As per your request, your password has been reset to: " +
+ String type = tokenItems[2];
+ String subject = "Password for MIS Portal";
+ String line = "As per your request, your password has been reset to:";
+ if(type.equals("new")) line = "The password for your newly created MIS account is:";
+ else if(type.equals("admin")) line = "The password for your MIS account has been reset by the admin to:";
+ String message = "\"Dear user,
"+line+"" +
password +
"
Once you login to the MIS portal with the above password, the system will direct you to change the default password as it is mandatory.
" +
"
Thanks,
" +"
NSP Support
\"";
@@ -81,19 +85,6 @@ String sendPassword(@PathVariable String encoded) throws Exception {
return "failure";
}
}catch (InterruptedException e){return "failure";}
-// EmailInfo newMail = new EmailInfo();
-// newMail.setFrom("nsp-reports@beehyv.com");
-// newMail.setTo(email);
-// Calendar c = Calendar.getInstance(); // this takes current date
-// c.add(Calendar.MONTH, -1);
-// c.set(Calendar.DATE, 1);
-// newMail.setSubject("Reset Password for MIS Portal");
-// newMail.setBody("Dear user,
As per your request, your password has been reset to: " +
-// password +
-// "
Once you login to the MIS portal with the above password, the system will direct you to change the default password as it is mandatory.
" +
-// "
Thanks,
" +
-// "
NSP Support
");
-// return emailService.sendMailPassword(newMail);
}
@RequestMapping(value = "/sendCaptcha/{captchaResponse}", method = RequestMethod.GET)
diff --git a/NMSReportingSuite/pom.xml b/NMSReportingSuite/pom.xml
index 01c74c980..ba6b91f9e 100644
--- a/NMSReportingSuite/pom.xml
+++ b/NMSReportingSuite/pom.xml
@@ -159,34 +159,35 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/ma
+
org.apache.shiro.samplessamples-spring-client
- LATEST
+ 1.4.1org.apache.shiroshiro-core
- LATEST
+ 1.4.1org.apache.shiroshiro-ehcache
- LATEST
+ 1.4.1org.apache.shiroshiro-spring
- LATEST
+ 1.4.1org.apache.shiroshiro-web
- LATEST
+ 1.4.1
diff --git a/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/CsrfInterceptor.java b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/CsrfInterceptor.java
new file mode 100644
index 000000000..81e10a222
--- /dev/null
+++ b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/CsrfInterceptor.java
@@ -0,0 +1,38 @@
+package com.beehyv.nmsreporting.business.impl;
+
+import com.beehyv.nmsreporting.business.UserService;
+import com.beehyv.nmsreporting.model.User;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.servlet.ModelAndView;
+import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class CsrfInterceptor extends HandlerInterceptorAdapter {
+ @Autowired
+ private UserService userService;
+
+ @Override
+ public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+ User currentUser = userService.getCurrentUser();
+
+ if(currentUser == null) {
+ return false;
+ }
+ String token = "dhty" + currentUser.getUserId().toString() + "alkihkf";
+ return request.getHeader("csrfToken").equals(token);
+ }
+
+ @Override
+ public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
+ }
+
+ @Override
+ public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
+ }
+
+ @Override
+ public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+ }
+}
diff --git a/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/UserServiceImpl.java b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/UserServiceImpl.java
index 8c837c582..f22855fe2 100644
--- a/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/UserServiceImpl.java
+++ b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/UserServiceImpl.java
@@ -11,6 +11,7 @@
import com.beehyv.nmsreporting.enums.ModificationType;
import com.beehyv.nmsreporting.model.*;
import com.beehyv.nmsreporting.utils.LoginUser;
+import com.beehyv.nmsreporting.utils.ServiceFunctions;
import org.apache.shiro.SecurityUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
@@ -55,6 +56,8 @@ public class UserServiceImpl implements UserService{
@Autowired
private AggregateCumulativeMADao aggregateCumulativeMADao;
+ private ServiceFunctions serviceFunctions = new ServiceFunctions();
+
private Role getAdminRole(){
return roleDao.findByRoleDescription(AccessType.ADMIN.getAccessType()).get(0);
}
@@ -140,11 +143,6 @@ public Map createNewUser(User user) {
responseMap.put(rowNum, userNameError);
return responseMap;
}
- if (userDao.findByUserName(user.getUsername()) != null) {
- String userNameError = "Username already exists.";
- responseMap.put(rowNum, userNameError);
- return responseMap;
- }
String userPhone = user.getPhoneNumber();
String regexStr1 = "^[0-9]*$";
@@ -311,8 +309,13 @@ else if (user.getAccessLevel().equalsIgnoreCase(AccessLevel.DISTRICT.getAccessLe
// return responseMap;
// }
}
-
- user.setPassword(passwordEncoder.encode(user.getPhoneNumber()));
+ if (userDao.findByUserName(user.getUsername()) != null) {
+ String userNameError = "Username already exists.";
+ responseMap.put(rowNum, userNameError);
+ return responseMap;
+ }
+ String password = serviceFunctions.generatePassword();
+ user.setPassword(passwordEncoder.encode(password));
user.setCreationDate(new Date());
user.setCreatedByUser(currentUser);
user.setAccountStatus(AccountStatus.ACTIVE.getAccountStatus());
@@ -321,6 +324,7 @@ else if (user.getAccessLevel().equalsIgnoreCase(AccessLevel.DISTRICT.getAccessLe
userDao.saveUser(user);
String authorityError = "User Created";
responseMap.put(rowNum, authorityError);
+ responseMap.put(1,password);
return responseMap;
}
@@ -609,10 +613,13 @@ public Map updatePassword(PasswordDto passwordDto) {
responseMap.put(rowNum, authorityError);
return responseMap;
}
- entity.setPassword(passwordEncoder.encode(entity.getPhoneNumber()));
+ String password = serviceFunctions.generatePassword();
+ entity.setPassword(passwordEncoder.encode(password));
entity.setDefault(true);
responseMap.put(rowNum, "Password changed successfully");
+ responseMap.put(1,password);
+ responseMap.put(2, entity.getEmailId());
return responseMap;
}
diff --git a/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/AdminController.java b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/AdminController.java
index 162c8ede5..531d058d5 100644
--- a/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/AdminController.java
+++ b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/AdminController.java
@@ -11,6 +11,7 @@
import com.beehyv.nmsreporting.model.ModificationTracker;
import com.beehyv.nmsreporting.model.State;
import com.beehyv.nmsreporting.model.User;
+import org.apache.commons.codec.binary.Base64;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.expression.ParseException;
import org.springframework.stereotype.Controller;
@@ -19,6 +20,8 @@
import javax.servlet.http.HttpServletResponse;
import java.io.*;
+import java.net.HttpURLConnection;
+import java.net.URL;
import java.util.*;
import static com.beehyv.nmsreporting.enums.ReportType.maCourse;
@@ -104,7 +107,12 @@ public Map uploadFileHandler(@RequestParam("bulkCsv") MultipartFile file) {
@ResponseBody
public String getBulkDataImportCSV(HttpServletResponse response) throws ParseException, java.text.ParseException{
- response.setContentType("APPLICATION/OCTECT-STREAM");
+ User user = userService.getCurrentUser();
+ if(user==null||!(user.getRoleName().equals("MASTER ADMIN"))&&!(user.getRoleName().equals("ADMIN"))){
+ return "Not Authorized";
+ }
+
+ response.setContentType("APPLICATION/OCTECT-STREAM");
try {
PrintWriter out=response.getWriter();
String filename="BulkImportData.csv";
@@ -137,7 +145,7 @@ public String getCumulativeCourseCompletion(@PathVariable("state") String State,
}*/
@RequestMapping(value = {"/changePassword"}, method = RequestMethod.POST)
- @ResponseBody public Map resetPassword(@RequestBody PasswordDto passwordDto){
+ @ResponseBody public Map resetPassword(@RequestBody PasswordDto passwordDto) throws Exception{
// String trackModification = mapper.convertValue(node.get("modification"), String.class);
//
// ModificationTracker modification = new ModificationTracker();
@@ -148,9 +156,39 @@ public String getCumulativeCourseCompletion(@PathVariable("state") String State,
// modification.setModifiedField(trackModification);
// modificationTrackerService.saveModification(modification);
-// return "redirect:http://localhost:8080/app/#!/";
+// return "redirect:https://rchivrreports.in/app/#!/";
Map map= userService.updatePassword(passwordDto);
if(map.get(0).equals("Password changed successfully")){
+ String password = map.get(1);
+ String email = map.get(2);
+ byte[] encoded = Base64.encodeBase64((email + "||" + password + "||admin").getBytes());
+ String encrypted = new String(encoded);
+ String url = "http://192.168.200.4:8080/NMSReportingSuite/nms/mail/sendPassword/" + encrypted;
+ URL obj = new URL(url);
+ HttpURLConnection con = (HttpURLConnection) obj.openConnection();
+
+ // optional default is GET
+ con.setRequestMethod("GET");
+
+ //add request header
+ con.setRequestProperty("User-Agent", "Mozilla/5.0");
+
+ int responseCode = con.getResponseCode();
+ System.out.println("\nSending 'GET' request to URL : " + url);
+ System.out.println("Response Code : " + responseCode);
+
+ BufferedReader in = new BufferedReader(
+ new InputStreamReader(con.getInputStream()));
+ String inputLine;
+ StringBuffer response = new StringBuffer();
+
+ while ((inputLine = in.readLine()) != null) {
+ response.append(inputLine);
+ }
+ in.close();
+
+ //print result
+ System.out.println(response.toString());
ModificationTracker modification = new ModificationTracker();
modification.setModificationDate(new Date(System.currentTimeMillis()));
modification.setModificationType(ModificationType.UPDATE.getModificationType());
@@ -159,7 +197,9 @@ public String getCumulativeCourseCompletion(@PathVariable("state") String State,
modification.setModifiedByUserId(userService.getCurrentUser().getUserId());
modificationTrackerService.saveModification(modification);
}
- return map;
+ Map requiredmap=new HashMap<>();
+ requiredmap.put(0,map.get(0));
+ return requiredmap;
}
@RequestMapping(value = "/create", method = RequestMethod.GET)
@ResponseBody
diff --git a/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/UserController.java b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/UserController.java
index 565dc9c21..b7b74d76b 100644
--- a/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/UserController.java
+++ b/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/UserController.java
@@ -136,7 +136,7 @@ public class UserController {
@RequestMapping(value={"/roles"} , method = RequestMethod.POST)
public @ResponseBody List getRoles() {
User currentUser = userService.getCurrentUser();
- if(currentUser.getUserId() != null){
+ if(currentUser.getUserId() != null&&((currentUser.getRoleName().equals("MASTER ADMIN"))||(currentUser.getRoleName().equals("ADMIN")))){
return roleService.getRoles();
} else
return null;
@@ -256,13 +256,16 @@ public class UserController {
}
-
+//returning a user only if current user is the creator, this api is used only during edit user
@RequestMapping(value={"/user/{userId}"})
public @ResponseBody User getUserById(@PathVariable("userId") Integer userId) {
- User currentUser = userService.getCurrentUser();
- if(currentUser.getUserId() != null){
- return userService.findUserByUserId(userId);
- } else
+ if(getCurrentUser() != null){
+ User user = userService.findUserByUserId(userId);
+ if(getCurrentUser().getUserId().equals(user.getCreatedByUser().getUserId())) {
+ return user;
+ }
+ return null;
+ }
return null;
}
@@ -298,13 +301,43 @@ public class UserController {
// }
@RequestMapping(value = {"/createUser"}, method = RequestMethod.POST)
- @ResponseBody public Map createNewUser(@RequestBody User user) {
+ @ResponseBody public Map createNewUser(@RequestBody User user) throws Exception {
User currentUser = userService.getCurrentUser();
if(currentUser != null){
user = locationService.SetLocations(user);
Map map = userService.createNewUser(user);
if(map.get(0).equals("User Created")){
+ String password = map.get(1);
+ String email = user.getEmailId();
+ byte[] encoded = Base64.encodeBase64((email + "||" + password + "||new").getBytes());
+ String encrypted = new String(encoded);
+ String url = "http://192.168.200.4:8080/NMSReportingSuite/nms/mail/sendPassword/" + encrypted;
+ URL obj = new URL(url);
+ HttpURLConnection con = (HttpURLConnection) obj.openConnection();
+
+ // optional default is GET
+ con.setRequestMethod("GET");
+
+ //add request header
+ con.setRequestProperty("User-Agent", USER_AGENT);
+
+ int responseCode = con.getResponseCode();
+ System.out.println("\nSending 'GET' request to URL : " + url);
+ System.out.println("Response Code : " + responseCode);
+
+ BufferedReader in = new BufferedReader(
+ new InputStreamReader(con.getInputStream()));
+ String inputLine;
+ StringBuffer response = new StringBuffer();
+
+ while ((inputLine = in.readLine()) != null) {
+ response.append(inputLine);
+ }
+ in.close();
+
+ //print result
+ System.out.println(response.toString());
ModificationTracker modification = new ModificationTracker();
modification.setModificationDate(new Date(System.currentTimeMillis()));
modification.setModificationType(ModificationType.CREATE.getModificationType());
@@ -456,7 +489,7 @@ public String forgotPassword(@RequestBody ForgotPasswordDto forgotPasswordDto, H
if (user != null) {
String email = user.getEmailId();
String password = serviceFunctions.generatePassword();
- byte[] encoded = Base64.encodeBase64((email + "||" + password).getBytes());
+ byte[] encoded = Base64.encodeBase64((email + "||" + password + "||forgot").getBytes());
String encrypted = new String(encoded);
String url = "http://192.168.200.4:8080/NMSReportingSuite/nms/mail/sendPassword/" + encrypted;
URL obj = new URL(url);
@@ -510,12 +543,13 @@ public String forgotPassword(@RequestBody ForgotPasswordDto forgotPasswordDto, H
-
- @RequestMapping(value = {"/deleteUser/{id}"}, method = RequestMethod.GET)
+//changed delete user to post, added a token verification
+ @RequestMapping(value = {"/deleteUser"}, method = RequestMethod.POST)
@ResponseBody
- public Map deleteExistingUser(@PathVariable("id") Integer id) {
+ public Map deleteExistingUser(HttpServletRequest request, @RequestBody Integer id) {
User currentUser = userService.getCurrentUser();
- if(currentUser != null){
+ String token = "dhty" + currentUser.getUserId().toString() + "alkihkf";
+ if(currentUser != null && request.getHeader("csrfToken").equals(token)){
Map map=userService.deleteExistingUser(id);
if(map.get(0).equals("User deleted")) {
ModificationTracker modification = new ModificationTracker();
diff --git a/NMSReportingSuite/src/main/webapp/WEB-INF/applicationContext.xml b/NMSReportingSuite/src/main/webapp/WEB-INF/applicationContext.xml
index 4923f463e..aaa0fa38a 100644
--- a/NMSReportingSuite/src/main/webapp/WEB-INF/applicationContext.xml
+++ b/NMSReportingSuite/src/main/webapp/WEB-INF/applicationContext.xml
@@ -135,6 +135,84 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/app/views/aboutKilkari.html b/app/htpagesmis/aboutKilkari.html
similarity index 100%
rename from app/views/aboutKilkari.html
rename to app/htpagesmis/aboutKilkari.html
diff --git a/app/views/aboutMA.html b/app/htpagesmis/aboutMA.html
similarity index 100%
rename from app/views/aboutMA.html
rename to app/htpagesmis/aboutMA.html
diff --git a/app/views/aboutUs.html b/app/htpagesmis/aboutUs.html
similarity index 100%
rename from app/views/aboutUs.html
rename to app/htpagesmis/aboutUs.html
diff --git a/app/views/bulkUser.html b/app/htpagesmis/bulkUser.html
similarity index 100%
rename from app/views/bulkUser.html
rename to app/htpagesmis/bulkUser.html
diff --git a/app/views/changePassword.html b/app/htpagesmis/changePassword.html
similarity index 100%
rename from app/views/changePassword.html
rename to app/htpagesmis/changePassword.html
diff --git a/app/views/contactUs.html b/app/htpagesmis/contactUs.html
similarity index 100%
rename from app/views/contactUs.html
rename to app/htpagesmis/contactUs.html
diff --git a/app/views/contactUsResponse.html b/app/htpagesmis/contactUsResponse.html
similarity index 100%
rename from app/views/contactUsResponse.html
rename to app/htpagesmis/contactUsResponse.html
diff --git a/app/views/copyrightPolicy.html b/app/htpagesmis/copyrightPolicy.html
similarity index 100%
rename from app/views/copyrightPolicy.html
rename to app/htpagesmis/copyrightPolicy.html
diff --git a/app/views/createUser.html b/app/htpagesmis/createUser.html
similarity index 100%
rename from app/views/createUser.html
rename to app/htpagesmis/createUser.html
diff --git a/app/views/disclaimer.html b/app/htpagesmis/disclaimer.html
similarity index 100%
rename from app/views/disclaimer.html
rename to app/htpagesmis/disclaimer.html
diff --git a/app/views/downloads.html b/app/htpagesmis/downloads.html
similarity index 100%
rename from app/views/downloads.html
rename to app/htpagesmis/downloads.html
diff --git a/app/views/editUser.html b/app/htpagesmis/editUser.html
similarity index 100%
rename from app/views/editUser.html
rename to app/htpagesmis/editUser.html
diff --git a/app/views/faq.html b/app/htpagesmis/faq.html
similarity index 100%
rename from app/views/faq.html
rename to app/htpagesmis/faq.html
diff --git a/app/views/faqAggregateInfo.html b/app/htpagesmis/faqAggregateInfo.html
similarity index 100%
rename from app/views/faqAggregateInfo.html
rename to app/htpagesmis/faqAggregateInfo.html
diff --git a/app/views/faqGeneralInfo.html b/app/htpagesmis/faqGeneralInfo.html
similarity index 100%
rename from app/views/faqGeneralInfo.html
rename to app/htpagesmis/faqGeneralInfo.html
diff --git a/app/views/faqLineListingInfo.html b/app/htpagesmis/faqLineListingInfo.html
similarity index 100%
rename from app/views/faqLineListingInfo.html
rename to app/htpagesmis/faqLineListingInfo.html
diff --git a/app/views/faqLoginInfo.html b/app/htpagesmis/faqLoginInfo.html
similarity index 100%
rename from app/views/faqLoginInfo.html
rename to app/htpagesmis/faqLoginInfo.html
diff --git a/app/views/faqReportsInfo.html b/app/htpagesmis/faqReportsInfo.html
similarity index 100%
rename from app/views/faqReportsInfo.html
rename to app/htpagesmis/faqReportsInfo.html
diff --git a/app/views/feedbackForm.html b/app/htpagesmis/feedbackForm.html
similarity index 100%
rename from app/views/feedbackForm.html
rename to app/htpagesmis/feedbackForm.html
diff --git a/app/views/feedbackResponse.html b/app/htpagesmis/feedbackResponse.html
similarity index 100%
rename from app/views/feedbackResponse.html
rename to app/htpagesmis/feedbackResponse.html
diff --git a/app/views/forgotPassword.html b/app/htpagesmis/forgotPassword.html
similarity index 100%
rename from app/views/forgotPassword.html
rename to app/htpagesmis/forgotPassword.html
diff --git a/app/views/helpPage.html b/app/htpagesmis/helpPage.html
similarity index 100%
rename from app/views/helpPage.html
rename to app/htpagesmis/helpPage.html
diff --git a/app/views/hyperLinkingPolicy.html b/app/htpagesmis/hyperLinkingPolicy.html
similarity index 100%
rename from app/views/hyperLinkingPolicy.html
rename to app/htpagesmis/hyperLinkingPolicy.html
diff --git a/app/views/login.html b/app/htpagesmis/login.html
similarity index 93%
rename from app/views/login.html
rename to app/htpagesmis/login.html
index 005061d82..cb97fd15f 100644
--- a/app/views/login.html
+++ b/app/htpagesmis/login.html
@@ -68,14 +68,15 @@