Codiki/codiki-old
Archived
1
0
Fork 0
Code Issues 7 Pull Requests Releases Wiki Activity

Edition of security layer and its impacts.

Browse Source
This commit is contained in:
florian
2018-05-14 22:12:48 +02:00
parent 41c460932e
commit c62de5d6ed
7 changed files with 45 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/org/codiki/posts/PostService.java
+6 -6
View File
@@ -33,15 +33,15 @@ public class PostService {
final HttpServletResponse pResponse) {
Optional<Post> result = Optional.empty();
final String userToken = pRequest.getHeader("token");
final Optional<User> user = tokenService.getAuthenticatedUserByToken(pRequest);
if(userToken.equals(pPost.getAuthor().getToken())) {
if(user.isPresent()) {
final Post postToSave = new Post(pPost);
postToSave.setAuthor(tokenService.getAuthenticatedUserByToken(pRequest));
postToSave.setAuthor(user.get());
postRepository.save(postToSave);
result = Optional.of(postToSave);
} else {
pResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
pResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
}
return result;
@@ -49,9 +49,9 @@ public class PostService {
public void update(final PostDTO pPost, final HttpServletRequest pRequest,
final HttpServletResponse pResponse) throws IOException {
final User connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
final Optional<User> connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
if(connectedUser != null && connectedUser.getKey().equals(pPost.getAuthor().getKey())) {
if(connectedUser.isPresent() && connectedUser.get().getKey().equals(pPost.getAuthor().getKey())) {
final Optional<Post> postOpt = postRepository.getByKey(pPost.getKey());
if(postOpt.isPresent()) {