MCPcopy Index your code
hub / github.com/OWASP/SecurityShepherd / doPost

Method doPost

src/main/java/servlets/GetJsonScore.java:51–111  ·  view source on GitHub ↗

Used to return an administrator with the current progress of each player in a class. This will require a complex client page to parse the returned JSON information to make a very pretty score board @param classId @param csrfToken

(HttpServletRequest request, HttpServletResponse response)

Source from the content-addressed store, hash-verified

49 * @param csrfToken
50 */
51 public void doPost (HttpServletRequest request, HttpServletResponse response)
52 throws ServletException, IOException
53 {
54 //Setting IpAddress To Log and taking header for original IP if forwarded from proxy
55 ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
56 //log.debug("*** servlets.GetJsonScore ***");
57 PrintWriter out = response.getWriter();
58 out.print(getServletInfo());
59 HttpSession ses = request.getSession(true);
60 if(Validate.validateSession(ses))
61 {
62 ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), ses.getAttribute("userName").toString());
63 log.debug("Scoreboard accessed by " + ses.getAttribute("userName").toString());
64 boolean canSeeScoreboard = ScoreboardStatus.canSeeScoreboard((String)ses.getAttribute("userRole"));
65 Cookie tokenCookie = Validate.getToken(request.getCookies());
66 Object tokenParmeter = request.getParameter("csrfToken");
67 String scoreboardClass = new String();
68 if(Validate.validateTokens(tokenCookie, tokenParmeter) && canSeeScoreboard)
69 {
70 //What Class to List?
71 if(ScoreboardStatus.getClassSpecificScoreboard())
72 {
73 if(ses.getAttribute("userRole").toString().compareTo("admin") == 0)
74 {
75 //Admin should get default class Scoreboard
76 scoreboardClass = Register.getDefaultClass();
77 }
78 else
79 {
80 //User should get their class scoreboard
81 if(ses.getAttribute("userClass") != null)
82 scoreboardClass = ses.getAttribute("userClass").toString();
83 else
84 scoreboardClass = new String();
85 }
86 }
87 else
88 {
89 scoreboardClass = ScoreboardStatus.getScoreboardClass();
90 }
91 String applicationRoot = getServletContext().getRealPath("");
92 String jsonOutput = Getter.getJsonScore(applicationRoot, scoreboardClass);
93 if(jsonOutput.isEmpty())
94 jsonOutput = "ERROR: No Scoreboard Data Right Now";
95 out.write(jsonOutput);
96 }
97 else
98 {
99 if(!canSeeScoreboard)
100 out.write("ERROR: Scoreboard is not currently available");
101 else
102 out.write("ERROR: Please refresh page!");
103 }
104 }
105 else
106 {
107 log.debug("Unauthenticated Scoreboard Request");
108 out.write("ERROR: You are logged out. Please refresh the page");

Callers

nothing calls this directly

Calls 10

setRequestIpMethod · 0.95
validateSessionMethod · 0.95
canSeeScoreboardMethod · 0.95
getTokenMethod · 0.95
validateTokensMethod · 0.95
getDefaultClassMethod · 0.95
getScoreboardClassMethod · 0.95
getJsonScoreMethod · 0.95
getSessionMethod · 0.80

Tested by

no test coverage detected