
protected Employee getEmployeeProfile(WebSession s, int userId,
|
||||
int subjectUserId) throws UnauthorizedException
|
||||
{
|
||||
Employee profile = null;
|
||||
|
||||
// Query the database for the profile data of the given employee
|
||||
try
|
||||
{
|
||||
String query = "SELECT * FROM employee WHERE userid = "
|
||||
+ subjectUserId;
|
||||
|
||||
try
|
||||
{
|
||||
Statement answer_statement = WebSession.getConnection(s)
|
||||
.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
|
||||
ResultSet.CONCUR_READ_ONLY);
|
||||
ResultSet answer_results = answer_statement.executeQuery(query);
|
||||
if (answer_results.next())
|
||||
{
|
||||
// Note: Do NOT get the password field.
|
||||
profile = new Employee(answer_results.getInt("userid"),
|
||||
answer_results.getString("first_name"),
|
||||
answer_results.getString("last_name"),
|
||||
answer_results.getString("ssn"), answer_results
|
||||
.getString("title"), answer_results
|
||||
.getString("phone"), answer_results
|
||||
.getString("address1"), answer_results
|
||||
.getString("address2"), answer_results
|
||||
.getInt("manager"), answer_results
|
||||
.getString("start_date"), answer_results
|
||||
.getInt("salary"), answer_results
|
||||
.getString("ccn"), answer_results
|
||||
.getInt("ccn_limit"), answer_results
|
||||
.getString("disciplined_date"),
|
||||
answer_results.getString("disciplined_notes"),
|
||||
answer_results.getString("personal_description"));
|
||||
/* System.out.println("Retrieved employee from db: " +
|
||||
profile.getFirstName() + " " + profile.getLastName() +
|
||||
" (" + profile.getId() + ")");
|
||||
*/}
|
||||
}
|
||||
catch (SQLException sqle)
|
||||
{
|
||||
s.setMessage("Error getting employee profile");
|
||||
sqle.printStackTrace();
|
||||
}
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
s.setMessage("Error getting employee profile");
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
return profile;
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user