Initiated by login.jsp. Once this post request has been completely processed, the user will be logged in, the account will be one count closer to been temporarily been locked or will be locked out temporarily. This method takes the credentials submitted and determines if they are correct. If they ar
(HttpServletRequest request, HttpServletResponse response)
| 49 | * @param pwd User's Password |
| 50 | */ |
| 51 | @SuppressWarnings("unchecked") |
| 52 | public void doPost (HttpServletRequest request, HttpServletResponse response) |
| 53 | throws ServletException, IOException |
| 54 | { |
| 55 | //Setting IpAddress To Log and taking header for original IP if forwarded from proxy |
| 56 | ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For")); |
| 57 | log.debug("**** servlets.MobileLogin ***"); |
| 58 | HttpSession ses = request.getSession(true); |
| 59 | PrintWriter out = response.getWriter(); |
| 60 | out.print(getServletInfo()); |
| 61 | response.setContentType("application/json"); |
| 62 | // params |
| 63 | String p_login = request.getParameter("login"); |
| 64 | log.debug("userName: " + p_login); |
| 65 | String p_pwd = request.getParameter("pwd"); |
| 66 | String csrfToken = new String(); |
| 67 | |
| 68 | boolean authenticated = false; |
| 69 | |
| 70 | // session is not new, try to set credentials |
| 71 | p_login = nvl(p_login, (String)ses.getAttribute("login")); |
| 72 | p_pwd = nvl(p_pwd, (String)ses.getAttribute("password")); |
| 73 | // get credentials |
| 74 | String ApplicationRoot = getServletContext().getRealPath(""); |
| 75 | try |
| 76 | { |
| 77 | String user[] = Getter.authUser(ApplicationRoot, p_login, p_pwd); |
| 78 | if(user != null && !user[0].isEmpty()) |
| 79 | { |
| 80 | |
| 81 | //Kill Session and Create a new one with user logged in |
| 82 | log.debug("Creating new session for " + user[2] + " " + user[1]); |
| 83 | ses.invalidate(); |
| 84 | ses = request.getSession(true); |
| 85 | ses.setAttribute("userStamp", user[0]); |
| 86 | ses.setAttribute("userName", user[1]); |
| 87 | ses.setAttribute("userRole", user[2]); |
| 88 | log.debug("userClassId = " + user[4]); |
| 89 | |
| 90 | ses.setAttribute("userClass", user[4]); |
| 91 | log.debug("Setting CSRF cookie"); |
| 92 | csrfToken = Hash.randomString(); |
| 93 | Cookie token = new Cookie("token", csrfToken); |
| 94 | if(request.getRequestURL().toString().startsWith("https"))//If Requested over HTTPs |
| 95 | token.setSecure(true); |
| 96 | response.addCookie(token); |
| 97 | authenticated = true; |
| 98 | |
| 99 | if(user[3].equalsIgnoreCase("true")) |
| 100 | { |
| 101 | log.debug("Temporary Password Detected, user will be prompted to change"); |
| 102 | ses.setAttribute("ChangePassword", "true"); |
| 103 | } |
| 104 | //Removing user from kick list. If they were on it before, their suspension must have ended if they DB authentication Succeeded |
| 105 | UserKicker.removeFromKicklist(user[1]); |
| 106 | } |
| 107 | } |
| 108 | catch(Exception e) |
nothing calls this directly
no test coverage detected