From e59d9d987a5dc29dc210feb28f4f347f12db4e5c Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Fri, 18 Sep 2015 08:27:32 -0400
Subject: [PATCH] Update to Wicket 1.4.22
---
src/main/java/com/gitblit/wicket/pages/RootPage.java | 33 +++++++++++++++++++++++----------
1 files changed, 23 insertions(+), 10 deletions(-)
diff --git a/src/main/java/com/gitblit/wicket/pages/RootPage.java b/src/main/java/com/gitblit/wicket/pages/RootPage.java
index b1c3639..6d7ebd8 100644
--- a/src/main/java/com/gitblit/wicket/pages/RootPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/RootPage.java
@@ -31,6 +31,9 @@
import java.util.concurrent.atomic.AtomicInteger;
import java.util.regex.Pattern;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
import org.apache.wicket.MarkupContainer;
import org.apache.wicket.PageParameters;
import org.apache.wicket.behavior.HeaderContributor;
@@ -46,9 +49,11 @@
import org.apache.wicket.markup.repeater.data.ListDataProvider;
import org.apache.wicket.model.IModel;
import org.apache.wicket.model.Model;
+import org.apache.wicket.protocol.http.WebRequest;
import org.apache.wicket.protocol.http.WebResponse;
import com.gitblit.Constants;
+import com.gitblit.Constants.AuthenticationType;
import com.gitblit.Keys;
import com.gitblit.extensions.NavLinkExtension;
import com.gitblit.extensions.UserMenuExtension;
@@ -68,7 +73,7 @@
import com.gitblit.wicket.GitBlitWebSession;
import com.gitblit.wicket.SessionlessForm;
import com.gitblit.wicket.WicketUtils;
-import com.gitblit.wicket.panels.GravatarImage;
+import com.gitblit.wicket.panels.AvatarImage;
import com.gitblit.wicket.panels.LinkPanel;
import com.gitblit.wicket.panels.NavigationPanel;
@@ -146,6 +151,7 @@
boolean authenticateAdmin = app().settings().getBoolean(Keys.web.authenticateAdminPages, true);
boolean allowAdmin = app().settings().getBoolean(Keys.web.allowAdministration, true);
boolean allowLucene = app().settings().getBoolean(Keys.web.allowLuceneIndexing, true);
+ boolean displayUserPanel = app().settings().getBoolean(Keys.web.displayUserPanel, true);
boolean isLoggedIn = GitBlitWebSession.get().isLoggedIn();
if (authenticateAdmin) {
@@ -163,7 +169,7 @@
}
}
- if (authenticateView || authenticateAdmin) {
+ if (displayUserPanel && (authenticateView || authenticateAdmin)) {
if (isLoggedIn) {
UserMenu userFragment = new UserMenu("userPanel", "userMenuFragment", RootPage.this);
add(userFragment);
@@ -261,28 +267,33 @@
private void loginUser(UserModel user) {
if (user != null) {
+ HttpServletRequest request = ((WebRequest) getRequest()).getHttpServletRequest();
+ HttpServletResponse response = ((WebResponse) getResponse()).getHttpServletResponse();
+
// Set the user into the session
GitBlitWebSession session = GitBlitWebSession.get();
+
// issue 62: fix session fixation vulnerability
session.replaceSession();
session.setUser(user);
+ request = ((WebRequest) getRequest()).getHttpServletRequest();
+ response = ((WebResponse) getResponse()).getHttpServletResponse();
+ request.getSession().setAttribute(Constants.AUTHENTICATION_TYPE, AuthenticationType.CREDENTIALS);
+
// Set Cookie
- if (app().settings().getBoolean(Keys.web.allowCookieAuthentication, false)) {
- WebResponse response = (WebResponse) getRequestCycle().getResponse();
- app().authentication().setCookie(response.getHttpServletResponse(), user);
- }
+ app().authentication().setCookie(request, response, user);
if (!session.continueRequest()) {
PageParameters params = getPageParameters();
if (params == null) {
// redirect to this page
- setResponsePage(getClass());
+ redirectTo(getClass());
} else {
// Strip username and password and redirect to this page
params.remove("username");
params.remove("password");
- setResponsePage(getClass(), params);
+ redirectTo(getClass(), params);
}
}
}
@@ -596,10 +607,12 @@
GitBlitWebSession session = GitBlitWebSession.get();
UserModel user = session.getUser();
boolean editCredentials = app().authentication().supportsCredentialChanges(user);
- boolean standardLogin = session.authenticationType.isStandard();
+ HttpServletRequest request = ((WebRequest) getRequest()).getHttpServletRequest();
+ AuthenticationType authenticationType = (AuthenticationType) request.getSession().getAttribute(Constants.AUTHENTICATION_TYPE);
+ boolean standardLogin = authenticationType.isStandard();
if (app().settings().getBoolean(Keys.web.allowGravatar, true)) {
- add(new GravatarImage("username", user, "navbarGravatar", 20, false));
+ add(new AvatarImage("username", user, "navbarGravatar", 20, false));
} else {
add(new Label("username", user.getDisplayName()));
}
--
Gitblit v1.9.1