Produced by Araxis Merge on 7/6/2017 8:32:13 AM Central Daylight Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.
# | Location | File | Last Modified |
---|---|---|---|
1 | HC 837 Compliance 05122017.zip\HC 837 Compliance 05122017\EWV\EWV\project\src\main\gov\va\med\hac\edi\ewv2\security | IDCheckServlet.java | Thu May 1 18:33:50 2014 UTC |
2 | HC 837 Compliance 05122017.zip\HC 837 Compliance 05122017\EWV\EWV\project\src\main\gov\va\med\hac\edi\ewv2\security | IDCheckServlet.java | Wed Jul 5 13:07:29 2017 UTC |
Description | Between Files 1 and 2 |
|
---|---|---|
Text Blocks | Lines | |
Unchanged | 2 | 306 |
Changed | 1 | 2 |
Inserted | 0 | 0 |
Removed | 0 | 0 |
Whitespace | |
---|---|
Character case | Differences in character case are significant |
Line endings | Differences in line endings (CR and LF characters) are ignored |
CR/LF characters | Not shown in the comparison detail |
No regular expressions were active.
1 | /* | |
2 | * $Id: ID CheckServl et.java,v 1.2 2011/0 3/25 22:55 :58 vhahac bergri Exp $ | |
3 | */ | |
4 | package go v.va.med.h ac.edi.ewv 2.security ; | |
5 | ||
6 | import jav a.io.IOExc eption; | |
7 | import jav a.net.URLD ecoder; | |
8 | ||
9 | import jav ax.servlet .ServletEx ception; | |
10 | import jav ax.servlet .http.*; | |
11 | ||
12 | /** | |
13 | * The Cla ss IDCheck Servlet. | |
14 | * | |
15 | * @author vhahacngu yes, vhaha cbergri | |
16 | */ | |
17 | public cla ss IDCheck Servlet ex tends Http Servlet | |
18 | { | |
19 | ||
20 | /* | |
21 | * (no n-Javadoc) | |
22 | * | |
23 | * @se e javax.se rvlet.Gene ricServlet #init() | |
24 | */ | |
25 | @Overr ide | |
26 | public void init () throws ServletExc eption | |
27 | { | |
28 | Sy stem.out.p rintln("ID CheckServl et init.") ; | |
29 | } | |
30 | ||
31 | /* | |
32 | * (no n-Javadoc) | |
33 | * | |
34 | * @se e | |
35 | * jav ax.servlet .http.Http Servlet#do Get(javax. servlet.ht tp.HttpSer vletReques t | |
36 | * , j avax.servl et.http.Ht tpServletR esponse) | |
37 | */ | |
38 | protec ted void d oGet(HttpS ervletRequ est req, H ttpServlet Response r esp) throw s ServletE xception, IOExceptio n | |
39 | { | |
40 | lo gDebug("In doGet, go ing to doP ost"); | |
41 | do Post(req, resp); | |
42 | ||
43 | } | |
44 | ||
45 | /** | |
46 | * Is the given string nul l, or blan k after tr imming? | |
47 | * | |
48 | * @pa ram value | |
49 | * th e value | |
50 | * | |
51 | * @re turn true, if is val id | |
52 | */ | |
53 | privat e boolean isValid(St ring value ) | |
54 | { | |
55 | lo gDebug("Ch ecking val idity of: " + value) ; | |
56 | re turn value != null & & value.tr im().lengt h() > 0 ? true : fal se; | |
57 | } | |
58 | ||
59 | /* | |
60 | * (no n-Javadoc) | |
61 | * | |
62 | * @se e | |
63 | * jav ax.servlet .http.Http Servlet#do Post(javax .servlet.h ttp.HttpSe rvletReque st | |
64 | * , j avax.servl et.http.Ht tpServletR esponse) | |
65 | */ | |
66 | protec ted void d oPost(Http ServletReq uest req, HttpServle tResponse resp) thro ws Servlet Exception, IOExcepti on | |
67 | { | |
68 | St ring userI d = ""; | |
69 | St ring captu redUrl = " "; | |
70 | try { | |
71 | String paramI = URLDecoder .decode(re q.getParam eter("i"), "UTF-8"); | |
72 | String paramC = URLDecoder .decode(re q.getParam eter("c"), "UTF-8"); | |
73 | logDeb ug("In ser vlet doPos t, paramet er [i]: " + paramI); | |
74 | logDeb ug("In ser vlet doPos t, paramet er [c]: " + paramC); | |
75 | userId = IDCheck AESEncrypt ion.decryp t(paramI); | |
76 | logDeb ug("In ser vlet doPos t, userId: " + userI d); | |
77 | captur edUrl = ID CheckAESEn cryption.d ecrypt(par amC); | |
78 | logDeb ug("captur edUrl: " + capturedU rl); | |
79 | } ca tch (Excep tion e1) { | |
80 | // TOD O Auto-gen erated cat ch block | |
81 | e1.pri ntStackTra ce(); | |
82 | } | |
83 | St ring sessi onId = req .getParame ter("s"); | |
84 | lo gDebug("se ssionId in parameter : " + sess ionId); | |
85 | ||
86 | Ht tpSession session = req.getSes sion(); | |
87 | St ring sId = session.g etId() + s ession.has hCode(); | |
88 | lo gDebug("Id in sessio n: " + sId ); | |
89 | ||
90 | St ring exist ingUser = (String) s ession.get Attribute( IDCheckFil ter.SEC_US ER); | |
91 | lo gDebug("In doPost, s ession use r: " + exi stingUser) ; | |
92 | ||
93 | // if any pa rameters a re wrong o r user Id already se t | |
94 | // (bean may be instan tiated by the JSF en gine when the error page is | |
95 | // rendered. ) This wil l ensure o nly one po st back pe r session. | |
96 | bo olean stat us = true; | |
97 | st atus &= is Valid(user Id); | |
98 | st atus &= is Valid(sess ionId); | |
99 | st atus &= is Valid(capt uredUrl); | |
100 | ||
101 | // Under cer tain circu mstances, the sessio n id repor ted by the ASP page | |
102 | // is not th e same as the one fo und by the servlet. Possibly, this | |
103 | // is due to the use o f a differ ent URL, i e. with an d without the | |
104 | // DNS part. Anyw ay, we rem oved this check beca use of | |
105 | // that situ ation. | |
106 | // status &= sId.equal s(sessionI d); | |
107 | ||
108 | if (isValid( existingUs er)) | |
109 | { | |
110 | status & = userId.e quals(exis tingUser); | |
111 | } | |
112 | lo gDebug("In doPost, s tatus resu lt is: " + status); | |
113 | if (!status) | |
114 | { | |
115 | try | |
116 | { | |
117 | logD ebug("Inva lidating t he session "); | |
118 | sess ion.remove Attribute( IDCheckFil ter.SEC_US ER); | |
119 | sess ion.invali date(); | |
120 | } | |
121 | catch (I llegalStat eException e) | |
122 | { | |
123 | // I gnore! For IE, when user click s back but ton twice after | |
124 | // l ogin this is called twice. | |
125 | } | |
126 | System.e rr.println (new Strin gBuffer("E rror autho rizing [") .append(" Rec - user Id:" + use rId).appen d( | |
127 | " sessionI d:" + sess ionId).app end(" capt uredUrl:" + captured Url).appen d( | |
128 | " App - ex istingUser :" + exist ingUser).a ppend(" sI d:" + sId) .append("] ").toStrin g()); | |
129 | String e rrorPage = (String) req.getAtt ribute(IDC heckFilter .ERROR_PAG E); | |
130 | ||
131 | // If we didn't ge t the info rmation we need, go to the err or page | |
132 | resp.sen dRedirect( errorPage) ; | |
133 | return; | |
134 | } | |
135 | ||
136 | ex istingUser = new Str ing(userId ); | |
137 | ||
138 | // Put this user into the HTTP s ession. Th is is the point of t his servle t | |
139 | se ssion.setA ttribute(I DCheckFilt er.SEC_USE R, existin gUser); | |
140 | // System.out .println(" IDCheckSer vlet set S EC_USER: " +existingU ser); | |
141 | ||
142 | ge tServletCo ntext().se tAttribute ("user", e xistingUse r); | |
143 | ||
144 | // Redirect to the url that was originally requested by the us er. | |
145 | lo gDebug("Re directing to: " + ca pturedUrl) ; | |
146 | re sp.sendRed irect(capt uredUrl); | |
147 | } | |
148 | ||
149 | privat e void log Debug(Stri ng s) | |
150 | { | |
151 | S ystem.out. println("I DCheckServ let:" + s) ; | |
152 | } | |
153 | ||
154 | } |
Araxis Merge (but not the data content of this report) is Copyright © 1993-2016 Araxis Ltd (www.araxis.com). All rights reserved.