Examples with InputValidator org.apache.wiki.ui.InputValidator used on opensource projects

Example 1 with InputValidator

use of org.apache.wiki.ui.InputValidator in project jspwiki by apache.

the class GroupManager method checkGroupName.

/**
 * Checks if a String is blank or a restricted Group name, and if it is,
 * appends an error to the WikiSession's message list.
 * @param context the wiki context
 * @param name the Group name to test
 * @throws WikiSecurityException if <code>session</code> is
 * <code>null</code> or the Group name is illegal
 * @see Group#RESTRICTED_GROUPNAMES
 */
protected void checkGroupName(WikiContext context, String name) throws WikiSecurityException {
    // TODO: groups cannot have the same name as a user
    // Name cannot be null
    InputValidator validator = new InputValidator(MESSAGES_KEY, context);
    validator.validateNotNull(name, "Group name");
    // Name cannot be one of the restricted names either
    if (ArrayUtils.contains(Group.RESTRICTED_GROUPNAMES, name)) {
        throw new WikiSecurityException("The group name '" + name + "' is illegal. Choose another.");
    }
}

Example 2 with InputValidator

use of org.apache.wiki.ui.InputValidator in project jspwiki by apache.

the class GroupManager method validateGroup.

/**
 * Validates a Group, and appends any errors to the session errors list. Any
 * validation errors are added to the wiki session's messages collection
 * (see {@link WikiSession#getMessages()}.
 * @param context the current wiki context
 * @param group the supplied Group
 */
public void validateGroup(WikiContext context, Group group) {
    InputValidator validator = new InputValidator(MESSAGES_KEY, context);
    // Name cannot be null or one of the restricted names
    try {
        checkGroupName(context, group.getName());
    } catch (WikiSecurityException e) {
    }
    // Member names must be "safe" strings
    Principal[] members = group.members();
    for (int i = 0; i < members.length; i++) {
        validator.validateNotNull(members[i].getName(), "Full name", InputValidator.ID);
    }
}

Example 3 with InputValidator

use of org.apache.wiki.ui.InputValidator in project jspwiki by apache.

the class UserManager method validateProfile.

/**
 * Validates a user profile, and appends any errors to the session errors
 * list. If the profile is new, the password will be checked to make sure it
 * isn't null. Otherwise, the password is checked for length and that it
 * matches the value of the 'password2' HTTP parameter. Note that we have a
 * special case when container-managed authentication is used and the user
 * is not authenticated; this will always cause validation to fail. Any
 * validation errors are added to the wiki session's messages collection
 * (see {@link WikiSession#getMessages()}.
 * @param context the current wiki context
 * @param profile the supplied UserProfile
 */
public void validateProfile(WikiContext context, UserProfile profile) {
    final boolean isNew = profile.isNew();
    final WikiSession session = context.getWikiSession();
    final InputValidator validator = new InputValidator(SESSION_MESSAGES, context);
    final ResourceBundle rb = Preferences.getBundle(context, InternationalizationManager.CORE_BUNDLE);
    // 
    // Query the SpamFilter first
    // 
    final FilterManager fm = m_engine.getFilterManager();
    final List<PageFilter> ls = fm.getFilterList();
    for (final PageFilter pf : ls) {
        if (pf instanceof SpamFilter) {
            if (((SpamFilter) pf).isValidUserProfile(context, profile) == false) {
                session.addMessage(SESSION_MESSAGES, "Invalid userprofile");
                return;
            }
            break;
        }
    }
    // If container-managed auth and user not logged in, throw an error
    if (m_engine.getAuthenticationManager().isContainerAuthenticated() && !context.getWikiSession().isAuthenticated()) {
        session.addMessage(SESSION_MESSAGES, rb.getString("security.error.createprofilebeforelogin"));
    }
    validator.validateNotNull(profile.getLoginName(), rb.getString("security.user.loginname"));
    validator.validateNotNull(profile.getFullname(), rb.getString("security.user.fullname"));
    validator.validate(profile.getEmail(), rb.getString("security.user.email"), InputValidator.EMAIL);
    // If new profile, passwords must match and can't be null
    if (!m_engine.getAuthenticationManager().isContainerAuthenticated()) {
        final String password = profile.getPassword();
        if (password == null) {
            if (isNew) {
                session.addMessage(SESSION_MESSAGES, rb.getString("security.error.blankpassword"));
            }
        } else {
            final HttpServletRequest request = context.getHttpRequest();
            final String password2 = (request == null) ? null : request.getParameter("password2");
            if (!password.equals(password2)) {
                session.addMessage(SESSION_MESSAGES, rb.getString("security.error.passwordnomatch"));
            }
        }
    }
    UserProfile otherProfile;
    final String fullName = profile.getFullname();
    final String loginName = profile.getLoginName();
    final String email = profile.getEmail();
    // It's illegal to use as a full name someone else's login name
    try {
        otherProfile = getUserDatabase().find(fullName);
        if (otherProfile != null && !profile.equals(otherProfile) && !fullName.equals(otherProfile.getFullname())) {
            final Object[] args = { fullName };
            session.addMessage(SESSION_MESSAGES, MessageFormat.format(rb.getString("security.error.illegalfullname"), args));
        }
    } catch (final NoSuchPrincipalException e) {
    /* It's clean */
    }
    // It's illegal to use as a login name someone else's full name
    try {
        otherProfile = getUserDatabase().find(loginName);
        if (otherProfile != null && !profile.equals(otherProfile) && !loginName.equals(otherProfile.getLoginName())) {
            final Object[] args = { loginName };
            session.addMessage(SESSION_MESSAGES, MessageFormat.format(rb.getString("security.error.illegalloginname"), args));
        }
    } catch (final NoSuchPrincipalException e) {
    /* It's clean */
    }
    // It's illegal to use multiple accounts with the same email
    try {
        otherProfile = getUserDatabase().findByEmail(email);
        if (otherProfile != null && // Issue JSPWIKI-1042
        !profile.getUid().equals(otherProfile.getUid()) && !profile.equals(otherProfile) && StringUtils.lowerCase(email).equals(StringUtils.lowerCase(otherProfile.getEmail()))) {
            final Object[] args = { email };
            session.addMessage(SESSION_MESSAGES, MessageFormat.format(rb.getString("security.error.email.taken"), args));
        }
    } catch (final NoSuchPrincipalException e) {
    /* It's clean */
    }
}