yacy_search_server/source/net/yacy/htroot/User.java

//User.java
//-----------------------
//part of the AnomicHTTPD caching proxy
//(C) by Michael Peter Christen; mc@yacy.net
//first published on http://www.anomic.de
//Frankfurt, Germany, 2004
//
//This File is contributed by Alexander Schier
//last major change: 12.11.2005
//
//This program is free software; you can redistribute it and/or modify
//it under the terms of the GNU General Public License as published by
//the Free Software Foundation; either version 2 of the License, or
//(at your option) any later version.
//
//This program is distributed in the hope that it will be useful,
//but WITHOUT ANY WARRANTY; without even the implied warranty of
//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
//GNU General Public License for more details.
//
//You should have received a copy of the GNU General Public License
//along with this program; if not, write to the Free Software
//Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA


//You must compile this file with
//javac -classpath .:../Classes Message.java
//if the shell's current path is HTROOT

package net.yacy.htroot;

import javax.servlet.ServletException;

import net.yacy.cora.order.Base64Order;
import net.yacy.cora.order.Digest;
import net.yacy.cora.protocol.RequestHeader;
import net.yacy.cora.protocol.ResponseHeader;
import net.yacy.cora.util.ConcurrentLog;
import net.yacy.data.UserDB;
import net.yacy.search.Switchboard;
import net.yacy.search.SwitchboardConstants;
import net.yacy.server.serverObjects;
import net.yacy.server.serverSwitch;
import net.yacy.server.servletProperties;

public class User{

    public static servletProperties respond(final RequestHeader requestHeader, final serverObjects post, @SuppressWarnings("unused") final serverSwitch env) {
        final servletProperties prop = new servletProperties();
        final Switchboard sb = Switchboard.getSwitchboard();
        UserDB.Entry entry=null;

        //default values
        prop.put("logged_in", "0");
        prop.put("logged-in_limit", "0");
        prop.put("status", "0");
        prop.put("logged-in_username", "");
        prop.put("logged-in_returnto", "");
        //identified via HTTPPassword
        entry=sb.userDB.proxyAuth(requestHeader);
        if(entry != null){
        	prop.put("logged-in_identified-by", "1");
        //try via cookie
        }else{
            entry=sb.userDB.cookieAuth(requestHeader.getCookies());
            prop.put("logged-in_identified-by", "2");
            //try via ip
            if(entry == null){
                final String ip = requestHeader.getRemoteAddr();
                entry = sb.userDB.ipAuth((ip != null ? ip : "xxxxxx"));
                if(entry != null){
                    prop.put("logged-in_identified-by", "0");
                }
            }
        }

        //identified via userDB
        if(entry != null){
            prop.put("logged-in", "1");
            prop.put("logged-in_username", entry.getUserName());
            if(entry.getTimeLimit() > 0){
                prop.put("logged-in_limit", "1");
                final long limit=entry.getTimeLimit();
                final long used=entry.getTimeUsed();
                prop.put("logged-in_limit_timelimit", limit);
                prop.put("logged-in_limit_timeused", used);
                int percent=0;
                if(limit!=0 && used != 0)
                    percent=(int)((float)used/(float)limit*100);
                prop.put("logged-in_limit_percent", percent/3);
                prop.put("logged-in_limit_percent2", (100-percent)/3);
            }
        //logged in via static Password
        }else if(sb.verifyAuthentication(requestHeader)){
            prop.put("logged-in", "2");
        //identified via form-login
        } else if (post != null && post.containsKey("username") && post.containsKey("password")) {
        	if (post.containsKey("returnto"))
        		prop.putHTML("logged-in_returnto", post.get("returnto"));
            final String username=post.get("username");
            final String password=post.get("password");
            prop.putHTML("logged-in_username", username);

            entry = sb.userDB.passwordAuth(username, password);
            boolean staticAdmin = false;
            if (entry == null) {
                // check for old style admin account
                staticAdmin = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, "").equals(
                        Digest.encodeMD5Hex(Base64Order.standardCoder.encodeString(username + ":" + password)));
                if (!staticAdmin) {
                    // check for DIGEST authentication admin account
                    final String realm = sb.getConfig(SwitchboardConstants.ADMIN_REALM, "YaCy");
                    staticAdmin = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, "").equals(
                            "MD5:" + Digest.encodeMD5Hex(username + ":" + realm + ":" + password));
                }
            }

            String cookie="";
            if(entry != null) {
                //set a random token in a cookie
                cookie=sb.userDB.getCookie(entry);
                final ResponseHeader outgoingHeader=new ResponseHeader(200);
                outgoingHeader.setCookie("login", cookie);
                prop.setOutgoingHeader(outgoingHeader);

                prop.put("logged-in", "1");
                prop.put("logged-in_identified-by", "1");
                prop.putHTML("logged-in_username", username);
                if(post.containsKey("returnto")){
                    prop.put(serverObjects.ACTION_LOCATION, post.get("returnto"));
                }
            }
        }

        if (post != null && entry != null) {
            if (post.containsKey("changepass")) {
                prop.put("status", "1"); //password

                if (entry.getMD5EncodedUserPwd().startsWith("MD5:") ?
                        entry.getMD5EncodedUserPwd().equals(sb.encodeDigestAuth(entry.getUserName(), post.get("oldpass", ""))) :
                        entry.getMD5EncodedUserPwd().equals(sb.encodeBasicAuth(entry.getUserName() , post.get("oldpass", "")))) {
                    if (post.get("newpass").equals(post.get("newpass2"))) {
                        if (!post.get("newpass", "").equals("")) {
                            try {
                                entry.setProperty(UserDB.Entry.MD5ENCODED_USERPWD_STRING, sb.encodeDigestAuth(entry.getUserName(), post.get("newpass", "")));
                                prop.put("status_password", "0"); //changes
                            } catch (final Exception e) {
                                ConcurrentLog.logException(e);
                            }
                        } else {
                            prop.put("status_password", "3"); //empty
                        }
                    } else {
                        prop.put("status_password", "2"); //pws do not match
                    }
                } else {
                    prop.put("status_password", "1"); //old pw wrong
                }
            }
        }
        if(post!=null && post.containsKey("logout")){
            prop.put("logged-in", "0");
            if(entry != null){
                final String ip = requestHeader.getRemoteAddr();
                entry.logout((ip != null ? ip : "xxxxxx"), UserDB.getLoginToken(requestHeader.getCookies()));
            }
            try {
                requestHeader.logout(); // servlet container session logout
            } catch (final ServletException ex) {}
            if(post.containsKey("returnto")){
                prop.putHTML(serverObjects.ACTION_LOCATION, post.get("returnto"));
            }
        }
        // return rewrite properties
        return prop;
    }
}