dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Extract the stage-related code from LessonTracker into SequentialLessonTracker

Browse Source 
git-svn-id: http://webgoat.googlecode.com/svn/trunk@157 4033779f-a91e-0410-96ef-6bf7bf53c507
This commit is contained in:
rogan.dawes
2007-07-11 12:50:32 +00:00
parent 02560a2510
commit f5e56c7081
18 changed files with 234 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
webgoat/main/project/WebContent/lessons/CrossSiteScripting/ViewProfile.jsp
View File

@ -6,6 +6,7 @@ STAGE 4 FIXES Look for the <-- STAGE 4 - FIX
<%
WebSession webSession = ((WebSession)session.getAttribute("websession"));
Employee employee = (Employee) session.getAttribute("CrossSiteScripting." + CrossSiteScripting.EMPLOYEE_ATTRIBUTE_KEY);
CrossSiteScripting lesson = (CrossSiteScripting) webSession.getCurrentLesson();
// int myUserId = getIntSessionAttribute(webSession, "CrossSiteScripting." + CrossSiteScripting.USER_ID);
%>
<div class="lesson_title_box"><strong>Welcome Back </strong><span class="lesson_text_db"><%=webSession.getUserNameInLesson()%></span></div>
@ -83,7 +84,7 @@ WebSession webSession = ((WebSession)session.getAttribute("websession"));
<TD>
<!-- Encode data that might contain HTML content to protect against XSS -->
<%=webSession.htmlEncode(employee.getPersonalDescription())%>
<%=lesson.htmlEncode(webSession, employee.getPersonalDescription())%>
</TD>
<TD>
Manager:
@ -112,7 +113,7 @@ WebSession webSession = ((WebSession)session.getAttribute("websession"));
<tr>
<td width="50">
<%
if (webSession.isAuthorizedInLesson(webSession.getUserIdInLesson(), CrossSiteScripting.EDITPROFILE_ACTION))
if (webSession.isAuthorizedInLesson(webSession.getUserIdInLesson(), CrossSiteScripting.LISTSTAFF_ACTION))
{
%>
<form method="POST" action="attack?menu=<%=webSession.getCurrentMenu()%>">
@ -161,9 +162,9 @@ WebSession webSession = ((WebSession)session.getAttribute("websession"));
<%
if (webSession.getCurrentLesson().getStage(webSession) == 1005)
if (lesson.getStage(webSession) == 1005)
{
webSession.getCurrentLesson().setStage(webSession, 5);
lesson.setStage(webSession, 5);
//System.out.println("Reloading ViewProfile.jsp for stage 5 transition");
String thisPage = webSession.getCurrentLink();
//System.out.println("Redirecting to " + thisPage);

12
webgoat/main/project/WebContent/main.jsp
View File

@ -8,6 +8,7 @@ AbstractLesson currentLesson = webSession.getCurrentLesson();
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<%@page import="org.owasp.webgoat.lessons.SequentialLessonAdapter"%>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
@ -197,18 +198,23 @@ StringBuffer buildList = new StringBuffer();
<a href="javascript:toggle('lessonPlans')" target="_top" onclick="MM_nbGroup('down','group1','plans','',1)">Close this Window</a>
</div>
<%
if (webSession.isDebug()&& webSession.getCurrentLesson().getStageCount() > 1) {
AbstractLesson al = webSession.getCurrentLesson();
if (al instanceof SequentialLessonAdapter)
{
SequentialLessonAdapter sla = (SequentialLessonAdapter) al;
if (webSession.isDebug()&& sla.getStageCount() > 1) {
%><form method="post" action="attack?menu=<%=webSession.getCurrentMenu()%>">
<select name="<%= WebSession.STAGE %>" onchange="this.form.submit();">
<%
int stages = webSession.getCurrentLesson().getStageCount();
int stage = webSession.getCurrentLesson().getStage(webSession);
int stages = sla.getStageCount();
int stage = sla.getStage(webSession);
for (int i=1; i<=stages;i++) {
%><option <% if (i == stage) out.print("selected"); %> value="<%= i %>">Stage <%= i %></option>
<%
}
%></select></form><%
}
}
%>
<div id="lessonContent"><%=webSession.getInstructions()%></div>
<div id="message" class="info"><%=webSession.getMessage()%></div>