Skip to content

Commit 8dc512c

Browse files
author
droodev
committedOct 28, 2015
Security fixed
·
1.0
1 parent 99b9496 commit 8dc512c

File tree

10 files changed

+205
-65
lines changed

10 files changed

+205
-65
lines changed
 

‎src/main/webapp/WEB-INF/web.xml

+77-46
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,80 @@
11
<web-app xmlns="http://java.sun.com/xml/ns/javaee" version="2.5">
2-
<filter>
3-
<filter-name>CorsFilter</filter-name>
4-
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
5-
<init-param>
6-
<param-name>cors.allowed.headers</param-name>
7-
<param-value>Accept,Accept-Encoding,Accept-Language,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,Connection,Content-Type,Host,Origin,Referer,Token-Id,User-Agent, X-Requested-With</param-value>
8-
</init-param>
9-
<init-param>
10-
<param-name>cors.allowed.origins</param-name>
11-
<param-value>*</param-value>
12-
</init-param>
13-
<init-param>
14-
<param-name>cors.allowed.methods</param-name>
15-
<param-value>GET, POST, PUT, DELETE, OPTIONS, HEAD</param-value>
16-
</init-param>
17-
<init-param>
18-
<param-name>cors.support.credentials</param-name>
19-
<param-value>true</param-value>
20-
</init-param>
21-
</filter>
22-
<filter-mapping>
23-
<filter-name>CorsFilter</filter-name>
24-
<url-pattern>/rest/*</url-pattern>
25-
</filter-mapping>
2+
<filter>
3+
<filter-name>CorsFilter</filter-name>
4+
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
5+
<init-param>
6+
<param-name>cors.allowed.headers</param-name>
7+
<param-value>
8+
Accept,Accept-Encoding,Accept-Language,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,Connection,Content-Type,Host,Origin,Referer,Token-Id,User-Agent,
9+
X-Requested-With
10+
</param-value>
11+
</init-param>
12+
<init-param>
13+
<param-name>cors.allowed.origins</param-name>
14+
<param-value>*</param-value>
15+
</init-param>
16+
<init-param>
17+
<param-name>cors.allowed.methods</param-name>
18+
<param-value>GET, POST, PUT, DELETE, OPTIONS, HEAD</param-value>
19+
</init-param>
20+
<init-param>
21+
<param-name>cors.support.credentials</param-name>
22+
<param-value>true</param-value>
23+
</init-param>
24+
</filter>
25+
<filter-mapping>
26+
<filter-name>CorsFilter</filter-name>
27+
<url-pattern>/*</url-pattern>
28+
</filter-mapping>
2629

27-
<security-constraint>
28-
<web-resource-collection>
29-
<web-resource-name>whole_app</web-resource-name>
30-
<url-pattern>/*</url-pattern>
31-
<http-method>GET</http-method>
32-
<http-method>POST</http-method>
33-
<http-method>PUT</http-method>
34-
<http-method>DELETE</http-method>
35-
</web-resource-collection>
36-
<auth-constraint>
37-
<role-name>adminRole</role-name>
38-
</auth-constraint>
39-
<user-data-constraint>
40-
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
41-
</user-data-constraint>
42-
</security-constraint>
43-
<login-config>
44-
<auth-method>BASIC</auth-method>
45-
</login-config>
46-
<security-role>
47-
<role-name>adminRole</role-name>
48-
</security-role>
30+
<security-constraint>
31+
<web-resource-collection>
32+
<web-resource-name>restAdding</web-resource-name>
33+
<url-pattern>/rest/papers/*</url-pattern>
34+
<http-method>GET</http-method>
35+
<http-method>POST</http-method>
36+
</web-resource-collection>
37+
</security-constraint>
38+
39+
<security-constraint>
40+
<web-resource-collection>
41+
<web-resource-name>restJournalsTaking</web-resource-name>
42+
<url-pattern>/rest/journals/*</url-pattern>
43+
<http-method>GET</http-method>
44+
</web-resource-collection>
45+
</security-constraint>
46+
47+
<security-constraint>
48+
<web-resource-collection>
49+
<web-resource-name>angular</web-resource-name>
50+
<url-pattern>/adding.html/*</url-pattern>
51+
<url-pattern>/bower_components/*</url-pattern>
52+
<url-pattern>/scripts/*</url-pattern>
53+
<url-pattern>/views/papers/*</url-pattern>
54+
<url-pattern>/styles/*</url-pattern>
55+
</web-resource-collection>
56+
</security-constraint>
57+
58+
<security-constraint>
59+
<web-resource-collection>
60+
<web-resource-name>whole_app</web-resource-name>
61+
<url-pattern>/*</url-pattern>
62+
<http-method>GET</http-method>
63+
<http-method>POST</http-method>
64+
<http-method>PUT</http-method>
65+
<http-method>DELETE</http-method>
66+
</web-resource-collection>
67+
<auth-constraint>
68+
<role-name>adminRole</role-name>
69+
</auth-constraint>
70+
<user-data-constraint>
71+
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
72+
</user-data-constraint>
73+
</security-constraint>
74+
<login-config>
75+
<auth-method>BASIC</auth-method>
76+
</login-config>
77+
<security-role>
78+
<role-name>adminRole</role-name>
79+
</security-role>
4980
</web-app>

‎src/main/webapp/adding.html

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
<!doctype html>
2+
<html class="no-js">
3+
<head>
4+
<meta charset="utf-8">
5+
<title>CFP</title>
6+
<meta name="description" content="">
7+
<meta name="viewport" content="width=device-width">
8+
<!-- Place favicon.ico and apple-touch-icon.png in the root directory -->
9+
<!-- build:css(.) styles/vendor.css -->
10+
<!-- bower:css -->
11+
<link rel="stylesheet" href="bower_components/bootstrap/dist/css/bootstrap.css" />
12+
<link rel="stylesheet" href="bower_components/font-awesome/css/font-awesome.css" />
13+
<link rel="stylesheet" href="bower_components/bootstrap-fileinput/css/fileinput.min.css" />
14+
<!-- endbower -->
15+
<!-- endbuild -->
16+
<!-- build:css(.tmp) styles/main.css -->
17+
<link rel="stylesheet" href="styles/main.css">
18+
<!-- endbuild -->
19+
<!--<base href="/">-->
20+
</head>
21+
<body ng-app="autorAppPapers">
22+
<!--[if lt IE 7]>
23+
<p class="browsehappy">You are using an <strong>outdated</strong> browser. Please <a href="http://browsehappy.com/">upgrade your browser</a> to improve your experience.</p>
24+
<![endif]-->
25+
26+
<!-- Add your site or application content here -->
27+
<div class="header">
28+
<div class="navbar navbar-inverse" role="navigation">
29+
<div class="container">
30+
<div class="navbar-header">
31+
</div>
32+
</div>
33+
</div>
34+
</div>
35+
36+
<div class="container" style="padding-bottom: 65px;">
37+
<div ng-view=""></div>
38+
</div>
39+
40+
41+
<div class="navbar-default navbar-fixed-bottom">
42+
<div class="container">
43+
<p class="navbar-text">AGH</p>
44+
</div>
45+
</div>
46+
47+
48+
<!-- Google Analytics: change UA-XXXXX-X to be your site's ID -->
49+
<script>
50+
!function(A,n,g,u,l,a,r){A.GoogleAnalyticsObject=l,A[l]=A[l]||function(){
51+
(A[l].q=A[l].q||[]).push(arguments)},A[l].l=+new Date,a=n.createElement(g),
52+
r=n.getElementsByTagName(g)[0],a.src=u,r.parentNode.insertBefore(a,r)
53+
}(window,document,'script','//www.google-analytics.com/analytics.js','ga');
54+
55+
ga('create', 'UA-XXXXX-X');
56+
ga('send', 'pageview');
57+
</script>
58+
59+
<!-- build:js(.) scripts/vendor.js -->
60+
<!-- bower:js -->
61+
<script src="bower_components/jquery/dist/jquery.js"></script>
62+
<script src="bower_components/angular/angular.js"></script>
63+
<script src="bower_components/bootstrap/dist/js/bootstrap.js"></script>
64+
<script src="bower_components/angular-animate/angular-animate.js"></script>
65+
<script src="bower_components/angular-cookies/angular-cookies.js"></script>
66+
<script src="bower_components/angular-resource/angular-resource.js"></script>
67+
<script src="bower_components/angular-route/angular-route.js"></script>
68+
<script src="bower_components/angular-sanitize/angular-sanitize.js"></script>
69+
<script src="bower_components/angular-touch/angular-touch.js"></script>
70+
<script src="bower_components/lodash/lodash.js"></script>
71+
<script src="bower_components/restangular/dist/restangular.js"></script>
72+
<script src="bower_components/angular-fontawesome/dist/angular-fontawesome.js"></script>
73+
<script src="bower_components/angular-base64-upload/src/angular-base64-upload.js"></script>
74+
<script src="bower_components/bootstrap-fileinput/js/fileinput.min.js"></script>
75+
<script src="bower_components/angular-modal-service/dst/angular-modal-service.js"></script>
76+
<!-- endbower -->
77+
<!-- endbuild -->
78+
79+
<!-- build:js({.tmp,app}) scripts/scripts.js -->
80+
<script src="scripts/appPapers.js"></script>
81+
<script src="scripts/controllers/papers/new-paper.js"></script>
82+
<script src="scripts/controllers/papers/confirmation.js"></script>
83+
<!-- endbuild -->
84+
</body>
85+
</html>

‎src/main/webapp/index.html

+1-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
<!-- build:css(.tmp) styles/main.css -->
1717
<link rel="stylesheet" href="styles/main.css">
1818
<!-- endbuild -->
19+
<!--<base href="/">-->
1920
</head>
2021
<body ng-app="autorApp">
2122
<!--[if lt IE 7]>
@@ -93,8 +94,6 @@
9394
<!-- build:js({.tmp,app}) scripts/scripts.js -->
9495
<script src="scripts/app.js"></script>
9596
<script src="scripts/controllers/journals/new-journal.js"></script>
96-
<script src="scripts/controllers/papers/new-paper.js"></script>
97-
<script src="scripts/controllers/papers/confirmation.js"></script>
9897
<script src="scripts/controllers/journals/journals.js"></script>
9998
<script src="scripts/controllers/journals/journal-details.js"></script>
10099
<script src="scripts/controllers/modal/modalController.js"></script>

‎src/main/webapp/scripts/app.js

+2-10
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ angular
1313
'naif.base64',
1414
'angularModalService'
1515
])
16-
.config(function ($routeProvider, RestangularProvider) {
16+
.config(function ($routeProvider, RestangularProvider, $locationProvider) {
1717
$routeProvider
1818
.when('/', {
1919
redirectTo: '/journals'
@@ -30,16 +30,8 @@ angular
3030
templateUrl: 'views/journals/journal-details.html',
3131
controller: 'JournalDetailsController'
3232
})
33-
.when('/journals/:id/new_paper', {
34-
templateUrl: 'views/papers/new-paper.html',
35-
controller: 'NewPaperController'
36-
})
37-
.when('/confirmation/:id', {
38-
templateUrl: 'views/papers/confirmation.html',
39-
controller: 'ConfirmationController'
40-
})
4133
.otherwise({
42-
redirectTo: '/'
34+
redirectTo: '/journals'
4335
});
4436
RestangularProvider.setBaseUrl('/rest');
4537
});

‎src/main/webapp/scripts/appPapers.js

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
'use strict';
2+
3+
angular
4+
.module('autorAppPapers', [
5+
'ngAnimate',
6+
'ngCookies',
7+
'ngResource',
8+
'ngRoute',
9+
'ngSanitize',
10+
'restangular',
11+
'ngTouch',
12+
'picardy.fontawesome',
13+
'naif.base64',
14+
'angularModalService'
15+
])
16+
.config(function ($routeProvider, RestangularProvider, $locationProvider) {
17+
$routeProvider
18+
.when('/:id', {
19+
templateUrl: 'views/papers/new-paper.html',
20+
controller: 'NewPaperController'
21+
})
22+
.when('/confirmation/:id', {
23+
templateUrl: 'views/papers/confirmation.html',
24+
controller: 'ConfirmationController'
25+
})
26+
RestangularProvider.setBaseUrl('/rest');
27+
});

‎src/main/webapp/scripts/controllers/journals/journal-details.js

+9-3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ angular.module('autorApp')
77
function(ret){
88
$scope.journal = ret;
99
$scope.addingLink = getAddingLink();
10+
$scope.notSecuredAddingLink = getNotSecuredAddingLink();
1011
}, function error(reason){
1112
alert(reason.status)
1213
});
@@ -45,7 +46,12 @@ angular.module('autorApp')
4546
}
4647

4748
var getAddingLink = function(){
48-
return $location.protocol() + "://" + $location.host() + ":" + $location.port() + "/#/journals/" +
49-
$scope.journal.id + "/new_paper"
49+
return $location.protocol() + "://" + $location.host() + ":" + $location.port() + "/adding.html#/" +
50+
$scope.journal.id
5051
}
51-
});
52+
53+
var getNotSecuredAddingLink = function(){
54+
return "http://" + $location.host() + "/adding.html#/" +
55+
$scope.journal.id
56+
}
57+
});l

‎src/main/webapp/scripts/controllers/papers/confirmation.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
'use strict';
22

3-
angular.module('autorApp')
3+
angular.module('autorAppPapers')
44
.controller('ConfirmationController', function ($scope, $routeParams, Restangular) {
55

66
$scope.downloadPDF = function(){

‎src/main/webapp/scripts/controllers/papers/new-paper.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
'use strict';
22

3-
angular.module('autorApp')
3+
angular.module('autorAppPapers')
44
.controller('NewPaperController', function ($scope, $location, $routeParams, $http, Restangular) {
55

66
$scope.newPaper = {authors: [{}]};

‎src/main/webapp/views/journals/journal-details.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ <h2>{{journal.name}}</h2>
5050
<h4 class="modal-title">Link to add new paper</h4>
5151
</div>
5252
<div class="modal-body">
53-
<p>{{addingLink}}</p>
53+
<p>{{notSecuredAddingLink}}</p>
5454
</div>
5555
</div>
5656

‎src/main/webapp/views/papers/new-paper.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ <h4>{{journal.name}}</h4>
1717
<form novalidate name="newpaperForm" class="form-horizontal" ng-submit="addPaper()">
1818
<div class="form-group">
1919
<label>Paper title</label>
20-
<label ng-show="newpaperForm.$submitted || newpaperForm.paperName.$touched">
20+
<label ng-show="newpaperForm.$submitted">
2121
<fa name="exclamation-circle" ng-show="newpaperForm.paperName.$error.required" style="color: #a94442"
2222
data-toggle="tooltip" title="Required field">
2323
</fa>

0 commit comments

Comments
 (0)
Please sign in to comment.