Codiki/codiki-old
Archived
1
0
Fork 0
Code Issues 7 Pull Requests Releases Wiki Activity

Edition of security layer and its impacts.

Browse Source
This commit is contained in:
florian
2018-05-14 22:12:48 +02:00
parent 41c460932e
commit c62de5d6ed
7 changed files with 45 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/org/codiki/posts/PostController.java
+14 -4
View File
@@ -1,6 +1,7 @@
package org.codiki.posts;
import java.io.IOException;
import java.util.LinkedList;
import java.util.List;
import java.util.Optional;
import java.util.stream.Collectors;
@@ -11,6 +12,7 @@ import javax.servlet.http.HttpServletResponse;
import org.codiki.core.entities.dto.PostDTO;
import org.codiki.core.entities.persistence.Post;
import org.codiki.core.entities.persistence.User;
import org.codiki.core.repositories.PostRepository;
import org.codiki.core.security.TokenService;
import org.codiki.core.services.ParserService;
@@ -82,10 +84,18 @@ public class PostController {
}
@GetMapping("/myPosts")
public List<PostDTO> getMyPosts(final HttpServletRequest pRequest, final HttpServletResponse pResponse) {
return postRepository.getByCreator(tokenService
.getAuthenticatedUserByToken(pRequest).getId())
.parallelStream().map(PostDTO::new).collect(Collectors.toList());
public List<PostDTO> getMyPosts(final HttpServletRequest pRequest, final HttpServletResponse pResponse) throws IOException {
List<PostDTO> result = new LinkedList<>();
final Optional<User> connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
if(connectedUser.isPresent()) {
result = postRepository.getByCreator(connectedUser.get().getId())
.stream().map(PostDTO::new).collect(Collectors.toList());
} else {
pResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
}
return result;
}
@PostMapping("/preview")
src/main/java/org/codiki/posts/PostService.java
+6 -6
View File
@@ -33,15 +33,15 @@ public class PostService {
final HttpServletResponse pResponse) {
Optional<Post> result = Optional.empty();
final String userToken = pRequest.getHeader("token");
final Optional<User> user = tokenService.getAuthenticatedUserByToken(pRequest);
if(userToken.equals(pPost.getAuthor().getToken())) {
if(user.isPresent()) {
final Post postToSave = new Post(pPost);
postToSave.setAuthor(tokenService.getAuthenticatedUserByToken(pRequest));
postToSave.setAuthor(user.get());
postRepository.save(postToSave);
result = Optional.of(postToSave);
} else {
pResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
pResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
}
return result;
@@ -49,9 +49,9 @@ public class PostService {
public void update(final PostDTO pPost, final HttpServletRequest pRequest,
final HttpServletResponse pResponse) throws IOException {
final User connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
final Optional<User> connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
if(connectedUser != null && connectedUser.getKey().equals(pPost.getAuthor().getKey())) {
if(connectedUser.isPresent() && connectedUser.get().getKey().equals(pPost.getAuthor().getKey())) {
final Optional<Post> postOpt = postRepository.getByKey(pPost.getKey());
if(postOpt.isPresent()) {