You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by lu...@apache.org on 2012/09/02 00:15:13 UTC
svn commit: r1379875 - in
/myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces:
custom/captcha/AbstractCAPTCHAComponent.java
custom/captcha/CAPTCHARenderer.java tomahawk/config/
tomahawk/config/TomahawkConfig.java
Author: lu4242
Date: Sat Sep 1 22:15:13 2012
New Revision: 1379875
URL: http://svn.apache.org/viewvc?rev=1379875&view=rev
Log:
TOMAHAWK-1633 Arbitrary Session Variable Override using Captcha Renderer
Added:
myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/ (with props)
myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/TomahawkConfig.java (with props)
Modified:
myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/AbstractCAPTCHAComponent.java
myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/CAPTCHARenderer.java
Modified: myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/AbstractCAPTCHAComponent.java
URL: http://svn.apache.org/viewvc/myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/AbstractCAPTCHAComponent.java?rev=1379875&r1=1379874&r2=1379875&view=diff
==============================================================================
--- myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/AbstractCAPTCHAComponent.java (original)
+++ myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/AbstractCAPTCHAComponent.java Sat Sep 1 22:15:13 2012
@@ -19,6 +19,8 @@
package org.apache.myfaces.custom.captcha;
import javax.faces.component.UIComponentBase;
+import javax.faces.context.ExternalContext;
+import org.apache.myfaces.tomahawk.config.TomahawkConfig;
/**
*
@@ -42,7 +44,9 @@ public abstract class AbstractCAPTCHACom
public static final String ATTRIBUTE_IMAGE_HEIGHT = "imageHeight";
/**
- * Determines the CAPTCHA session key name.
+ * Determines the CAPTCHA session key name. If
+ * org.apache.myfaces.tomahawk.PREFIX_CAPTCHA_SESSION_KEY is set to true (default),
+ * a prefix defined by the component is added to this key name.
*
* @JSFProperty
* @return
@@ -61,6 +65,25 @@ public abstract class AbstractCAPTCHACom
*
* @JSFProperty
*/
- public abstract String getImageHeight();
-
+ public abstract String getImageHeight();
+
+ /**
+ * Return the value stored in session map related to captchaSessionKeyName
+ *
+ * @return
+ */
+ public String getCaptchaSessionValue()
+ {
+ //Return the value stored
+ ExternalContext externalContext = getFacesContext().getExternalContext();
+ TomahawkConfig config = TomahawkConfig.getCurrentInstance(externalContext);
+ if (externalContext.getSession(false) != null)
+ {
+ return (String) getFacesContext().getExternalContext().getSessionMap().get(
+ config.isPrefixCaptchaSessionKey() ?
+ ATTRIBUTE_CAPTCHA_SESSION_KEY_NAME+"_"+getCaptchaSessionKeyName() :
+ getCaptchaSessionKeyName());
+ }
+ return null;
+ }
}
Modified: myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/CAPTCHARenderer.java
URL: http://svn.apache.org/viewvc/myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/CAPTCHARenderer.java?rev=1379875&r1=1379874&r2=1379875&view=diff
==============================================================================
--- myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/CAPTCHARenderer.java (original)
+++ myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/custom/captcha/CAPTCHARenderer.java Sat Sep 1 22:15:13 2012
@@ -48,6 +48,7 @@ import org.apache.myfaces.renderkit.html
import org.apache.myfaces.renderkit.html.util.ResourceLoader;
import org.apache.myfaces.shared_tomahawk.renderkit.html.HTML;
+import org.apache.myfaces.tomahawk.config.TomahawkConfig;
/**
*
@@ -201,9 +202,12 @@ public class CAPTCHARenderer extends Ren
// Generate random CAPTCHA text.
captchaText = CAPTCHATextGenerator.generateRandomText();
+ TomahawkConfig config = TomahawkConfig.getCurrentInstance(facesContext);
// Set the generated text in the user session.
facesContext.getExternalContext().getSessionMap().put(
- captchaSessionKeyName, captchaText);
+ config.isPrefixCaptchaSessionKey() ?
+ AbstractCAPTCHAComponent.ATTRIBUTE_CAPTCHA_SESSION_KEY_NAME+
+ "_"+captchaSessionKeyName : captchaSessionKeyName, captchaText);
// Generate the image, the BG color is randomized from starting to ending colors.
captchaImageGenerator.generateImage(response, captchaText,
Propchange: myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/
------------------------------------------------------------------------------
bugtraq:number = true
Added: myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/TomahawkConfig.java
URL: http://svn.apache.org/viewvc/myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/TomahawkConfig.java?rev=1379875&view=auto
==============================================================================
--- myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/TomahawkConfig.java (added)
+++ myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/TomahawkConfig.java Sat Sep 1 22:15:13 2012
@@ -0,0 +1,173 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.tomahawk.config;
+
+import javax.faces.context.ExternalContext;
+import javax.faces.context.FacesContext;
+
+/**
+ *
+ * @author lu4242
+ */
+public class TomahawkConfig
+{
+ private static final String APPLICATION_MAP_PARAM_NAME = TomahawkConfig.class.getName();
+
+ /**
+ * If the param is set to true (default), a prefix is added to the captcha session key
+ * used to store into session the secret generated by t:captcha component.
+ *
+ * In versions before 1.1.14, the captcha session key is not prefixed, so it is possible
+ * to override session values with random content, so this param is here by backward
+ * compatibility with previous code that relies on such behavior.
+ *
+ * @JSFWebConfigParam since="1.1.14"
+ * defaultValue="true"
+ * expectedValues="true, false"
+ */
+ private static final String INIT_PARAM_PREFIX_CAPTCHA_SESSION_KEY = "org.apache.myfaces.tomahawk.PREFIX_CAPTCHA_SESSION_KEY";
+ private static final boolean INIT_PARAM_PREFIX_CAPTCHA_SESSION_KEY_DEFAULT = true;
+
+ private boolean prefixCaptchaSessionKey;
+
+ public TomahawkConfig()
+ {
+ setPrefixCaptchaSessionKey(INIT_PARAM_PREFIX_CAPTCHA_SESSION_KEY_DEFAULT);
+ }
+
+ public static TomahawkConfig getCurrentInstance(FacesContext facesContext)
+ {
+ return getCurrentInstance(facesContext.getExternalContext());
+ }
+
+ public static TomahawkConfig getCurrentInstance(ExternalContext extCtx)
+ {
+ TomahawkConfig myfacesConfig = (TomahawkConfig)extCtx
+ .getApplicationMap().get(APPLICATION_MAP_PARAM_NAME);
+ if (myfacesConfig == null)
+ {
+
+ myfacesConfig = createAndInitializeTomahawkConfig(extCtx);
+
+ extCtx.getApplicationMap().put(APPLICATION_MAP_PARAM_NAME, myfacesConfig);
+
+ }
+
+ return myfacesConfig;
+
+ }
+
+ private static TomahawkConfig createAndInitializeTomahawkConfig(ExternalContext extCtx)
+ {
+ TomahawkConfig config = new TomahawkConfig();
+
+ config.setPrefixCaptchaSessionKey(getBooleanInitParameter(
+ extCtx, INIT_PARAM_PREFIX_CAPTCHA_SESSION_KEY,
+ INIT_PARAM_PREFIX_CAPTCHA_SESSION_KEY_DEFAULT));
+
+ return config;
+ }
+
+ private static boolean getBooleanInitParameter(ExternalContext externalContext,
+ String paramName,
+ boolean defaultValue)
+ {
+ String strValue = externalContext.getInitParameter(paramName);
+ if (strValue == null)
+ {
+ //if (log.isLoggable(Level.INFO)) log.info("No context init parameter '" +
+ // paramName + "' found, using default value " + defaultValue);
+ return defaultValue;
+ }
+ else if (strValue.equalsIgnoreCase("true") || strValue.equalsIgnoreCase("on") ||
+ strValue.equalsIgnoreCase("yes"))
+ {
+ return true;
+ }
+ else if (strValue.equalsIgnoreCase("false") || strValue.equalsIgnoreCase("off") ||
+ strValue.equalsIgnoreCase("no"))
+ {
+ return false;
+ }
+ else
+ {
+ //if (log.isLoggable(Level.WARNING)) log.warning("Wrong context init parameter '" +
+ //paramName + "' (='" + strValue + "'), using default value " + defaultValue);
+ return defaultValue;
+ }
+ }
+
+ private static String getStringInitParameter(ExternalContext externalContext,
+ String paramName,
+ String defaultValue)
+ {
+ String strValue = externalContext.getInitParameter(paramName);
+ if (strValue == null)
+ {
+ //if (log.isLoggable(Level.INFO)) log.info("No context init parameter '" + paramName +
+ //"' found, using default value " + defaultValue); //defaultValue==null should not be
+ //a problem here
+ return defaultValue;
+ }
+
+ return strValue;
+ }
+
+ private static long getLongInitParameter(ExternalContext externalContext,
+ String paramName,
+ long defaultValue)
+ {
+ String strValue = externalContext.getInitParameter(paramName);
+ if (strValue == null)
+ {
+ //if (log.isLoggable(Level.INFO)) log.info("No context init parameter '" +paramName +
+ //"' found, using default value " +defaultValue);
+ return defaultValue;
+ }
+ else
+ {
+ try
+ {
+ return Long.parseLong(strValue);
+ }
+ catch (NumberFormatException e)
+ {
+ //if (log.isLoggable(Level.WARNING)) log.warning("Wrong context init parameter '" +
+ //paramName + "' (='" + strValue + "'), using default value " + defaultValue);
+ }
+ return defaultValue;
+ }
+ }
+
+ /**
+ * @return the prefixCaptchaSessionKey
+ */
+ public boolean isPrefixCaptchaSessionKey()
+ {
+ return prefixCaptchaSessionKey;
+ }
+
+ /**
+ * @param prefixCaptchaSessionKey the prefixCaptchaSessionKey to set
+ */
+ public void setPrefixCaptchaSessionKey(boolean prefixCaptchaSessionKey)
+ {
+ this.prefixCaptchaSessionKey = prefixCaptchaSessionKey;
+ }
+}
Propchange: myfaces/tomahawk/trunk/core/src/main/java/org/apache/myfaces/tomahawk/config/TomahawkConfig.java
------------------------------------------------------------------------------
svn:eol-style = native