head	1.10;
access;
symbols
	TIGRIS_NOV_12_2000:1.9
	OLDHELM:1.9.0.4
	TIGRIS_NOV_11_2000:1.9
	TIGRIS_SEP_13_2000:1.9.0.2
	TIGRIS_BASELINE:1.9;
locks; strict;
comment	@# @;


1.10
date	2000.11.12.23.10.06;	author dlr;	state dead;
branches;
next	1.9;

1.9
date	2000.09.20.03.13.14;	author brian;	state Exp;
branches;
next	1.8;

1.8
date	2000.08.29.22.12.06;	author jrobbins;	state Exp;
branches;
next	1.7;

1.7
date	2000.06.22.23.39.30;	author dlr;	state Exp;
branches;
next	1.6;

1.6
date	2000.05.26.00.19.55;	author jrobbins;	state Exp;
branches;
next	1.5;

1.5
date	2000.05.02.03.09.49;	author jrobbins;	state Exp;
branches;
next	1.4;

1.4
date	2000.05.02.01.17.10;	author jrobbins;	state Exp;
branches;
next	1.3;

1.3
date	2000.04.18.00.10.33;	author jrobbins;	state Exp;
branches;
next	1.2;

1.2
date	2000.02.03.04.21.31;	author jrobbins;	state Exp;
branches;
next	1.1;

1.1
date	2000.01.30.01.59.36;	author jrobbins;	state Exp;
branches;
next	;


desc
@@


1.10
log
@Does not exist--possibly only WRT this location--in newhelm.
@
text
@/* ================================================================
 * Copyright (c) 2000 Collab.Net.  All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 * 
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 
 * 3. The end-user documentation included with the redistribution, if
 * any, must include the following acknowlegement: "This product includes
 * software developed by Collab.Net (http://www.Collab.Net/)."
 * Alternately, this acknowlegement may appear in the software itself, if
 * and wherever such third-party acknowlegements normally appear.
 * 
 * 4. The hosted project names must not be used to endorse or promote
 * products derived from this software without prior written
 * permission. For written permission, please contact info@@collab.net.
 * 
 * 5. Products derived from this software may not use the "Tigris" name
 * nor may "Tigris" appear in their names without prior written
 * permission of Collab.Net.
 * 
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL COLLAB.NET OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
 * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * ====================================================================
 * 
 * This software consists of voluntary contributions made by many
 * individuals on behalf of Collab.Net.
 */


package org.tigris.helm.admin;

import org.webmacro.util.*;
import org.webmacro.servlet.*;
import org.webmacro.engine.*;
import org.webmacro.broker.*;

import javax.servlet.*;
import javax.servlet.http.*;

import java.sql.*;
import java.io.IOException;
import com.sun.java.util.collections.ArrayList;
import com.sun.java.util.collections.Iterator;
import gnu.regexp.RE;

import org.joist.security.PermissionSet;
import org.joist.security.RedirectException;
import org.joist.security.SecureServlet;
import org.joist.session.SessionManager;
import org.joist.database.DataManager;

import org.tigris.helm.tool.TigrisUpdate;
import org.tigris.helm.tool.UpdateException;
import org.tigris.helm.database.ProjectManager;
import org.tigris.helm.database.UserPrivs;
import org.tigris.helm.database.TUserManager;


/**
 * Displays the current settings for a Tigris user, and allows editing
 * of them. When called with no username parameter, it also serves as
 * the user preferences servlet, allowing a user to change their own
 * information.
 */
public class UserEdit extends SecureServlet {

    static public Log log = new Log("usrEdt", "UserEdit");
    static private boolean debug = true;
    
    static private RE emailRE = null;
    static private RE loginRE = null;
    static private RE realnameRE = null;
    //static private RE passwordRE = null;
    
    public void start() throws ServletException {
	super.start();
	try {
	    emailRE = new RE("^[\\w\\-\\._=\\!#\\*\\+]+@@([\\w\\-]+\\.)+[a-zA-Z]{2,3}$");
	    loginRE = new RE("^[\\w]{1,16}$");
	    realnameRE = new RE("^[\\w \\-\\.\\,]+$");
	    //passwordRE = new RE("^[\w]{4,8}$"); //not used
	}
	catch (gnu.regexp.REException e) {
	    log.exception(e);
	}
    }
    
    
  protected String processRequest(Connection connection, WebContext context)
    throws HandlerException, RedirectException
  {
    String templateName = super.processRequest(connection, context);

    PermissionSet userPerms = (PermissionSet)context.get("UserPermissions");
    String username = (String) context.getForm("user");
    String real_name = (String) context.getForm("real_name");
    String email = (String) context.getForm("email");
    String loginUserID = (String)context.get("loginUserID");

    String loginLoginName = "";
    String loginUserRoleName = "";

    try {
	SessionManager sMgr = getSessionManager(context);
	DataManager dMgr = sMgr.getDataManager();
        TUserManager uMgr = (TUserManager)
            dMgr.getManager("org.tigris.helm.database.TUserManager");
	loginLoginName = uMgr.getLoginID(connection, loginUserID);
	loginUserRoleName = uMgr.getUserRole(connection, loginLoginName);
    }
    catch (TUserManager.NoSuchUserException e) {
	log.exception(e);
	String message = "UserEdit: " + e.getMessage();
	if (debug) log.debug(message);
	throw new HandlerException(e.getMessage());
    }
    catch (SQLException e) {
	log.exception(e);
	String message = "UserEdit: " + e.getMessage();
	if (debug) log.debug(message);
	throw new HandlerException(e.getMessage());
    }
    
    if (debug) log.debug("UserEdit: user=" + username);
    context.put("user", username);
    context.put("real_name", real_name);
    context.put("email", email);
    context.put("changed", Boolean.FALSE);
    context.put("passwordMismatch", Boolean.FALSE);
    context.put("password1", "");
    context.put("password2", "");
    context.put("validationErrors", new ArrayList());
    context.put("loginLoginName", loginLoginName);	

    String action = (String) context.get("action");
    if (debug) log.debug("action=" + action);
    
    try {
	if (userPerms.accessAllowed("User - Change") || loginLoginName.equals(username)) { 
	    if (action != null && action.equals("Change Name And Email"))
		updateNameAndEmail(connection, context);
	    else if (action != null && action.equals("Change Password"))
		updatePassword(connection, context);
	    else if (action != null && action.equals("Change Privileges"))
		updatePrivleges(connection, context, loginUserRoleName);
	}
	displayPage(connection, context);
    }
    catch (SQLException e) {
	log.exception(e);
	String message = "UserEdit: " + e.getMessage();
	if (debug) log.debug(message);
	throw new HandlerException(e.getMessage());
    }
    catch (UpdateException e) {
	log.exception(e);
	String message = "UserEdit: " + e.getMessage();
	if (debug) log.debug(message);
	throw new HandlerException(e.getMessage());
    }
    if (debug) log.debug("done");
    
    return templateName;
  }
    


    protected void updateNameAndEmail(Connection connection, WebContext context)
	throws SQLException, UpdateException
    {
	if (debug) log.debug("updateNameAndEmail");
	String username = context.getForm("user");
	String real_name = context.getForm("real_name");
	String email = context.getForm("email");

	if (!emailRE.isMatch(email)) {
	    ArrayList validationErrors = new ArrayList();
	    validationErrors.add("Email Address");
	    context.put("validationErrors", validationErrors);
	    if (debug) log.debug("invalid email");
	    return;
	}
	
	if (!realnameRE.isMatch(real_name)) {
	    ArrayList validationErrors = new ArrayList();
	    validationErrors.add("Real Name");
	    context.put("validationErrors", validationErrors);
	    if (debug) log.debug("invalid real name");
	    return;
	}
	
	// TODO: move db logic into UserManager class, or reuse sXc
	Statement s = connection.createStatement();
	// Make changes to domain_users table
	s.executeUpdate("UPDATE domain_users SET real_name = '"
			+ real_name
			+ "', email = '" + email
			+ "' WHERE username = '" + username + "'");
	s.executeUpdate("UPDATE User SET name = '"
			+ real_name
			+ "', email = '" + email
			+ "' WHERE loginID = '" + username + "'");
	// This change needs to be propogated (n.b. that the others
	// do not)
	TigrisUpdate.update(connection);
	context.put("changed", Boolean.TRUE);
	if (debug) log.debug("updateNameAndEmail done");
    }
    
    protected void updatePassword(Connection connection, WebContext context)
	throws SQLException, UpdateException
    {
	if (debug) log.debug("updatePassword");
	String password1 = context.getForm("password1");
	String password2 = context.getForm("password2");
	String username = context.getForm("user");
        if (password1 != null && password2 != null &&
	    password1.equals(password2)) {
	    Statement s = connection.createStatement();
	    s.executeUpdate("UPDATE domain_users SET password = "
                          + "PASSWORD('" + password1
                          + "') WHERE username = '" + username + "'");
	    
	    s.executeUpdate("UPDATE User SET password = "
                          + "PASSWORD('" + password1
                          + "') WHERE loginID = '" + username + "'");
	    
	    context.put("changed", Boolean.TRUE);
        } else {
	    context.put("passwordMismatch", Boolean.TRUE);
        }
    }


    protected void updatePrivleges(Connection connection, WebContext context, String loginUserRoleName)
	throws SQLException, UpdateException, HandlerException
    {
      if (debug) log.debug("updatePrivleges");
      SessionManager sMgr = getSessionManager(context);
      DataManager dMgr = sMgr.getDataManager();
      TUserManager uMgr = (TUserManager)
          dMgr.getManager("org.tigris.helm.database.TUserManager");

      String username = context.getForm("user");
      //TODO: replace with sXc privleges
      UserPrivs userPrivs;
      //req.verifyDomainPriv("users_priv");
      try {
	  userPrivs = new UserPrivs(connection, username);
      }
      catch (UserPrivs.UserDoesNotExist e) {
	  log.exception(e);
	    String message = "UserEdit: " + e.getMessage();
	    if (debug) log.debug(message);
	    throw new HandlerException(e.getMessage());
      }

      // TODO: replace with sXc prileges
      Iterator i = userPrivs.getPrivNames().iterator();
      while (i.hasNext()) {
	  String priv = (String)i.next();
	  userPrivs.setPrivilege(connection,
				 priv, context.getForm(priv) != null);
      }
      context.put("changed", Boolean.TRUE);

      String rolename = context.getForm("role");
      try {
	  if (debug) log.debug("u=" + username + " r="+rolename);
	  if ("Web Site Administrator".equals(rolename)) {
	      if (!("Web Site Administrator".equals(loginUserRoleName))) return;
	  }
	  uMgr.setUserRole(connection, username, rolename);
      }
      catch (SQLException e) {
	  log.exception(e);
	  String message = "UserEdit: " + e.getMessage();
	  if (debug) log.debug(message);
	  throw new HandlerException(e.getMessage());
      }
      catch (TUserManager.NoSuchUserException e) {
	  log.exception(e);
	  String message = "UserEdit: " + e.getMessage();
	  if (debug) log.debug(message);
	  throw new HandlerException(e.getMessage());
      }
      
    }

    protected void displayPage(Connection connection, WebContext context)
	throws SQLException, HandlerException, RedirectException
    {
	if (debug) log.debug("displayPage");
	SessionManager sMgr = getSessionManager(context);
	DataManager dMgr = sMgr.getDataManager();
        TUserManager uMgr = (TUserManager)
            dMgr.getManager("org.tigris.helm.database.TUserManager");

	// Get the userID and permissions of the person who logged in.
	String loginUserID = (String)context.get("loginUserID");
	String username = (String) context.getForm("user");
	PermissionSet userPerms = (PermissionSet)context.get("UserPermissions");

	String role = "Active Developer";
	final String roles[] = {
	    "Web Site Administrator",
	    "Sponsor Administrator",
	    "Project Owner",
	    "Module Owner",
	    "Active Developer"
	};
	context.put("roles", roles);
	
	//TODO: replace with sXc privleges
	UserPrivs userPrivs;
	//req.verifyDomainPriv("users_priv");
	try {
	    userPrivs = new UserPrivs(connection, username);
	    role = uMgr.getUserRole(connection, username);
	    context.put("role", role);
	}
	catch (TUserManager.NoSuchUserException e) {
	    log.exception(e);
	    String message = "UserEdit: " + e.getMessage();
	    if (debug) log.debug(message);
	    throw new HandlerException(e.getMessage());
	}
	catch (UserPrivs.UserDoesNotExist e) {
	    log.exception(e);
	    String message = "UserEdit: " + e.getMessage();
	    if (debug) log.debug(message);
	    throw new HandlerException(e.getMessage());
	}
	
	// Obtain information from domain_users table
	Statement s = connection.createStatement();
	ResultSet user = s.executeQuery("SELECT real_name, email "
					+ "FROM domain_users WHERE username "
					+ "= '" + username + "'");
	if (user.next()) {
	    context.put("real_name", user.getString(1));
	    context.put("email", user.getString(2));
	} else {
	    redirectToError(context, "UserEdit: Username " + username
			    + " not present in database");
	}
    
	// Obtain information from domain_privs table
	// TODO: replace with sXc prileges
	log.debug(userPrivs.rowExists ? "rowExists" : "no such row!");
	UserPrivs.UPEntry privArray[] = userPrivs.getPrivArray();
	for (int i = 0; i < privArray.length; i++) {
	    log.debug(privArray[i].getName() + " " + privArray[i].getValue());
	}
	context.put("privList", privArray);
	
	// Get the list of projects we have privs for
	ArrayList projects = new ArrayList();
	ResultSet project =
	    s.executeQuery("SELECT project_privs.project,"
			   + "domain_projects.long_name FROM project_privs,"
			   + "domain_projects WHERE project_privs.project "
			   + "= domain_projects.project AND username = '"
			   + username + "' ORDER BY project_privs.project");
	while (project.next()) {
	    projects.add(new ProjectManager.Entry(project.getString(1),
						  project.getString(2)));
	}
	context.put("projects", projects);
	if (debug) log.debug("UserEdit: projects=" + projects);
    }
    
    
} /* end class UserEdit */
@


1.9
log
@
Obtained from:
Submitted by:
Reviewed by:

Moved from org.helm to org.tigris.helm
Moved from org/helm to org/tigris/helm

perl -pi.bak -e, how I love thee

note: this update was done POST-CVS-REPOSITORY surgury.  In order to
get this right, you may need to remove the directories

$CVSROOT/helm/java/org/helm
$CVSROOT/helm/data/htdoc/look/www/org/helm
$CVSROOT/helm/templates/org/helm

before doing the "CVS update" call, since those directories don't
exist anymore and CVS will try to create lockfiles for you in them,
giving you an error.
@
text
@@


1.8
log
@added more form validation
@
text
@d48 1
a48 1
package org.helm.admin;
d70 5
a74 5
import org.helm.tool.TigrisUpdate;
import org.helm.tool.UpdateException;
import org.helm.database.ProjectManager;
import org.helm.database.UserPrivs;
import org.helm.database.TUserManager;
d125 1
a125 1
            dMgr.getManager("org.helm.database.TUserManager");
d260 1
a260 1
          dMgr.getManager("org.helm.database.TUserManager");
d315 1
a315 1
            dMgr.getManager("org.helm.database.TUserManager");
@


1.7
log
@Switched from DataManager.getXxxManger() API to DataManager.getManager("xxx.xxx.xxx").  Please note that this has the possiblity of introducing minor bugs if I did not type all the fully qualified class names properly.
@
text
@d90 1
d98 1
d199 8
@


1.6
log
@fixes related to sponsor admin bugs
@
text
@d122 2
a123 1
	TUserManager uMgr = (TUserManager) dMgr.getUserManager();
d249 2
a250 1
      TUserManager uMgr = (TUserManager) dMgr.getUserManager();
d304 3
a306 1
	TUserManager uMgr = (TUserManager) dMgr.getUserManager();
@


1.5
log
@changed loginUserName to loginLoginName, confusing huh?
@
text
@d117 1
d124 1
d160 1
a160 1
		updatePrivleges(connection, context);
d242 1
a242 1
    protected void updatePrivleges(Connection connection, WebContext context)
d276 3
d304 1
@


1.4
log
@Now users can edit their own preferences
@
text
@d114 23
a136 1
    String loginUserName = (String)context.get("loginUserName");
d146 1
a146 1
	
d152 1
a152 1
	if (userPerms.accessAllowed("User - Change") || loginUserName.equals(username)) { 
@


1.3
log
@switched from collections2.jar to collections.jar
@
text
@d80 1
a80 1
 * the user preferences servlet, allowin a user to change their own
d114 1
d130 8
a137 10
	if (action != null && action.equals("Change Name And Email")
	    && userPerms.accessAllowed("User - Change") )
	    updateNameAndEmail(connection, context);
	else if (action != null && action.equals("Change Password")
		 && userPerms.accessAllowed("User - Change") )
	    updatePassword(connection, context);
	else if (action != null && action.equals("Change Privileges")
		 && userPerms.accessAllowed("User - Change") )
	    updatePrivleges(connection, context);

a276 1
	String loginUserID = (String)context.get("loginUserID");
@


1.2
log
@Added tigris.org license
PR:
Obtained from:
Submitted by:
Reviewed by:
@
text
@d60 2
a61 2
import java.util.ArrayList;
import java.util.Iterator;
@


1.1
log
@initial checking
@
text
@d1 46
a46 1
// Copyright (c) 2000 Collab.Net, Inc. All Rights Reserved.
@

