package servlets.module.lesson; import jakarta.servlet.ServletException; import jakarta.servlet.http.Cookie; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import jakarta.servlet.http.HttpSession; import java.io.IOException; import java.io.PrintWriter; import java.util.Locale; import java.util.ResourceBundle; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import utils.Hash; import utils.ShepherdLogManager; import utils.Validate; /** * Session Management Lesson
*
* This file is part of the Security Shepherd Project. * *

The Security Shepherd project is free software: you can redistribute it and/or modify it under * the terms of the GNU General Public License as published by the Free Software Foundation, either * version 3 of the License, or (at your option) any later version.
* *

The Security Shepherd project is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR * PURPOSE. See the GNU General Public License for more details.
* *

You should have received a copy of the GNU General Public License along with the Security * Shepherd project. If not, see . * * @author Mark Denihan */ public class SessionManagementLesson extends HttpServlet { private static final long serialVersionUID = 1L; private static final Logger log = LogManager.getLogger(SessionManagementLesson.class); private static String levelName = "Session Management Lesson"; public static String levelHash = "b8c19efd1a7cc64301f239f9b9a7a32410a0808138bbefc98986030f9ea83806"; private static String levelResult = "6594dec9ff7c4e60d9f8945ca0d4"; /** * Controller is tracking the user completion through the "lessonComplete" cookie. If this cookie * is changed the user can complete the level * * @param lessonComplete Tracking cookie */ public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // Setting IpAddress To Log and taking header for original IP if forwarded from proxy ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For")); PrintWriter out = response.getWriter(); out.print(getServletInfo()); // Translation Stuff Locale locale = new Locale(Validate.validateLanguage(request.getSession())); ResourceBundle errors = ResourceBundle.getBundle("i18n.servlets.errors", locale); ResourceBundle bundle = ResourceBundle.getBundle("i18n.servlets.lessons.sessionManagement", locale); try { HttpSession ses = request.getSession(true); if (Validate.validateSession(ses)) { ShepherdLogManager.setRequestIp( request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), ses.getAttribute("userName").toString()); log.debug(levelName + " servlet accessed by: " + ses.getAttribute("userName").toString()); Cookie userCookies[] = request.getCookies(); int i = 0; Cookie theCookie = null; for (i = 0; i < userCookies.length; i++) { if (userCookies[i].getName().compareTo("lessonComplete") == 0) { theCookie = userCookies[i]; break; // End Loop, because we found the token } } String htmlOutput = null; if (theCookie != null) { log.debug("Cookie value: " + theCookie.getValue()); if (theCookie.getValue().equals("lessonComplete")) { log.debug("Lesson Complete"); // Get key and add it to the output String userKey = Hash.generateUserSolution(levelResult, (String) ses.getAttribute("userName")); htmlOutput = "

" + bundle.getString("result.lessonComplete") + "

" + "

" + bundle.getString("result.youDidIt") + " " + "" + userKey + "" + "

"; } } if (htmlOutput == null) { log.debug("Lesson Not Complete"); htmlOutput = "

" + bundle.getString("response.lessonNotComplete") + "

" + "

" + bundle.getString("response.youDidntDoIt") + "

"; } log.debug("Outputting HTML"); out.write(htmlOutput); } else { log.error(levelName + " servlet accessed with no session"); out.write(errors.getString("error.noSession")); } } catch (Exception e) { out.write(errors.getString("error.funky")); log.fatal(levelName + " - " + e.toString()); } } }