Skip to content

Commit 172d243

Browse files
anuranjananuranjan
authored
Merge pull request #21 from motech-implementations/audit_fixes_final
Audit fixes final
2 parents b9880a1 + 37419c2 commit 172d243

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+358
-123
lines changed

‎Email/NMSReportingSuite/pom.xml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -143,34 +143,35 @@
143143
</dependency>
144144

145145
<!-- Apache Shiro -->
146+
<!-- latest versions no longer work with our project, so changed to a version that works-->
146147
<dependency>
147148
<groupId>org.apache.shiro.samples</groupId>
148149
<artifactId>samples-spring-client</artifactId>
149-
<version>LATEST</version>
150+
<version>1.4.1</version>
150151
</dependency>
151152

152153
<dependency>
153154
<groupId>org.apache.shiro</groupId>
154155
<artifactId>shiro-core</artifactId>
155-
<version>LATEST</version>
156+
<version>1.4.1</version>
156157
</dependency>
157158

158159
<dependency>
159160
<groupId>org.apache.shiro</groupId>
160161
<artifactId>shiro-ehcache</artifactId>
161-
<version>LATEST</version>
162+
<version>1.4.1</version>
162163
</dependency>
163164

164165
<dependency>
165166
<groupId>org.apache.shiro</groupId>
166167
<artifactId>shiro-spring</artifactId>
167-
<version>LATEST</version>
168+
<version>1.4.1</version>
168169
</dependency>
169170

170171
<dependency>
171172
<groupId>org.apache.shiro</groupId>
172173
<artifactId>shiro-web</artifactId>
173-
<version>LATEST</version>
174+
<version>1.4.1</version>
174175
</dependency>
175176

176177
<dependency>

‎Email/NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/EmailController.java‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,12 @@ String sendPassword(@PathVariable String encoded) throws Exception {
6262
//changed the 'from' emailId from beehyv domain address to govt domain address
6363
String email = tokenItems[0];
6464
String password = tokenItems[1];
65-
String subject = "Reset Password for MIS Portal";
66-
String message = "\"Dear user,<br/><br/><p>As per your request, your password has been reset to: <b>" +
65+
String type = tokenItems[2];
66+
String subject = "Password for MIS Portal";
67+
String line = "As per your request, your password has been reset to:";
68+
if(type.equals("new")) line = "The password for your newly created MIS account is:";
69+
else if(type.equals("admin")) line = "The password for your MIS account has been reset by the admin to:";
70+
String message = "\"Dear user,<br/><br/><p>"+line+"<b>" +
6771
password +
6872
"</b></p><br/><p>Once you login to the MIS portal with the above password, the system will direct you to change the default password as it is mandatory.</p><br/>" +
6973
"<p>Thanks,</p>" +"<p>NSP Support</p>\"";
@@ -81,19 +85,6 @@ String sendPassword(@PathVariable String encoded) throws Exception {
8185
return "failure";
8286
}
8387
}catch (InterruptedException e){return "failure";}
84-
// EmailInfo newMail = new EmailInfo();
85-
// newMail.setFrom("nsp-reports@beehyv.com");
86-
// newMail.setTo(email);
87-
// Calendar c = Calendar.getInstance(); // this takes current date
88-
// c.add(Calendar.MONTH, -1);
89-
// c.set(Calendar.DATE, 1);
90-
// newMail.setSubject("Reset Password for MIS Portal");
91-
// newMail.setBody("Dear user,<br/><br/><p>As per your request, your password has been reset to: <b>" +
92-
// password +
93-
// "</b></p><br/><p>Once you login to the MIS portal with the above password, the system will direct you to change the default password as it is mandatory.</p><br/>" +
94-
// "<p>Thanks,</p>" +
95-
// "<p>NSP Support</p>");
96-
// return emailService.sendMailPassword(newMail);
9788
}
9889

9990
@RequestMapping(value = "/sendCaptcha/{captchaResponse}", method = RequestMethod.GET)

‎NMSReportingSuite/pom.xml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -159,34 +159,35 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/ma
159159
</dependency>
160160

161161
<!-- Apache Shiro -->
162+
<!-- latest versions no longer work with our projects, so switched to the lastest working version-->
162163
<dependency>
163164
<groupId>org.apache.shiro.samples</groupId>
164165
<artifactId>samples-spring-client</artifactId>
165-
<version>LATEST</version>
166+
<version>1.4.1</version>
166167
</dependency>
167168

168169
<dependency>
169170
<groupId>org.apache.shiro</groupId>
170171
<artifactId>shiro-core</artifactId>
171-
<version>LATEST</version>
172+
<version>1.4.1</version>
172173
</dependency>
173174

174175
<dependency>
175176
<groupId>org.apache.shiro</groupId>
176177
<artifactId>shiro-ehcache</artifactId>
177-
<version>LATEST</version>
178+
<version>1.4.1</version>
178179
</dependency>
179180

180181
<dependency>
181182
<groupId>org.apache.shiro</groupId>
182183
<artifactId>shiro-spring</artifactId>
183-
<version>LATEST</version>
184+
<version>1.4.1</version>
184185
</dependency>
185186

186187
<dependency>
187188
<groupId>org.apache.shiro</groupId>
188189
<artifactId>shiro-web</artifactId>
189-
<version>LATEST</version>
190+
<version>1.4.1</version>
190191
</dependency>
191192

192193
<dependency>

‎NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/CsrfInterceptor.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package com.beehyv.nmsreporting.business.impl;
2+
3+
import com.beehyv.nmsreporting.business.UserService;
4+
import com.beehyv.nmsreporting.model.User;
5+
import org.springframework.beans.factory.annotation.Autowired;
6+
import org.springframework.web.servlet.ModelAndView;
7+
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
8+
9+
import javax.servlet.http.HttpServletRequest;
10+
import javax.servlet.http.HttpServletResponse;
11+
12+
public class CsrfInterceptor extends HandlerInterceptorAdapter {
13+
@Autowired
14+
private UserService userService;
15+
16+
@Override
17+
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
18+
User currentUser = userService.getCurrentUser();
19+
20+
if(currentUser == null) {
21+
return false;
22+
}
23+
String token = "dhty" + currentUser.getUserId().toString() + "alkihkf";
24+
return request.getHeader("csrfToken").equals(token);
25+
}
26+
27+
@Override
28+
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
29+
}
30+
31+
@Override
32+
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
33+
}
34+
35+
@Override
36+
public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
37+
}
38+
}

‎NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/business/impl/UserServiceImpl.java‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import com.beehyv.nmsreporting.enums.ModificationType;
1212
import com.beehyv.nmsreporting.model.*;
1313
import com.beehyv.nmsreporting.utils.LoginUser;
14+
import com.beehyv.nmsreporting.utils.ServiceFunctions;
1415
import org.apache.shiro.SecurityUtils;
1516
import org.springframework.beans.factory.annotation.Autowired;
1617
import org.springframework.security.core.context.SecurityContextHolder;
@@ -55,6 +56,8 @@ public class UserServiceImpl implements UserService{
5556
@Autowired
5657
private AggregateCumulativeMADao aggregateCumulativeMADao;
5758

59+
private ServiceFunctions serviceFunctions = new ServiceFunctions();
60+
5861
private Role getAdminRole(){
5962
return roleDao.findByRoleDescription(AccessType.ADMIN.getAccessType()).get(0);
6063
}
@@ -140,11 +143,6 @@ public Map<Integer, String> createNewUser(User user) {
140143
responseMap.put(rowNum, userNameError);
141144
return responseMap;
142145
}
143-
if (userDao.findByUserName(user.getUsername()) != null) {
144-
String userNameError = "Username already exists.";
145-
responseMap.put(rowNum, userNameError);
146-
return responseMap;
147-
}
148146

149147
String userPhone = user.getPhoneNumber();
150148
String regexStr1 = "^[0-9]*$";
@@ -311,8 +309,13 @@ else if (user.getAccessLevel().equalsIgnoreCase(AccessLevel.DISTRICT.getAccessLe
311309
// return responseMap;
312310
// }
313311
}
314-
315-
user.setPassword(passwordEncoder.encode(user.getPhoneNumber()));
312+
if (userDao.findByUserName(user.getUsername()) != null) {
313+
String userNameError = "Username already exists.";
314+
responseMap.put(rowNum, userNameError);
315+
return responseMap;
316+
}
317+
String password = serviceFunctions.generatePassword();
318+
user.setPassword(passwordEncoder.encode(password));
316319
user.setCreationDate(new Date());
317320
user.setCreatedByUser(currentUser);
318321
user.setAccountStatus(AccountStatus.ACTIVE.getAccountStatus());
@@ -321,6 +324,7 @@ else if (user.getAccessLevel().equalsIgnoreCase(AccessLevel.DISTRICT.getAccessLe
321324
userDao.saveUser(user);
322325
String authorityError = "User Created";
323326
responseMap.put(rowNum, authorityError);
327+
responseMap.put(1,password);
324328
return responseMap;
325329
}
326330

@@ -609,10 +613,13 @@ public Map<Integer, String> updatePassword(PasswordDto passwordDto) {
609613
responseMap.put(rowNum, authorityError);
610614
return responseMap;
611615
}
612-
entity.setPassword(passwordEncoder.encode(entity.getPhoneNumber()));
616+
String password = serviceFunctions.generatePassword();
617+
entity.setPassword(passwordEncoder.encode(password));
613618
entity.setDefault(true);
614619

615620
responseMap.put(rowNum, "Password changed successfully");
621+
responseMap.put(1,password);
622+
responseMap.put(2, entity.getEmailId());
616623
return responseMap;
617624
}
618625

‎NMSReportingSuite/src/main/java/com/beehyv/nmsreporting/controller/AdminController.java‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import com.beehyv.nmsreporting.model.ModificationTracker;
1212
import com.beehyv.nmsreporting.model.State;
1313
import com.beehyv.nmsreporting.model.User;
14+
import org.apache.commons.codec.binary.Base64;
1415
import org.springframework.beans.factory.annotation.Autowired;
1516
import org.springframework.expression.ParseException;
1617
import org.springframework.stereotype.Controller;
@@ -19,6 +20,8 @@
1920

2021
import javax.servlet.http.HttpServletResponse;
2122
import java.io.*;
23+
import java.net.HttpURLConnection;
24+
import java.net.URL;
2225
import java.util.*;
2326

2427
import static com.beehyv.nmsreporting.enums.ReportType.maCourse;
@@ -104,7 +107,12 @@ public Map uploadFileHandler(@RequestParam("bulkCsv") MultipartFile file) {
104107
@ResponseBody
105108
public String getBulkDataImportCSV(HttpServletResponse response) throws ParseException, java.text.ParseException{
106109

107-
response.setContentType("APPLICATION/OCTECT-STREAM");
110+
User user = userService.getCurrentUser();
111+
if(user==null||!(user.getRoleName().equals("MASTER ADMIN"))&&!(user.getRoleName().equals("ADMIN"))){
112+
return "Not Authorized";
113+
}
114+
115+
response.setContentType("APPLICATION/OCTECT-STREAM");
108116
try {
109117
PrintWriter out=response.getWriter();
110118
String filename="BulkImportData.csv";
@@ -137,7 +145,7 @@ public String getCumulativeCourseCompletion(@PathVariable("state") String State,
137145
}*/
138146

139147
@RequestMapping(value = {"/changePassword"}, method = RequestMethod.POST)
140-
@ResponseBody public Map resetPassword(@RequestBody PasswordDto passwordDto){
148+
@ResponseBody public Map resetPassword(@RequestBody PasswordDto passwordDto) throws Exception{
141149
// String trackModification = mapper.convertValue(node.get("modification"), String.class);
142150
//
143151
// ModificationTracker modification = new ModificationTracker();
@@ -148,9 +156,39 @@ public String getCumulativeCourseCompletion(@PathVariable("state") String State,
148156
// modification.setModifiedField(trackModification);
149157
// modificationTrackerService.saveModification(modification);
150158

151-
// return "redirect:http://localhost:8080/app/#!/";
159+
// return "redirect:https://rchivrreports.in/app/#!/";
152160
Map<Integer, String> map= userService.updatePassword(passwordDto);
153161
if(map.get(0).equals("Password changed successfully")){
162+
String password = map.get(1);
163+
String email = map.get(2);
164+
byte[] encoded = Base64.encodeBase64((email + "||" + password + "||admin").getBytes());
165+
String encrypted = new String(encoded);
166+
String url = "http://192.168.200.4:8080/NMSReportingSuite/nms/mail/sendPassword/" + encrypted;
167+
URL obj = new URL(url);
168+
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
169+
170+
// optional default is GET
171+
con.setRequestMethod("GET");
172+
173+
//add request header
174+
con.setRequestProperty("User-Agent", "Mozilla/5.0");
175+
176+
int responseCode = con.getResponseCode();
177+
System.out.println("\nSending 'GET' request to URL : " + url);
178+
System.out.println("Response Code : " + responseCode);
179+
180+
BufferedReader in = new BufferedReader(
181+
new InputStreamReader(con.getInputStream()));
182+
String inputLine;
183+
StringBuffer response = new StringBuffer();
184+
185+
while ((inputLine = in.readLine()) != null) {
186+
response.append(inputLine);
187+
}
188+
in.close();
189+
190+
//print result
191+
System.out.println(response.toString());
154192
ModificationTracker modification = new ModificationTracker();
155193
modification.setModificationDate(new Date(System.currentTimeMillis()));
156194
modification.setModificationType(ModificationType.UPDATE.getModificationType());
@@ -159,7 +197,9 @@ public String getCumulativeCourseCompletion(@PathVariable("state") String State,
159197
modification.setModifiedByUserId(userService.getCurrentUser().getUserId());
160198
modificationTrackerService.saveModification(modification);
161199
}
162-
return map;
200+
Map<Integer, String> requiredmap=new HashMap<>();
201+
requiredmap.put(0,map.get(0));
202+
return requiredmap;
163203
}
164204
@RequestMapping(value = "/create", method = RequestMethod.GET)
165205
@ResponseBody

0 commit comments

Comments
 (0)