1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45 package org.melati.login;
46
47 import javax.servlet.http.Cookie;
48 import javax.servlet.http.HttpSession;
49
50 import org.melati.Melati;
51 import org.melati.poem.AccessPoemException;
52 import org.melati.poem.Field;
53 import org.melati.poem.PoemThread;
54 import org.melati.poem.User;
55 import org.melati.poem.UserTable;
56 import org.melati.servlet.Form;
57 import org.melati.servlet.TemplateServlet;
58 import org.melati.template.ServletTemplateContext;
59 import org.melati.util.HttpServletRequestParameters;
60 import org.melati.util.MD5Util;
61 import org.melati.util.UTF8URLEncoder;
62
63
64
65
66
67 public class LoginHandler {
68
69 static int ONEYEARINSECONDS = 60 * 60 * 24 * 365;
70
71 protected TemplateServlet servlet;
72
73
74
75
76
77
78 public LoginHandler(TemplateServlet servlet) {
79 this.servlet = servlet;
80 }
81
82 protected String loginTemplate(String name) {
83
84
85
86
87
88
89
90 return "org/melati/login/" + name;
91 }
92
93 protected String loginPageTemplate() {
94 return loginTemplate("Login");
95 }
96
97 protected String usernameUnknownTemplate() {
98 return loginTemplate("LoginFailure");
99 }
100
101 protected String passwordIncorrectTemplate() {
102 return loginTemplate("LoginFailure");
103 }
104
105 protected String loginSuccessTemplate () {
106 return loginTemplate("LoginSuccess");
107 }
108
109
110
111
112
113
114 public void setupContext(ServletTemplateContext context) {
115 HttpSession session = context.getSession();
116
117 AccessPoemException triggeringException = null;
118 if (session != null) triggeringException =
119 (AccessPoemException)session.getAttribute(Login.TRIGGERING_EXCEPTION);
120
121 if (triggeringException != null)
122 context.put("triggeringException", triggeringException);
123
124 String username = context.getFormField("field_login");
125 String password = context.getFormField("field_password");
126 UserTable<User> users = PoemThread.database().getUserTable();
127
128 context.put("login", new Field<String>(username, users.getLoginColumn()));
129 context.put("password", new Field<String>(password, users.getPasswordColumn()));
130
131 context.put("loginUnknown", Boolean.FALSE);
132 context.put("passwordWrong", Boolean.FALSE);
133 }
134
135
136
137
138
139
140
141
142
143
144 public String loginSuccessfullyAs (Melati melati,
145 ServletTemplateContext templateContext,
146 User user) {
147
148
149
150
151
152
153
154 if (Form.getFieldNulled(templateContext,"rememberme") != null) {
155 String ldb = melati.getPoemContext().getLogicalDatabase();
156 melati.getResponse().addCookie(makeCookie(ldb, user.getLogin_unsafe()));
157 melati.getResponse().addCookie(makeCookie(ldb+user.getLogin_unsafe(),
158 MD5Util.encode(user.getPassword_unsafe())));
159 }
160
161 HttpSession session = templateContext.getSession();
162
163 HttpServletRequestParameters triggeringParams =
164 (HttpServletRequestParameters)session.getAttribute(
165 Login.TRIGGERING_REQUEST_PARAMETERS);
166
167 if (triggeringParams != null) {
168 session.setAttribute(HttpSessionAccessHandler.OVERLAY_PARAMETERS,
169 triggeringParams);
170 session.removeAttribute(Login.TRIGGERING_REQUEST_PARAMETERS);
171 session.removeAttribute(Login.TRIGGERING_EXCEPTION);
172 templateContext.put("continuationURL",
173 triggeringParams.continuationURL());
174 } else {
175 if (Form.getFieldNulled(templateContext,"continuationURL")
176 != null) {
177 templateContext.put("continuationURL",
178 templateContext.getFormField("continuationURL"));
179 }
180 }
181
182 session.setAttribute(HttpSessionAccessHandler.USER, user);
183
184 return loginSuccessTemplate();
185 }
186
187
188
189
190
191 private Cookie makeCookie(String key, String value) {
192 Cookie c = new Cookie(UTF8URLEncoder.encode(key), UTF8URLEncoder.encode(value));
193
194 c.setPath("/");
195 c.setMaxAge(ONEYEARINSECONDS);
196 c.setComment("This cookie is used to automatically log you back into " +
197 "this site when you return.");
198 return c;
199 }
200
201
202
203
204
205
206
207
208
209 public String doTemplateRequest(Melati melati,
210 ServletTemplateContext templateContext)
211 throws Exception {
212
213 setupContext(templateContext);
214
215 String username = templateContext.getFormField("field_login");
216 String password = templateContext.getFormField("field_password");
217
218 if (username == null)
219 return loginPageTemplate();
220
221 User user = (User)PoemThread.database().getUserTable().getLoginColumn().
222 firstWhereEq(username);
223 if (user == null) {
224 templateContext.put("loginUnknown", Boolean.TRUE);
225 return usernameUnknownTemplate();
226 }
227
228 if (!user.getPassword_unsafe().equals(password)) {
229 templateContext.put("passwordWrong", Boolean.TRUE);
230 return passwordIncorrectTemplate();
231 }
232
233 return loginSuccessfullyAs(melati, templateContext, user);
234 }
235 }