『 BangMaple's Blog 』

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

package bangmaple.controllers;

import bangmaple.daos.UsersDAO;
import bangmaple.utils.AntiCSRFToken;
import java.io.IOException;
import java.sql.SQLException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

@WebServlet(name = "ChangePasswordController", urlPatterns = {"/ChangePasswordController"})
public class ChangePasswordController extends HttpServlet {

    private static final String ERROR = "error.jsp";
    private static final String SUCCESS = "success.jsp";

    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        String url = ERROR;
        try {
            HttpSession session = request.getSession();
            if (request.getParameter("btnAction") == null) {
                request.getRequestDispatcher("changePassword.jsp").forward(request, response);
            } else {
                UsersDAO dao = new UsersDAO();
                if (dao.changePassword(request.getParameter("txtUsername"), request.getParameter("txtPasswordChange"))) {
                    url = SUCCESS;
                }
            }
        } catch (ClassNotFoundException | SQLException e) {
            log("ERROR at ChangePasswordController: " + e.getMessage());
        } finally {
            if (url.equals(SUCCESS)) {
                request.getSession().invalidate();
                response.sendRedirect("success.jsp");
            } else {
                request.getRequestDispatcher(url).forward(request, response);
            }
        }
    }

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        processRequest(request, response);
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        processRequest(request, response);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

package bangmaple.controllers;

import bangmaple.daos.UsersDAO;
import bangmaple.utils.AntiCSRFToken;
import java.io.IOException;
import java.sql.SQLException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

/**
 *
 * @author bangmaple
 */
@WebServlet(name = "ChangePasswordController", urlPatterns = {"/ChangePasswordController"})
public class ChangePasswordController extends HttpServlet {

    private static final String ERROR = "error.jsp";
    private static final String SUCCESS = "success.jsp";

    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        String url = ERROR;
        try {
            HttpSession session = request.getSession();
              String antiCSRFToken;
            if (request.getParameter("btnAction") == null) {
                    antiCSRFToken = AntiCSRFToken.getToken();
                  session.setAttribute("csrfToken", antiCSRFToken);
                request.getRequestDispatcher("changePassword.jsp").forward(request, response);
            } else {
                 antiCSRFToken = String.valueOf(session.getAttribute("csrfToken"));
                if (antiCSRFToken.equals(request.getParameter("csrfToken"))) {
                UsersDAO dao = new UsersDAO();
                if (dao.changePassword(request.getParameter("txtUsername"), request.getParameter("txtPasswordChange"))) {
                    url = SUCCESS;
                }
                } else {
                  request.setAttribute("ERROR", "Invalid CSRF Token! Well done, hacker!");
                }
            }
        } catch (ClassNotFoundException | SQLException e) {
            log("ERROR at ChangePasswordController: " + e.getMessage());
        } finally {
            if (url.equals(SUCCESS)) {
                request.getSession().invalidate();
                response.sendRedirect("success.jsp");
            } else {
                request.getRequestDispatcher(url).forward(request, response);
            }
        }
    }

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        processRequest(request, response);
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        processRequest(request, response);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE html>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>JSP Page</title>
    </head>
    <body>
        <h1>Hello ${sessionScope.USER_NAME}!</h1><br/>
        <h2>Change your password!</h2><br/>
        Please input your new password!<br/>
        <form action="ChangePasswordController" method="POST">
            Current username: <input type="text" name="txtUsername" value="${sessionScope.USER_NAME}" readonly="true"/><br/>
            New password: <input type="password" name="txtPasswordChange"/><br/>
            <input type="hidden" name="csrfToken" value="${sessionScope.csrfToken}"/>
            <input type="submit" name="btnAction" value="Change password now!"/>
        </form>
    </body>
</html>