Initiated by login.jsp. Once this post request has been completely processed, the user will be logged in, the account will be one count closer to been temporarily been locked or will be locked out temporarily. This method takes the credentials submitted and determines if they are correct. If they ar
(HttpServletRequest request, HttpServletResponse response)
| 47 | * @param pwd User's Password |
| 48 | */ |
| 49 | public void doPost (HttpServletRequest request, HttpServletResponse response) |
| 50 | throws ServletException, IOException |
| 51 | { |
| 52 | //Setting IpAddress To Log and taking header for original IP if forwarded from proxy |
| 53 | ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For")); |
| 54 | log.debug("**** servlets.Login ***"); |
| 55 | HttpSession ses = request.getSession(true); |
| 56 | try |
| 57 | { |
| 58 | response.setContentType("text/plain"); |
| 59 | // params |
| 60 | String p_login = request.getParameter("login"); |
| 61 | String p_pwd = request.getParameter("pwd"); |
| 62 | Object language = ses.getAttribute("lang"); |
| 63 | |
| 64 | boolean mustRedirect = false; |
| 65 | |
| 66 | // session is not new, try to set credentials |
| 67 | p_login = nvl(p_login, (String)ses.getAttribute("login")); |
| 68 | p_pwd = nvl(p_pwd, (String)ses.getAttribute("password")); |
| 69 | // get credentials |
| 70 | log.debug("Getting ApplicationRoot"); |
| 71 | String ApplicationRoot = getServletContext().getRealPath(""); |
| 72 | log.debug("Servlet root = " + ApplicationRoot ); |
| 73 | try |
| 74 | { |
| 75 | String user[] = Getter.authUser(ApplicationRoot, p_login, p_pwd); |
| 76 | if(user != null && !user[0].isEmpty()) |
| 77 | { |
| 78 | |
| 79 | //Kill Session and Create a new one with user logged in |
| 80 | log.debug("Creating new session for " + user[2] + " " + user[1]); |
| 81 | ses.invalidate(); |
| 82 | ses = request.getSession(true); |
| 83 | ses.setAttribute("userStamp", user[0]); |
| 84 | ses.setAttribute("userName", user[1]); |
| 85 | ses.setAttribute("userRole", user[2]); |
| 86 | ses.setAttribute("lang", language); |
| 87 | log.debug("userClassId = " + user[4]); |
| 88 | |
| 89 | ses.setAttribute("userClass", user[4]); |
| 90 | log.debug("Setting CSRF cookie"); |
| 91 | Cookie token = new Cookie("token", Hash.randomString()); |
| 92 | if(request.getRequestURL().toString().startsWith("https"))//If Requested over HTTPs |
| 93 | token.setSecure(true); |
| 94 | response.addCookie(token); |
| 95 | mustRedirect = true; |
| 96 | |
| 97 | if(user[3].equalsIgnoreCase("true")) |
| 98 | { |
| 99 | log.debug("Temporary Password Detected, user will be prompted to change"); |
| 100 | ses.setAttribute("ChangePassword", "true"); |
| 101 | } |
| 102 | |
| 103 | //Removing user from kick list. If they were on it before, their suspension must have ended if they DB authentication Succeeded |
| 104 | UserKicker.removeFromKicklist(user[1]); |
| 105 | } |
| 106 | } |