-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #21 from motech-implementations/audit_fixes_final
Audit fixes final
- Loading branch information
Showing
65 changed files
with
358 additions
and
123 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -62,8 +62,12 @@ String sendPassword(@PathVariable String encoded) throws Exception { | |
| //changed the 'from' emailId from beehyv domain address to govt domain address | ||
| String email = tokenItems[0]; | ||
| String password = tokenItems[1]; | ||
| String subject = "Reset Password for MIS Portal"; | ||
| String message = "\"Dear user,<br/><br/><p>As per your request, your password has been reset to: <b>" + | ||
| String type = tokenItems[2]; | ||
| String subject = "Password for MIS Portal"; | ||
| String line = "As per your request, your password has been reset to:"; | ||
| if(type.equals("new")) line = "The password for your newly created MIS account is:"; | ||
| else if(type.equals("admin")) line = "The password for your MIS account has been reset by the admin to:"; | ||
| String message = "\"Dear user,<br/><br/><p>"+line+"<b>" + | ||
| password + | ||
| "</b></p><br/><p>Once you login to the MIS portal with the above password, the system will direct you to change the default password as it is mandatory.</p><br/>" + | ||
| "<p>Thanks,</p>" +"<p>NSP Support</p>\""; | ||
|
|
@@ -81,19 +85,6 @@ String sendPassword(@PathVariable String encoded) throws Exception { | |
| return "failure"; | ||
| } | ||
| }catch (InterruptedException e){return "failure";} | ||
| // EmailInfo newMail = new EmailInfo(); | ||
| // newMail.setFrom("[email protected]"); | ||
| // newMail.setTo(email); | ||
| // Calendar c = Calendar.getInstance(); // this takes current date | ||
| // c.add(Calendar.MONTH, -1); | ||
| // c.set(Calendar.DATE, 1); | ||
| // newMail.setSubject("Reset Password for MIS Portal"); | ||
| // newMail.setBody("Dear user,<br/><br/><p>As per your request, your password has been reset to: <b>" + | ||
| // password + | ||
| // "</b></p><br/><p>Once you login to the MIS portal with the above password, the system will direct you to change the default password as it is mandatory.</p><br/>" + | ||
| // "<p>Thanks,</p>" + | ||
| // "<p>NSP Support</p>"); | ||
| // return emailService.sendMailPassword(newMail); | ||
| } | ||
|
|
||
| @RequestMapping(value = "/sendCaptcha/{captchaResponse}", method = RequestMethod.GET) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
38 changes: 38 additions & 0 deletions
38
NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/CsrfInterceptor.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package com.beehyv.nmsreporting.business.impl; | ||
|
|
||
| import com.beehyv.nmsreporting.business.UserService; | ||
| import com.beehyv.nmsreporting.model.User; | ||
| import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.web.servlet.ModelAndView; | ||
| import org.springframework.web.servlet.handler.HandlerInterceptorAdapter; | ||
|
|
||
| import javax.servlet.http.HttpServletRequest; | ||
| import javax.servlet.http.HttpServletResponse; | ||
|
|
||
| public class CsrfInterceptor extends HandlerInterceptorAdapter { | ||
| @Autowired | ||
| private UserService userService; | ||
|
|
||
| @Override | ||
| public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { | ||
| User currentUser = userService.getCurrentUser(); | ||
|
|
||
| if(currentUser == null) { | ||
| return false; | ||
| } | ||
| String token = "dhty" + currentUser.getUserId().toString() + "alkihkf"; | ||
| return request.getHeader("csrfToken").equals(token); | ||
| } | ||
|
|
||
| @Override | ||
| public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception { | ||
| } | ||
|
|
||
| @Override | ||
| public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception { | ||
| } | ||
|
|
||
| @Override | ||
| public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.