shopizer-developers

Security issues

11/15/2016 6:31:39 PM

Details

diff --git a/shopizer-canadapost/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-canadapost-module/pom.properties b/shopizer-canadapost/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-canadapost-module/pom.properties
index 8db2e08..3134119 100644
--- a/shopizer-canadapost/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-canadapost-module/pom.properties
+++ b/shopizer-canadapost/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-canadapost-module/pom.properties
@@ -1,5 +1,5 @@
 #Generated by Maven Integration for Eclipse
-#Mon Nov 14 10:53:54 EST 2016
+#Tue Nov 15 09:14:26 EST 2016
 version=2.5.0-SNAPSHOT
 groupId=com.shopizer
 m2e.projectName=shopizer-canadapost
diff --git a/shopizer-shipping-distance-module/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-distance-processor/pom.properties b/shopizer-shipping-distance-module/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-distance-processor/pom.properties
index cc84cfe..89abda5 100644
--- a/shopizer-shipping-distance-module/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-distance-processor/pom.properties
+++ b/shopizer-shipping-distance-module/target/classes/META-INF/maven/com.shopizer/shopizer-shipping-distance-processor/pom.properties
@@ -1,5 +1,5 @@
 #Generated by Maven Integration for Eclipse
-#Mon Nov 14 10:53:54 EST 2016
+#Tue Nov 15 13:08:48 EST 2016
 version=2.5.0-SNAPSHOT
 groupId=com.shopizer
 m2e.projectName=shopizer-shipping-distance-processor
diff --git a/sm-core/.classpath b/sm-core/.classpath
index b130f32..fc5f96c 100644
--- a/sm-core/.classpath
+++ b/sm-core/.classpath
@@ -27,7 +27,7 @@
 			<attribute name="maven.pomderived" value="true"/>
 		</attributes>
 	</classpathentry>
-	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER">
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8">
 		<attributes>
 			<attribute name="maven.pomderived" value="true"/>
 		</attributes>
diff --git a/sm-core/src/main/java/com/salesmanager/core/business/repositories/user/UserRepository.java b/sm-core/src/main/java/com/salesmanager/core/business/repositories/user/UserRepository.java
index a77201b..e7ac971 100644
--- a/sm-core/src/main/java/com/salesmanager/core/business/repositories/user/UserRepository.java
+++ b/sm-core/src/main/java/com/salesmanager/core/business/repositories/user/UserRepository.java
@@ -9,15 +9,15 @@ import com.salesmanager.core.model.user.User;
 
 public interface UserRepository extends JpaRepository<User, Long> {
 
-	@Query("select u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um inner join fetch u.defaultLanguage ul where u.adminName = ?1")
+	@Query("select u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um left join fetch u.defaultLanguage ul where u.adminName = ?1")
 	User findByUserName(String userName);
 	
-	@Query("select u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um inner join fetch u.defaultLanguage ul where u.id = ?1")
+	@Query("select u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um left join fetch u.defaultLanguage ul where u.id = ?1")
 	User findById(Long id);
 	
-	@Query("select u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um inner join fetch u.defaultLanguage ul order by u.id")
+	@Query("select u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um left join fetch u.defaultLanguage ul order by u.id")
 	List<User> findAll();
 	
-	@Query("select distinct u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um inner join fetch u.defaultLanguage ul where um.id = ?1 order by u.id")
+	@Query("select distinct u from User as u inner join fetch u.groups ug inner join fetch u.merchantStore um left join fetch u.defaultLanguage ul where um.id = ?1 order by u.id")
 	List<User> findByStore(Integer storeId);
 }
diff --git a/sm-search/target/classes/META-INF/maven/com.shopizer/sm-search/pom.properties b/sm-search/target/classes/META-INF/maven/com.shopizer/sm-search/pom.properties
index 91747a8..ff789a2 100644
--- a/sm-search/target/classes/META-INF/maven/com.shopizer/sm-search/pom.properties
+++ b/sm-search/target/classes/META-INF/maven/com.shopizer/sm-search/pom.properties
@@ -1,5 +1,5 @@
 #Generated by Maven Integration for Eclipse
-#Mon Nov 14 10:53:55 EST 2016
+#Tue Nov 15 13:08:49 EST 2016
 version=2.5.0-SNAPSHOT
 groupId=com.shopizer
 m2e.projectName=sm-search
diff --git a/sm-shop/.classpath b/sm-shop/.classpath
index fc5f96c..b130f32 100644
--- a/sm-shop/.classpath
+++ b/sm-shop/.classpath
@@ -27,7 +27,7 @@
 			<attribute name="maven.pomderived" value="true"/>
 		</attributes>
 	</classpathentry>
-	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8">
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER">
 		<attributes>
 			<attribute name="maven.pomderived" value="true"/>
 		</attributes>
diff --git a/sm-shop/files/store/StoreRepository.dat b/sm-shop/files/store/StoreRepository.dat
index 3404c64..c0bc7da 100644
Binary files a/sm-shop/files/store/StoreRepository.dat and b/sm-shop/files/store/StoreRepository.dat differ
diff --git a/sm-shop/SALESMANAGER.h2.db b/sm-shop/SALESMANAGER.h2.db
new file mode 100644
index 0000000..ca04170
Binary files /dev/null and b/sm-shop/SALESMANAGER.h2.db differ
diff --git a/sm-shop/SALESMANAGER.lock.db b/sm-shop/SALESMANAGER.lock.db
new file mode 100644
index 0000000..3db2d06
--- /dev/null
+++ b/sm-shop/SALESMANAGER.lock.db
@@ -0,0 +1,4 @@
+#FileLock
+#Tue Nov 15 13:29:13 EST 2016
+id=158693ffec276464d8386afa624f465a867ccf25f21
+method=file
diff --git a/sm-shop/src/main/java/com/salesmanager/shop/admin/controller/AdminController.java b/sm-shop/src/main/java/com/salesmanager/shop/admin/controller/AdminController.java
index 3481ca8..5dc93d8 100644
--- a/sm-shop/src/main/java/com/salesmanager/shop/admin/controller/AdminController.java
+++ b/sm-shop/src/main/java/com/salesmanager/shop/admin/controller/AdminController.java
@@ -7,6 +7,7 @@ import javax.inject.Inject;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -33,6 +34,7 @@ public class AdminController {
 	@Inject
 	UserService userService;
 	
+	@PreAuthorize("hasRole('AUTH')")
 	@RequestMapping(value={"/admin/home.html","/admin/","/admin"}, method=RequestMethod.GET)
 	public String displayDashboard(Model model, HttpServletRequest request, HttpServletResponse response) throws Exception {
 		Language language = (Language)request.getAttribute("LANGUAGE");
diff --git a/sm-shop/src/main/java/com/salesmanager/shop/admin/security/UserAuthenticationSuccessHandler.java b/sm-shop/src/main/java/com/salesmanager/shop/admin/security/UserAuthenticationSuccessHandler.java
index 6ebcac9..180d995 100644
--- a/sm-shop/src/main/java/com/salesmanager/shop/admin/security/UserAuthenticationSuccessHandler.java
+++ b/sm-shop/src/main/java/com/salesmanager/shop/admin/security/UserAuthenticationSuccessHandler.java
@@ -5,11 +5,17 @@ import com.salesmanager.core.model.user.User;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.DefaultRedirectStrategy;
+import org.springframework.security.web.RedirectStrategy;
 import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
 
 import javax.inject.Inject;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
 import java.util.Date;
 
 public class UserAuthenticationSuccessHandler extends
@@ -17,14 +23,25 @@ public class UserAuthenticationSuccessHandler extends
 	
 	private static final Logger LOGGER = LoggerFactory.getLogger(UserAuthenticationSuccessHandler.class);
 	
+	private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
+	
 	@Inject
 	private UserService userService;
 	
-	  @Override
+	    @Override
 	    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
 		  // last access timestamp
 		  String userName = authentication.getName();
 		  
+		  /**
+		   * Spring Security 4 does not seem to add security context in the session
+		   * creating the authentication to be lost during the login
+		   */
+		  SecurityContext securityContext = SecurityContextHolder.getContext();
+		  Authentication auth = securityContext.getAuthentication();
+		  HttpSession session = request.getSession(true);
+		  session.setAttribute("SPRING_SECURITY_CONTEXT", securityContext);
+		  
 		  try {
 			  User user = userService.getByUserName(userName);
 			  
@@ -37,10 +54,23 @@ public class UserAuthenticationSuccessHandler extends
 			  
 			  userService.saveOrUpdate(user);
 			  
-			  response.sendRedirect(request.getContextPath() + "/admin/home.html");
+			  //response.sendRedirect(request.getContextPath() + "/admin/home.html");
+			  redirectStrategy.sendRedirect(request, response, request.getContextPath() + "/admin/home.html");
+			  
+		  
+		  
 		  } catch (Exception e) {
 			  LOGGER.error("User authenticationSuccess",e);
 		  }
+		  
+
 	   }
+	    
+	    public void setRedirectStrategy(RedirectStrategy redirectStrategy) {
+	        this.redirectStrategy = redirectStrategy;
+	    }
+	    protected RedirectStrategy getRedirectStrategy() {
+	        return redirectStrategy;
+	    }
 
 }
diff --git a/sm-shop/src/main/resources/application.properties b/sm-shop/src/main/resources/application.properties
index 202407c..b86329f 100644
--- a/sm-shop/src/main/resources/application.properties
+++ b/sm-shop/src/main/resources/application.properties
@@ -2,5 +2,5 @@ logging.level.org.springframework.web: DEBUG
 logging.level.org.springframework.security: DEBUG
 
 #remove spring fav icon
-spring.mvc.favicon.enabled=false
+#spring.mvc.favicon.enabled=false
 
diff --git a/sm-shop/src/main/resources/spring/shopizer-security.xml b/sm-shop/src/main/resources/spring/shopizer-security.xml
index 4216528..9bf53d2 100644
--- a/sm-shop/src/main/resources/spring/shopizer-security.xml
+++ b/sm-shop/src/main/resources/spring/shopizer-security.xml
@@ -47,14 +47,15 @@
 	
 	
 	<http pattern="/admin/**" auto-config="true" use-expressions="true" authentication-manager-ref="adminAuthenticationManager">
-		<!-- Spring security login component -->
-		<intercept-url pattern="/admin/login" access="permitAll" />
 		<!-- Shopizer logon page -->
 		<intercept-url pattern="/admin/logon*" access="permitAll" />
 		<intercept-url pattern="/admin/denied.html" access="permitAll" />
 		<intercept-url pattern="/admin/unauthorized.html" access="permitAll" />
 		<intercept-url pattern="/admin/users/resetPassword.html*" access="permitAll" />
 		<intercept-url pattern="/admin/users/resetPasswordSecurityQtn.html*" access="permitAll" /> 
+ 		
+ 		
+ 		
  		<intercept-url pattern="/admin" access="hasRole('AUTH')" />
 		<intercept-url pattern="/admin/" access="hasRole('AUTH')" />
 		<intercept-url pattern="/admin/*.html*" access="hasRole('AUTH')" />
@@ -73,6 +74,7 @@
 					username-parameter="username" 
 					password-parameter="password" 
 					login-processing-url="/login" 
+					authentication-success-handler-ref="userAuthenticationSuccessHandler"
 					authentication-failure-url="/admin/logon.html?login_error=true" 
 		/>
 			
@@ -123,16 +125,14 @@
 	
 	<authentication-manager id="adminAuthenticationManager">
 		<authentication-provider user-service-ref="userDetailsService">
-			<password-encoder hash="sha" />
+			<password-encoder ref="passwordEncoder" hash="sha"/>
 		</authentication-provider>
-		
 	</authentication-manager>
 	
 	<authentication-manager id="customerAuthenticationManager">
 		<authentication-provider user-service-ref="customerDetailsService">
-			<password-encoder hash="sha" />
+			<password-encoder ref="passwordEncoder" hash="sha"/>
 		</authentication-provider>
-		
 	</authentication-manager>
 
 
diff --git a/sm-shop/src/main/resources/static/favicon.ico b/sm-shop/src/main/resources/static/favicon.ico
new file mode 100644
index 0000000..c9a6e7d
Binary files /dev/null and b/sm-shop/src/main/resources/static/favicon.ico differ
diff --git a/sm-shop/target/m2e-wtp/web-resources/META-INF/maven/com.shopizer/sm-shop/pom.properties b/sm-shop/target/m2e-wtp/web-resources/META-INF/maven/com.shopizer/sm-shop/pom.properties
index 3b4c35e..fc0fa72 100644
--- a/sm-shop/target/m2e-wtp/web-resources/META-INF/maven/com.shopizer/sm-shop/pom.properties
+++ b/sm-shop/target/m2e-wtp/web-resources/META-INF/maven/com.shopizer/sm-shop/pom.properties
@@ -1,5 +1,5 @@
 #Generated by Maven Integration for Eclipse
-#Mon Nov 14 13:10:10 EST 2016
+#Tue Nov 15 13:08:51 EST 2016
 version=2.5.0-SNAPSHOT
 groupId=com.shopizer
 m2e.projectName=sm-shop