Fix sql injection vulnerability
[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / portal / controller / UserController.java
1 /*-
2  * ============LICENSE_START==========================================
3  * ONAP Portal
4  * ===================================================================
5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6  * ===================================================================
7  *
8  * Unless otherwise specified, all software contained herein is licensed
9  * under the Apache License, Version 2.0 (the "License");
10  * you may not use this software except in compliance with the License.
11  * You may obtain a copy of the License at
12  *
13  *             http://www.apache.org/licenses/LICENSE-2.0
14  *
15  * Unless required by applicable law or agreed to in writing, software
16  * distributed under the License is distributed on an "AS IS" BASIS,
17  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18  * See the License for the specific language governing permissions and
19  * limitations under the License.
20  *
21  * Unless otherwise specified, all documentation contained herein is licensed
22  * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
23  * you may not use this documentation except in compliance with the License.
24  * You may obtain a copy of the License at
25  *
26  *             https://creativecommons.org/licenses/by/4.0/
27  *
28  * Unless required by applicable law or agreed to in writing, documentation
29  * distributed under the License is distributed on an "AS IS" BASIS,
30  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
31  * See the License for the specific language governing permissions and
32  * limitations under the License.
33  *
34  * ============LICENSE_END============================================
35  *
36  * 
37  */
38 package org.onap.portalapp.portal.controller;
39
40 import javax.servlet.http.HttpServletRequest;
41
42 import org.onap.portalapp.controller.EPRestrictedBaseController;
43 import org.onap.portalapp.portal.domain.EPUser;
44 import org.onap.portalapp.portal.ecomp.model.PortalRestResponse;
45 import org.onap.portalapp.portal.ecomp.model.PortalRestStatusEnum;
46 import org.onap.portalapp.portal.logging.aop.EPAuditLog;
47 import org.onap.portalapp.portal.service.UserService;
48 import org.onap.portalapp.portal.transport.ProfileDetail;
49 import org.onap.portalapp.portal.utils.EcompPortalUtils;
50 import org.onap.portalapp.util.EPUserUtils;
51 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
52 import org.onap.portalsdk.core.onboarding.util.CipherUtil;
53 import org.onap.portalsdk.core.util.SystemProperties;
54 import org.springframework.beans.factory.annotation.Autowired;
55 import org.springframework.context.annotation.EnableAspectJAutoProxy;
56 import org.springframework.web.bind.annotation.RequestBody;
57 import org.springframework.web.bind.annotation.RequestMapping;
58 import org.springframework.web.bind.annotation.RequestMethod;
59 import org.springframework.web.bind.annotation.RestController;
60
61 @RestController
62 @org.springframework.context.annotation.Configuration
63 @EnableAspectJAutoProxy
64 @EPAuditLog
65 public class UserController extends EPRestrictedBaseController {
66
67         private EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(UserController.class);
68
69         @Autowired
70         private UserService userService;
71
72         /**
73          * RESTful service method to get ONAP Logged in User details.
74          * 
75          * @param request
76          *            HttpServletRequest
77          * 
78          * @return PortalRestResponse of EPUser
79          */
80         @RequestMapping(value = { "/portalApi/loggedinUser" }, method = RequestMethod.GET, produces = "application/json")
81         public PortalRestResponse<ProfileDetail> getLoggedinUser(HttpServletRequest request) {
82                 PortalRestResponse<ProfileDetail> portalRestResponse = null;
83                 try {
84                         EPUser user = EPUserUtils.getUserSession(request);
85                         ProfileDetail profileDetail = new ProfileDetail(user.getFirstName(), user.getLastName(),
86                                         user.getMiddleInitial(), user.getEmail(), user.getLoginId(),  CipherUtil.decryptPKC(user.getLoginPwd()));
87                         portalRestResponse = new PortalRestResponse<ProfileDetail>(PortalRestStatusEnum.OK, "success",
88                                         profileDetail);
89                         EcompPortalUtils.logAndSerializeObject(logger, "/portalApi/loggedinUser", "result =", profileDetail);
90                 } catch (Exception e) {
91                         portalRestResponse = new PortalRestResponse<ProfileDetail>(PortalRestStatusEnum.ERROR, e.getMessage(),
92                                         null);
93                         logger.error(EELFLoggerDelegate.errorLogger, "getLoggedinUser failed", e);
94                 }
95                 return portalRestResponse;
96         }
97
98         /**
99          * RESTful service method to update ONAP Logged in User in DB.
100          * 
101          * @param request
102          *            HttpServletRequest
103          * @param profileDetail
104          *            Body with user information
105          * @return PortalRestResponse of String
106          */
107         @RequestMapping(value = {
108                         "/portalApi/modifyLoggedinUser" }, method = RequestMethod.PUT, produces = "application/json")
109         public PortalRestResponse<String> modifyLoggedinUser(HttpServletRequest request,
110                         @RequestBody ProfileDetail profileDetail) {
111                 PortalRestResponse<String> portalRestResponse = null;
112                 try {
113                         String errorMsg = "";
114                         if (profileDetail.getFirstName().equals("") || profileDetail.getLastName().equals("")
115                                         || profileDetail.getEmail().equals("") || profileDetail.getLoginId().equals("")
116                                         || profileDetail.getLoginPassword().equals("")) {
117                                 errorMsg = "Required field(s) is missing";
118                                 portalRestResponse = new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, errorMsg, null);
119                                 logger.error(EELFLoggerDelegate.errorLogger, "modifyLoggedinUser failed", errorMsg);
120                         } else {
121                                 EPUser user = EPUserUtils.getUserSession(request);
122                                 user.setFirstName(profileDetail.getFirstName());
123                                 user.setLastName(profileDetail.getLastName());
124                                 user.setEmail(profileDetail.getEmail());
125                                 user.setMiddleInitial(profileDetail.getMiddleName());
126                                 user.setLoginId(profileDetail.getLoginId());
127                                 user.setLoginPwd(CipherUtil.encryptPKC(profileDetail.getLoginPassword()));
128                                 userService.saveUser(user);
129                                 // Update user info in the session
130                                 request.getSession().setAttribute(SystemProperties.getProperty(SystemProperties.USER_ATTRIBUTE_NAME),
131                                                 user);
132                                 portalRestResponse = new PortalRestResponse<String>(PortalRestStatusEnum.OK, "success", null);
133                                 EcompPortalUtils.logAndSerializeObject(logger, "/portalApi/modifyLoggedinUser", "result =", user);
134                         }
135                 } catch (Exception e) {
136                         portalRestResponse = new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, e.toString(), null);
137                         logger.error(EELFLoggerDelegate.errorLogger, "modifyLoggedinUser failed", e);
138                 }
139                 return portalRestResponse;
140         }
141 }