Merge "Fix sql injection vulnerability"
[portal.git] / ecomp-portal-BE-common / src / main / java / org / onap / portalapp / portal / controller / UserController.java
1 /*-
2  * ============LICENSE_START==========================================
3  * ONAP Portal
4  * ===================================================================
5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6  * ===================================================================
7  *
8  * Unless otherwise specified, all software contained herein is licensed
9  * under the Apache License, Version 2.0 (the "License");
10  * you may not use this software except in compliance with the License.
11  * You may obtain a copy of the License at
12  *
13  *             http://www.apache.org/licenses/LICENSE-2.0
14  *
15  * Unless required by applicable law or agreed to in writing, software
16  * distributed under the License is distributed on an "AS IS" BASIS,
17  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18  * See the License for the specific language governing permissions and
19  * limitations under the License.
20  *
21  * Unless otherwise specified, all documentation contained herein is licensed
22  * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
23  * you may not use this documentation except in compliance with the License.
24  * You may obtain a copy of the License at
25  *
26  *             https://creativecommons.org/licenses/by/4.0/
27  *
28  * Unless required by applicable law or agreed to in writing, documentation
29  * distributed under the License is distributed on an "AS IS" BASIS,
30  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
31  * See the License for the specific language governing permissions and
32  * limitations under the License.
33  *
34  * ============LICENSE_END============================================
35  *
36  * 
37  */
38 package org.onap.portalapp.portal.controller;
39
40 import javax.servlet.http.HttpServletRequest;
41
42 import org.onap.portalapp.controller.EPRestrictedBaseController;
43 import org.onap.portalapp.portal.domain.EPUser;
44 import org.onap.portalapp.portal.ecomp.model.PortalRestResponse;
45 import org.onap.portalapp.portal.ecomp.model.PortalRestStatusEnum;
46 import org.onap.portalapp.portal.logging.aop.EPAuditLog;
47 import org.onap.portalapp.portal.service.UserService;
48 import org.onap.portalapp.portal.transport.ProfileDetail;
49 import org.onap.portalapp.portal.utils.EcompPortalUtils;
50 import org.onap.portalapp.util.EPUserUtils;
51 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
52 import org.onap.portalsdk.core.onboarding.util.CipherUtil;
53 import org.onap.portalsdk.core.util.SystemProperties;
54 import org.springframework.beans.factory.annotation.Autowired;
55 import org.springframework.context.annotation.EnableAspectJAutoProxy;
56 import org.springframework.web.bind.annotation.RequestBody;
57 import org.springframework.web.bind.annotation.RequestMapping;
58 import org.springframework.web.bind.annotation.RequestMethod;
59 import org.springframework.web.bind.annotation.RestController;
60
61 @RestController
62 @org.springframework.context.annotation.Configuration
63 @EnableAspectJAutoProxy
64 @EPAuditLog
65 public class UserController extends EPRestrictedBaseController {
66
67         private EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(UserController.class);
68
69         @Autowired
70         private UserService userService;
71
72         private static final String HIDDEN_DEFAULT_PASSWORD = "*****";
73
74         /**
75          * RESTful service method to get ONAP Logged in User details.
76          * 
77          * @param request
78          *            HttpServletRequest
79          * 
80          * @return PortalRestResponse of EPUser
81          */
82         @RequestMapping(value = { "/portalApi/loggedinUser" }, method = RequestMethod.GET, produces = "application/json")
83         public PortalRestResponse<ProfileDetail> getLoggedinUser(HttpServletRequest request) {
84                 PortalRestResponse<ProfileDetail> portalRestResponse = null;
85                 try {
86                         EPUser user = EPUserUtils.getUserSession(request);
87                         ProfileDetail profileDetail = new ProfileDetail(user.getFirstName(), user.getLastName(),
88                                         user.getMiddleInitial(), user.getEmail(), user.getLoginId(),  HIDDEN_DEFAULT_PASSWORD);
89                         portalRestResponse = new PortalRestResponse<ProfileDetail>(PortalRestStatusEnum.OK, "success",
90                                         profileDetail);
91                         EcompPortalUtils.logAndSerializeObject(logger, "/portalApi/loggedinUser", "result =", profileDetail);
92                 } catch (Exception e) {
93                         portalRestResponse = new PortalRestResponse<ProfileDetail>(PortalRestStatusEnum.ERROR, e.getMessage(),
94                                         null);
95                         logger.error(EELFLoggerDelegate.errorLogger, "getLoggedinUser failed", e);
96                 }
97                 return portalRestResponse;
98         }
99
100         /**
101          * RESTful service method to update ONAP Logged in User in DB.
102          * 
103          * @param request
104          *            HttpServletRequest
105          * @param profileDetail
106          *            Body with user information
107          * @return PortalRestResponse of String
108          */
109         @RequestMapping(value = {
110                         "/portalApi/modifyLoggedinUser" }, method = RequestMethod.PUT, produces = "application/json")
111         public PortalRestResponse<String> modifyLoggedinUser(HttpServletRequest request,
112                         @RequestBody ProfileDetail profileDetail) {
113                 PortalRestResponse<String> portalRestResponse = null;
114                 try {
115                         String errorMsg = "";
116                         if (profileDetail.getFirstName().equals("") || profileDetail.getLastName().equals("")
117                                         || profileDetail.getEmail().equals("") || profileDetail.getLoginId().equals("")
118                                         || profileDetail.getLoginPassword().equals("")) {
119                                 errorMsg = "Required field(s) is missing";
120                                 portalRestResponse = new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, errorMsg, null);
121                                 logger.error(EELFLoggerDelegate.errorLogger, "modifyLoggedinUser failed", errorMsg);
122                         } else {
123                                 EPUser user = EPUserUtils.getUserSession(request);
124                                 user.setFirstName(profileDetail.getFirstName());
125                                 user.setLastName(profileDetail.getLastName());
126                                 user.setEmail(profileDetail.getEmail());
127                                 user.setMiddleInitial(profileDetail.getMiddleName());
128                                 user.setLoginId(profileDetail.getLoginId());
129                                 if (!HIDDEN_DEFAULT_PASSWORD.equals(profileDetail.getLoginPassword())){
130                                         user.setLoginPwd(CipherUtil.encryptPKC(profileDetail.getLoginPassword()));
131                                 }
132                                 userService.saveUser(user);
133                                 // Update user info in the session
134                                 request.getSession().setAttribute(SystemProperties.getProperty(SystemProperties.USER_ATTRIBUTE_NAME),
135                                                 user);
136                                 portalRestResponse = new PortalRestResponse<String>(PortalRestStatusEnum.OK, "success", null);
137                                 EcompPortalUtils.logAndSerializeObject(logger, "/portalApi/modifyLoggedinUser", "result =", user);
138                         }
139                 } catch (Exception e) {
140                         portalRestResponse = new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, e.toString(), null);
141                         logger.error(EELFLoggerDelegate.errorLogger, "modifyLoggedinUser failed", e);
142                 }
143                 return portalRestResponse;
144         }
145 }