diff --git a/webgoat-container/pom.xml b/webgoat-container/pom.xml
index b75ff052a..d04601c06 100644
--- a/webgoat-container/pom.xml
+++ b/webgoat-container/pom.xml
@@ -161,11 +161,7 @@
org.springframework.bootspring-boot-starter-actuator
-
- org.springframework.boot
- spring-boot-devtools
- true
-
+
com.fasterxml.jackson.dataformat
@@ -264,6 +260,11 @@
+
+ org.springframework.boot
+ spring-boot-starter-test
+ test
+ junitjunit
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java b/webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java
index 9180277ad..e2a09ab3a 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/HammerHead.java
@@ -52,7 +52,6 @@ public class HammerHead {
/**
* Entry point for WebGoat, redirects to the first lesson found within the course.
*/
- //// TODO: 11/6/2016 course necessary?
@RequestMapping(path = "/attack", method = {RequestMethod.GET, RequestMethod.POST})
public ModelAndView attack() {
return new ModelAndView("redirect:" + "start.mvc" + course.getFirstLesson().getLink());
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java b/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java
index 7fde94e7e..a00509665 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/WebGoat.java
@@ -30,14 +30,17 @@
*/
package org.owasp.webgoat;
+import lombok.SneakyThrows;
import org.owasp.webgoat.plugins.Plugin;
import org.owasp.webgoat.plugins.PluginClassLoader;
import org.owasp.webgoat.plugins.PluginEndpointPublisher;
import org.owasp.webgoat.plugins.PluginsLoader;
import org.owasp.webgoat.session.Course;
+import org.owasp.webgoat.session.UserTracker;
import org.owasp.webgoat.session.WebSession;
import org.owasp.webgoat.session.WebgoatContext;
import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.builder.SpringApplicationBuilder;
@@ -62,15 +65,10 @@ public class WebGoat extends SpringBootServletInitializer {
}
@Bean(name = "pluginTargetDirectory")
- public File pluginTargetDirectory() {
- return com.google.common.io.Files.createTempDir();
+ public File pluginTargetDirectory(@Value("${webgoat.user.directory}") final String webgoatHome) {
+ return new File(webgoatHome);
}
-// @Bean
-// public ApplicationListener closeEvent(@Qualifier("pluginTargetDirectory") File pluginTargetDirectory) {
-// return e -> pluginTargetDirectory.delete();
-// }
-
@Bean
public PluginClassLoader pluginClassLoader() {
return new PluginClassLoader(PluginClassLoader.class.getClassLoader());
@@ -96,4 +94,14 @@ public class WebGoat extends SpringBootServletInitializer {
return course;
}
+
+ @Bean
+ @Scope(value = "session", proxyMode = ScopedProxyMode.TARGET_CLASS)
+ @SneakyThrows
+ public UserTracker userTracker(@Value("${webgoat.user.directory}") final String webgoatHome, WebSession webSession) {
+ UserTracker userTracker = new UserTracker(webgoatHome, webSession.getUserName());
+ userTracker.load();
+ return userTracker;
+ }
+
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java
index 978fc293e..4648c0335 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AbstractLesson.java
@@ -1,5 +1,7 @@
package org.owasp.webgoat.lessons;
+import lombok.Getter;
+import lombok.Setter;
import org.owasp.webgoat.session.Screen;
import java.util.List;
@@ -42,6 +44,10 @@ public abstract class AbstractLesson extends Screen implements Comparable
*
@@ -135,6 +142,7 @@ public abstract class AbstractLesson extends Screen implements ComparablegetHints.
+ *
* @return a {@link java.util.List} object.
*/
public abstract List getHints();
@@ -198,8 +206,7 @@ public abstract class AbstractLesson extends Screen implements Comparable
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ *
+ */
+package org.owasp.webgoat.lessons;
+
+import org.owasp.webgoat.lessons.model.AttackResult;
+import org.owasp.webgoat.session.UserTracker;
+import org.owasp.webgoat.session.WebSession;
+import org.springframework.beans.factory.annotation.Autowired;
+
+/**
+ * Each lesson can define an endpoint which can support the lesson. So for example if you create a lesson which uses JavaScript and
+ * needs to call out to the server to fetch data you can define an endpoint in that lesson. WebGoat will pick up this endpoint and
+ * Spring will publish it.
+ *
+ * Extend this class and implement the met
+ *
+ * Note: each subclass should declare this annotation otherwise the WebGoat framework cannot find your endpoint.
+ */
+public abstract class Assignment extends Endpoint {
+
+ @Autowired
+ private UserTracker userTracker;
+ @Autowired
+ private WebSession webSession;
+
+ //// TODO: 11/13/2016 events better fit?
+ protected AttackResult trackProgress(AttackResult attackResult) {
+ if (attackResult.assignmentSolved()) {
+ userTracker.assignmentSolved(webSession.getCurrentLesson(), this);
+ } else {
+ userTracker.assignmentFailed(webSession.getCurrentLesson());
+ }
+ return attackResult;
+ }
+
+}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AssignmentEndpoint.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Endpoint.java
similarity index 60%
rename from webgoat-container/src/main/java/org/owasp/webgoat/lessons/AssignmentEndpoint.java
rename to webgoat-container/src/main/java/org/owasp/webgoat/lessons/Endpoint.java
index 1a7e3aee2..18e33f4ef 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AssignmentEndpoint.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/Endpoint.java
@@ -1,3 +1,11 @@
+package org.owasp.webgoat.lessons;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.boot.actuate.endpoint.mvc.MvcEndpoint;
+
+import java.io.File;
+
/**
* ************************************************************************************************
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@@ -22,36 +30,16 @@
* Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
* projects.
*
+ *
+ * @author nbaars
+ * @version $Id: $Id
+ * @since November 13, 2016
*/
-package org.owasp.webgoat.lessons;
-
-import org.owasp.webgoat.lessons.model.AttackResult;
-import org.owasp.webgoat.session.LessonTracker;
-import org.owasp.webgoat.session.UserTracker;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.boot.actuate.endpoint.Endpoint;
-import org.springframework.boot.actuate.endpoint.mvc.MvcEndpoint;
-
-import java.io.File;
-
-/**
- * Each lesson can define an endpoint which can support the lesson. So for example if you create a lesson which uses JavaScript and
- * needs to call out to the server to fetch data you can define an endpoint in that lesson. WebGoat will pick up this endpoint and
- * Spring will publish it.
- *
- * Extend this class and implement the met
- *
- * Note: each subclass should declare this annotation otherwise the WebGoat framework cannot find your endpoint.
- */
-@LessonEndpointMapping
-public abstract class AssignmentEndpoint implements MvcEndpoint {
+public abstract class Endpoint implements MvcEndpoint {
@Autowired
@Qualifier("pluginTargetDirectory")
private File pluginDirectory;
- @Autowired
- private UserTracker userTracker;
/**
* The directory of the plugin directory in which the lessons resides, so if you want to access the lesson 'ClientSideFiltering' you will
@@ -69,23 +57,6 @@ public abstract class AssignmentEndpoint implements MvcEndpoint {
return new File(this.pluginDirectory, "plugin");
}
- /**
- * Get the lesson tracker which is based on the current user and do the
- * @return
- */
- protected LessonTracker getLessonTracker() {
- LessonTracker lessonTracker = userTracker.getCurrentLessonTracker();
- return lessonTracker;
- }
-
- protected AttackResult trackProgress(AttackResult attackResult) {
- //// TODO: 11/5/2016 improve
- if (attackResult.isLessonCompleted()) {
- getLessonTracker().incrementNumVisits();
- }
- getLessonTracker().setCompleted(attackResult.isLessonCompleted());
- return attackResult;
- }
@Override
public final boolean isSensitive() {
@@ -93,8 +64,7 @@ public abstract class AssignmentEndpoint implements MvcEndpoint {
}
@Override
- public final Class extends Endpoint> getEndpointType() {
+ public final Class extends org.springframework.boot.actuate.endpoint.Endpoint> getEndpointType() {
return null;
}
-
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java
index 2825ef6e7..70d0fdf52 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonAdapter.java
@@ -30,6 +30,7 @@
*/
package org.owasp.webgoat.lessons;
+//// TODO: 11/8/2016 remove
public abstract class LessonAdapter extends AbstractLesson {
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpointMapping.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpointMapping.java
deleted file mode 100644
index 94bc84c2c..000000000
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/LessonEndpointMapping.java
+++ /dev/null
@@ -1,49 +0,0 @@
-
-/**
- *************************************************************************************************
- * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
- * please see http://www.owasp.org/
- *
- * Copyright (c) 2002 - 20014 Bruce Mayhew
- *
- * This program is free software; you can redistribute it and/or modify it under the terms of the
- * GNU General Public License as published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
- * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with this program; if
- * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
- *
- * Getting Source ==============
- *
- * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
- * projects.
- *
- *
- * @author WebGoat
- * @since December 12, 2015
- * @version $Id: $Id
- */
-package org.owasp.webgoat.lessons;
-
-import org.springframework.stereotype.Component;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- * Annotation as a marker annotation. During the startup we scan the plugins for classes which use this annotation.
- * @see AssignmentEndpoint for more information.
- */
-@Component
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-public @interface LessonEndpointMapping { }
-
-
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java
index 074391ba6..c0a10e9d4 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/NewLesson.java
@@ -1,9 +1,5 @@
package org.owasp.webgoat.lessons;
-import lombok.Getter;
-import lombok.Setter;
-import org.owasp.webgoat.session.WebSession;
-
import java.util.List;
/**
@@ -37,9 +33,7 @@ import java.util.List;
*/
public abstract class NewLesson extends LessonAdapter {
- @Setter
- @Getter
- private int totalNumberOfAssignments = 0;
+
@Override
public abstract Category getDefaultCategory();
@@ -55,10 +49,4 @@ public abstract class NewLesson extends LessonAdapter {
@Override
public abstract String getId();
- public final List getHints(WebSession w) {
- throw new IllegalStateException("Do not use");
- }
-
-
-
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/AttackResult.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/AttackResult.java
index 95af8dacf..d90bf8258 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/AttackResult.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/AttackResult.java
@@ -1,5 +1,7 @@
package org.owasp.webgoat.lessons.model;
+import lombok.Getter;
+
/**
* ************************************************************************************************
* This file is part of WebGoat, an Open Web Application Security Project utility. For details,
@@ -29,6 +31,7 @@ package org.owasp.webgoat.lessons.model;
* @version $Id: $Id
* @since August 13, 2016
*/
+@Getter
public class AttackResult {
private boolean lessonCompleted;
@@ -54,15 +57,7 @@ public class AttackResult {
return attackResult;
}
- public boolean isLessonCompleted() {
+ public boolean assignmentSolved() {
return lessonCompleted;
}
-
- public String getFeedback() {
- return feedback;
- }
-
- public String getOutput() {
- return output;
- }
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java
index ad661ab59..427a7f57c 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/model/LessonInfoModel.java
@@ -1,5 +1,6 @@
package org.owasp.webgoat.lessons.model;
+import lombok.Getter;
import org.owasp.webgoat.lessons.AbstractLesson;
import org.owasp.webgoat.session.WebSession;
@@ -10,6 +11,7 @@ import org.owasp.webgoat.session.WebSession;
* @version $Id: $Id
*/
//// TODO: 11/5/2016 this can be removed???
+@Getter
public class LessonInfoModel {
private String lessonTitle;
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java b/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java
index b34a1b351..dac0619be 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/plugins/Plugin.java
@@ -3,18 +3,16 @@ package org.owasp.webgoat.plugins;
import com.google.common.base.Optional;
import com.google.common.collect.Lists;
import org.owasp.webgoat.lessons.AbstractLesson;
-import org.owasp.webgoat.lessons.AssignmentEndpoint;
+import org.owasp.webgoat.lessons.Assignment;
+import org.owasp.webgoat.lessons.Endpoint;
import org.owasp.webgoat.lessons.NewLesson;
import org.springframework.util.StringUtils;
import java.io.File;
import java.nio.file.Path;
-import java.util.HashMap;
import java.util.List;
-import java.util.Map;
import static org.owasp.webgoat.plugins.PluginFileUtils.fileEndsWith;
-import static org.owasp.webgoat.plugins.PluginFileUtils.hasParentDirectoryWithName;
/**
*
Plugin class.
@@ -24,23 +22,22 @@ import static org.owasp.webgoat.plugins.PluginFileUtils.hasParentDirectoryWithNa
*/
public class Plugin {
- private static final String NAME_LESSON_SOLUTION_DIRECTORY = "lessonSolutions";
- private static final String NAME_LESSON_PLANS_DIRECTORY = "lessonPlans";
-
private PluginClassLoader classLoader;
private Class newLesson;
- private List> lessonEndpoints = Lists.newArrayList();
- private Map solutionLanguageFiles = new HashMap<>();
- private Map lessonPlansLanguageFiles = new HashMap<>();
+ private List> assignments = Lists.newArrayList();
+ private List> endpoints = Lists.newArrayList();
private List pluginFiles = Lists.newArrayList();
- private File lessonSourceFile;
public Plugin(PluginClassLoader classLoader) {
this.classLoader = classLoader;
}
- public List> getLessonEndpoints() {
- return this.lessonEndpoints;
+ public List> getAssignments() {
+ return this.assignments;
+ }
+
+ public List> getEndpoints() {
+ return this.endpoints;
}
/**
@@ -74,8 +71,10 @@ public class Plugin {
try {
Class clazz = classLoader.loadClass(realClassName);
- if (AssignmentEndpoint.class.isAssignableFrom(clazz)) {
- this.lessonEndpoints.add(clazz);
+ if (Assignment.class.isAssignableFrom(clazz)) {
+ this.assignments.add(clazz);
+ } else if (Endpoint.class.isAssignableFrom(clazz)) {
+ this.endpoints.add(clazz);
}
} catch (ClassNotFoundException ce) {
throw new PluginLoadingFailure("Class " + realClassName + " listed in jar but unable to load the class.", ce);
@@ -89,16 +88,6 @@ public class Plugin {
* @param file a {@link java.nio.file.Path} object.
*/
public void loadFiles(Path file) {
- if (fileEndsWith(file, ".html") && hasParentDirectoryWithName(file, NAME_LESSON_SOLUTION_DIRECTORY)) {
- solutionLanguageFiles.put(file.getParent().getFileName().toString(), file.toFile());
- }
- if (fileEndsWith(file, ".html") && hasParentDirectoryWithName(file, NAME_LESSON_PLANS_DIRECTORY)) {
- lessonPlansLanguageFiles.put(file.getParent().getFileName().toString(), file.toFile());
- }
- if (fileEndsWith(file, ".java")) {
- lessonSourceFile = file.toFile();
- }
-
if (fileEndsWith(file, ".css", ".jsp", ".js")) {
pluginFiles.add(file.toFile());
}
@@ -106,13 +95,14 @@ public class Plugin {
/**
* Lesson is optional, it is also possible that the supplied jar contains only helper classes.
- * Lesson could be a new lesson (adoc based) or still ECS based.
*
* @return a {@link com.google.common.base.Optional} object.
*/
public Optional getLesson() {
try {
if (newLesson != null) {
+ AbstractLesson lesson = newLesson.newInstance();
+ lesson.setAssignments(this.assignments);
return Optional.of(newLesson.newInstance());
}
} catch (IllegalAccessException | InstantiationException e) {
@@ -121,42 +111,5 @@ public class Plugin {
return Optional.absent();
}
- /**
- *
getLessonSolution.
- *
- * @param language a {@link java.lang.String} object.
- * @return a {@link com.google.common.base.Optional} object.
- */
- public Optional getLessonSolution(String language) {
- return Optional.fromNullable(this.solutionLanguageFiles.get(language));
- }
-
- /**
- *
- *
- * @param lessonProperties The lessonProperties to set.
- */
- public void setLessonProperties(Properties lessonProperties) {
- this.lessonProperties = lessonProperties;
+ void reset() {
+ solvedAssignments.clear();
}
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java
index 1e073b391..5e2dbdd22 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/UserTracker.java
@@ -1,13 +1,16 @@
package org.owasp.webgoat.session;
+import lombok.SneakyThrows;
import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.Assignment;
import org.springframework.beans.factory.annotation.Value;
-import org.springframework.stereotype.Component;
+import org.springframework.util.FileCopyUtils;
+import org.springframework.util.SerializationUtils;
+import java.io.File;
import java.util.HashMap;
import java.util.Map;
-import java.util.Optional;
/**
@@ -40,34 +43,15 @@ import java.util.Optional;
* @version $Id: $Id
* @since October 29, 2003
*/
-@Component
public class UserTracker {
- private static Map> storage = new HashMap<>();
private final String webgoatHome;
- private final WebSession webSession;
+ private final String user;
+ private Map storage = new HashMap<>();
- public UserTracker(@Value("${webgoat.user.directory}") final String webgoatHome, final WebSession webSession) {
+ public UserTracker(@Value("${webgoat.user.directory}") final String webgoatHome, final String user) {
this.webgoatHome = webgoatHome;
- this.webSession = webSession;
- }
-
- /**
- *
getCurrentLessonTracker.
- *
- * @return a {@link org.owasp.webgoat.session.LessonTracker} object.
- */
- public LessonTracker getCurrentLessonTracker() {
- String lessonTitle = webSession.getCurrentLesson().getTitle();
- String username = webSession.getUserName();
- HashMap usermap = getUserMap(username);
- LessonTracker tracker = usermap.get(lessonTitle);
- if (tracker == null) {
- // Creates a new lesson tracker, if one does not exist on disk.
- tracker = LessonTracker.load(webSession, username, webSession.getCurrentLesson());
- usermap.put(lessonTitle, tracker);
- }
- return tracker;
+ this.user = user;
}
/**
@@ -76,31 +60,45 @@ public class UserTracker {
* @param lesson the lesson
* @return the optional lesson tracker
*/
- public Optional getLessonTracker(AbstractLesson lesson) {
- String username = webSession.getUserName();
- return Optional.ofNullable(getUserMap(username).getOrDefault(lesson.getTitle(), null));
- }
-
-
- /**
- * Gets the userMap attribute of the UserTracker object
- *
- * @param userName Description of the Parameter
- * @return The userMap value
- */
- private HashMap getUserMap(String userName) {
-
- HashMap usermap = storage.get(userName);
-
- if (usermap == null) {
-
- usermap = new HashMap<>();
-
- storage.put(userName, usermap);
-
+ public LessonTracker getLessonTracker(AbstractLesson lesson) {
+ LessonTracker lessonTracker = storage.get(lesson.getTitle());
+ if (lessonTracker == null) {
+ lessonTracker = new LessonTracker(lesson);
+ storage.put(lesson.getTitle(), lessonTracker);
}
-
- return (usermap);
+ return lessonTracker;
}
+ public void assignmentSolved(AbstractLesson lesson, Assignment assignment) {
+ LessonTracker lessonTracker = getLessonTracker(lesson);
+ lessonTracker.incrementAttempts();
+ lessonTracker.assignmentSolved(assignment.getClass().getSimpleName());
+ save();
+ }
+
+ public void assignmentFailed(AbstractLesson lesson) {
+ LessonTracker lessonTracker = getLessonTracker(lesson);
+ lessonTracker.incrementAttempts();
+ save();
+ }
+
+ @SneakyThrows
+ public void load() {
+ File file = new File(webgoatHome, user);
+ if (file.exists() && file.isFile()) {
+ this.storage = (Map) SerializationUtils.deserialize(FileCopyUtils.copyToByteArray(file));
+ }
+ }
+
+ @SneakyThrows
+ private void save() {
+ File file = new File(webgoatHome, user);
+ FileCopyUtils.copy(SerializationUtils.serialize(this.storage), file);
+ }
+
+
+ public void reset(AbstractLesson al) {
+ getLessonTracker(al).reset();
+ save();
+ }
}
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java b/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java
index e70ac70cd..858610b4a 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/session/WebSession.java
@@ -2,7 +2,6 @@ package org.owasp.webgoat.session;
import lombok.extern.slf4j.Slf4j;
import org.owasp.webgoat.lessons.AbstractLesson;
-import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.User;
@@ -44,13 +43,13 @@ public class WebSession {
private final User currentUser;
private final WebgoatContext webgoatContext;
private AbstractLesson currentLesson;
+ private UserTracker userTracker;
/**
* Constructor for the WebSession object
*
* @param webgoatContext a {@link org.owasp.webgoat.session.WebgoatContext} object.
*/
- @Autowired
public WebSession(WebgoatContext webgoatContext) {
this.webgoatContext = webgoatContext;
this.currentUser = (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
@@ -76,7 +75,6 @@ public class WebSession {
DatabaseUtilities.returnConnection(s.getUserName());
}
-
/**
*
Setter for the field currentScreen.
*
diff --git a/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js b/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js
index d2568cfc4..3df9a2344 100644
--- a/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js
+++ b/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js
@@ -187,22 +187,11 @@ define(['jquery',
this.restartLesson = function() {
var self=this;
- var fragment = "attack/" + self.scr + "/" + self.menu;
- console.log("Navigating to " + fragment);
- // Avoiding the trigger event - handle - navigate loop by
- // loading the lesson explicitly (after executing the restart
- // servlet).
- goatRouter.navigate(fragment);
- // Resetting the user's lesson state (assuming a single browser
- // and session per user).
$.ajax({
url:'service/restartlesson.mvc',
method:'GET'
- }).done(function(text) {
- console.log("Received a response from the restart servlet: '" + text + "'");
- // Explicitly loading the lesson instead of triggering an
- // event in goatRouter.navigate().
- self.loadLesson(self.scr,self.menu);
+ }).done(function(lessonLink) {
+ self.loadLesson(self.name);
});
};
diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js
index 6cf30b0cd..7d79fac85 100644
--- a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js
+++ b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js
@@ -77,7 +77,7 @@ define(['jquery',
this.renderFeedback(data.feedback);
this.renderOutput(data.output || "");
- if (data.lessonComplete) {
+ if (data.lessonCompleted) {
this.trigger('lesson:complete');
}
return false;
diff --git a/webgoat-container/src/test/java/org/owasp/webgoat/session/UserTrackerTest.java b/webgoat-container/src/test/java/org/owasp/webgoat/session/UserTrackerTest.java
new file mode 100644
index 000000000..1a29893db
--- /dev/null
+++ b/webgoat-container/src/test/java/org/owasp/webgoat/session/UserTrackerTest.java
@@ -0,0 +1,71 @@
+package org.owasp.webgoat.session;
+
+import com.google.common.collect.Lists;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.owasp.webgoat.lessons.AbstractLesson;
+import org.owasp.webgoat.lessons.Assignment;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.when;
+
+/**
+ * ************************************************************************************************
+ * This file is part of WebGoat, an Open Web Application Security Project utility. For details,
+ * please see http://www.owasp.org/
+ *
+ * Copyright (c) 2002 - 20014 Bruce Mayhew
+ *
+ * This program is free software; you can redistribute it and/or modify it under the terms of the
+ * GNU General Public License as published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+ * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this program; if
+ * not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * Getting Source ==============
+ *
+ * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software
+ * projects.
+ *