Examples with SpamFilter org.apache.wiki.filters.SpamFilter used on opensource projects

Example 1 with SpamFilter

use of org.apache.wiki.filters.SpamFilter in project jspwiki by apache.

the class UserManager method validateProfile.

/**
 * Validates a user profile, and appends any errors to the session errors
 * list. If the profile is new, the password will be checked to make sure it
 * isn't null. Otherwise, the password is checked for length and that it
 * matches the value of the 'password2' HTTP parameter. Note that we have a
 * special case when container-managed authentication is used and the user
 * is not authenticated; this will always cause validation to fail. Any
 * validation errors are added to the wiki session's messages collection
 * (see {@link WikiSession#getMessages()}.
 * @param context the current wiki context
 * @param profile the supplied UserProfile
 */
public void validateProfile(WikiContext context, UserProfile profile) {
    final boolean isNew = profile.isNew();
    final WikiSession session = context.getWikiSession();
    final InputValidator validator = new InputValidator(SESSION_MESSAGES, context);
    final ResourceBundle rb = Preferences.getBundle(context, InternationalizationManager.CORE_BUNDLE);
    // 
    // Query the SpamFilter first
    // 
    final FilterManager fm = m_engine.getFilterManager();
    final List<PageFilter> ls = fm.getFilterList();
    for (final PageFilter pf : ls) {
        if (pf instanceof SpamFilter) {
            if (((SpamFilter) pf).isValidUserProfile(context, profile) == false) {
                session.addMessage(SESSION_MESSAGES, "Invalid userprofile");
                return;
            }
            break;
        }
    }
    // If container-managed auth and user not logged in, throw an error
    if (m_engine.getAuthenticationManager().isContainerAuthenticated() && !context.getWikiSession().isAuthenticated()) {
        session.addMessage(SESSION_MESSAGES, rb.getString("security.error.createprofilebeforelogin"));
    }
    validator.validateNotNull(profile.getLoginName(), rb.getString("security.user.loginname"));
    validator.validateNotNull(profile.getFullname(), rb.getString("security.user.fullname"));
    validator.validate(profile.getEmail(), rb.getString("security.user.email"), InputValidator.EMAIL);
    // If new profile, passwords must match and can't be null
    if (!m_engine.getAuthenticationManager().isContainerAuthenticated()) {
        final String password = profile.getPassword();
        if (password == null) {
            if (isNew) {
                session.addMessage(SESSION_MESSAGES, rb.getString("security.error.blankpassword"));
            }
        } else {
            final HttpServletRequest request = context.getHttpRequest();
            final String password2 = (request == null) ? null : request.getParameter("password2");
            if (!password.equals(password2)) {
                session.addMessage(SESSION_MESSAGES, rb.getString("security.error.passwordnomatch"));
            }
        }
    }
    UserProfile otherProfile;
    final String fullName = profile.getFullname();
    final String loginName = profile.getLoginName();
    final String email = profile.getEmail();
    // It's illegal to use as a full name someone else's login name
    try {
        otherProfile = getUserDatabase().find(fullName);
        if (otherProfile != null && !profile.equals(otherProfile) && !fullName.equals(otherProfile.getFullname())) {
            final Object[] args = { fullName };
            session.addMessage(SESSION_MESSAGES, MessageFormat.format(rb.getString("security.error.illegalfullname"), args));
        }
    } catch (final NoSuchPrincipalException e) {
    /* It's clean */
    }
    // It's illegal to use as a login name someone else's full name
    try {
        otherProfile = getUserDatabase().find(loginName);
        if (otherProfile != null && !profile.equals(otherProfile) && !loginName.equals(otherProfile.getLoginName())) {
            final Object[] args = { loginName };
            session.addMessage(SESSION_MESSAGES, MessageFormat.format(rb.getString("security.error.illegalloginname"), args));
        }
    } catch (final NoSuchPrincipalException e) {
    /* It's clean */
    }
    // It's illegal to use multiple accounts with the same email
    try {
        otherProfile = getUserDatabase().findByEmail(email);
        if (otherProfile != null && // Issue JSPWIKI-1042
        !profile.getUid().equals(otherProfile.getUid()) && !profile.equals(otherProfile) && StringUtils.lowerCase(email).equals(StringUtils.lowerCase(otherProfile.getEmail()))) {
            final Object[] args = { email };
            session.addMessage(SESSION_MESSAGES, MessageFormat.format(rb.getString("security.error.email.taken"), args));
        }
    } catch (final NoSuchPrincipalException e) {
    /* It's clean */
    }
}