dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#961: Give each user its own schema for the lessons

Browse Source 
This way we can reset a lesson using the database for each user and not for all users at once.
Also solves the issue that when someone solves the lesson it is solved for all users on the same WebGoat instance
This commit is contained in:
Nanne Baars
2021-04-10 09:47:07 +02:00
committed by Nanne Baars
parent 04d065fd87
commit e49f5d610f
30 changed files with 281 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACUsers.java
View File

@ -83,7 +83,7 @@ public class MissingFunctionACUsers {
//@PreAuthorize()
public WebGoatUser addUser(@RequestBody WebGoatUser newUser) {
try {
userService.addUser(newUser.getUsername(),newUser.getPassword(),newUser.getRole());
userService.addUser(newUser.getUsername(),newUser.getPassword());
return userService.loadUserByUsername(newUser.getUsername());
} catch (Exception ex) {
log.error("Error creating new User", ex);

6
webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/Users.java
View File

@ -22,11 +22,11 @@
package org.owasp.webgoat.missing_ac;
import org.owasp.webgoat.LessonDataSource;
import org.owasp.webgoat.session.UserSessionData;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.sql.DataSource;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
@ -36,9 +36,9 @@ import java.util.HashMap;
public class Users {
private UserSessionData userSessionData;
private DataSource dataSource;
private LessonDataSource dataSource;
public Users(UserSessionData userSessionData, DataSource dataSource) {
public Users(UserSessionData userSessionData, LessonDataSource dataSource) {
this.userSessionData = userSessionData;
this.dataSource = dataSource;
}