Re: Session integrity issue?

package org.nkpap.visualizer;

import java.io.BufferedOutputStream;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.PrintStream;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.Date;
import java.util.Enumeration;
import java.util.Hashtable;
import java.util.LinkedList;
import java.util.List;
import java.util.logging.FileHandler;
import java.util.logging.Logger;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.netoperis.db.core.Authors;
import org.netoperis.db.core.Interests;
import org.netoperis.db.core.Reviews;
import org.netoperis.db.core.Submissions;
import org.netoperis.db.core.TopicList;
import org.netoperis.db.core.Topics;
import org.netoperis.db.core.Users;
import org.netoperis.db.core.Votes;
import org.netoperis.db.mgr.AuthorsManager;
import org.netoperis.db.mgr.InterestsManager;
import org.netoperis.db.mgr.ReviewsManager;
import org.netoperis.db.mgr.SubmissionsManager;
import org.netoperis.db.mgr.TopicListManager;
import org.netoperis.db.mgr.TopicsManager;
import org.netoperis.db.mgr.UsersManager;
import org.netoperis.db.mgr.VotesManager;
import org.nkpap.util.EmailBuffer;
import org.nkpap.util.MyConnectionManager;
import org.nkpap.util.RandomPasswordGenerator;
import org.webmacro.PropertyException;
import org.webmacro.ResourceException;
import org.webmacro.Template;
import org.webmacro.servlet.HandlerException;
import org.webmacro.servlet.WMServlet;
import org.webmacro.servlet.WebContext;
import org.webmacro.util.Settings;

import com.oreilly.servlet.MultipartRequest;

/**
 * @author nkpap in Greece 2 Ïêô 2005
 * 
 * (c) 2005 - 2006
 * 
 */
public class Login extends WMServlet {
	public static Settings configProperties = null;
	Logger logger;

	protected void start() throws ServletException {
		try {
			configProperties = new Settings();
			System.out.println(" READING CONFIGURATION FILE: ms2.properties");

			configProperties.load("ms2.properties");
			System.out
					.println("  CONFIGURATION FILE: ms2.properties LOADED SUCCESSFULLY ");
			FileHandler handler = new FileHandler(configProperties
					.getSetting("LogsPath")
					+ "my_log.txt", true);
			logger = Logger.getLogger("org.nkpap.visualizer.LoginUsers");
			logger.addHandler(handler);
		} catch (Exception ex) {
			System.out
					.println("ERROR READING CONFIGURATION FILE: ms2.properties");
			System.out.println(ex);
		}
	}

	private Template returnMyTemplate(String template, WebContext context) {
		try {
			context.put("fragment", template);
			return getTemplate("users/index.htm");
		} catch (ResourceException e) {
			System.out
					.println("Oooops!!!  a problem occured with the error template!");
			e.printStackTrace();
			return null;
		}
	}

	public Template handle(WebContext context) throws HandlerException {
		HttpServletRequest request = context.getRequest();
		HttpSession session = request.getSession();
		context.getResponse().setContentType("text/html; charset=iso-8859-7");

		String userID = (String) session.getAttribute("USERID");

		if (isActionEqualTo("login", context)) {
			// use has entered credentials
			String login = request.getParameter("login");
			String password = request.getParameter("password");

			if (validateUser(login, password, context)) {
				if (session.getAttribute("FIRSTIME") != null)
					return showReviewer(
							(String) session.getAttribute("USERID"), context);
				return returnMyTemplate("users/choices.htm", context);
			}// user doesnt validate
			session.invalidate();
			context.put("fail", "Access denied !!");
			return returnMyTemplate("users/login.htm", context);
		}
		// -----------------------ACTIONS---BEGIN----HERE-------------
		// ACTIONS that do not require user to be logged-in
		if (isActionEqualTo("register", context)) {
			return returnMyTemplate("users/aut_registration.htm", context);
		}
		if (isActionEqualTo("back", context)) {
			return returnMyTemplate("users/login.htm", context);
		}
		if (isActionEqualTo("remind", context)) {
			return returnMyTemplate("users/remind_passwd.htm", context);
		}
		// end of ACTIONS that do not require user to be logged-in

		if (isActionEqualTo("logout", context)) {
			session.invalidate();
			logger.info("User " + userID + " logged out");
			return returnMyTemplate("users/login.htm", context);
		}		
		// --------------------ACTIONS----END-----HERE---------
		// the default page to be shown...

		if (request.getParameter("action") == null && userID != null) {
			if (session.getAttribute("FIRSTIME") != null)
				return showReviewer((String) session.getAttribute("USERID"),
						context);
			return returnMyTemplate("users/choices.htm", context);
		} else {
			return returnMyTemplate("users/login.htm", context);
		}
	}

	private Template handleError(Exception e, Connection connection,
			WebContext context) {
		logger.severe("An error occurred:\n" + e.toString());
		if (connection != null) {
			try {
				connection.close();
			} catch (SQLException e1) {
				e1.printStackTrace();
			}
		}
		e.printStackTrace();
		context.put("msg", "An error occurred:\n" + e.toString());
		return returnMyTemplate("users/errore.htm", context);
	}

	private Template showReviewer(String userId, WebContext context) {
		MyConnectionManager ConnectionManager = new MyConnectionManager();
		Connection connection = null;
		logger.info("starting method: showReviewer");
		try {
			int usId = Integer.parseInt(userId);
			connection = ConnectionManager.getConnection();

			Users user = UsersManager.getManager().loadByKey(usId, connection);
			Topics[] topics = TopicsManager.getManager().loadAll(connection);

			connection.close();
			context.put("user", user);
			// context.put("interests", interests);
			context.put("topics", topics);
		} catch (SQLException e) {
			return handleError(e, connection, context);
		}

		logger.info("ended method: showReviewer");
		return returnMyTemplate("users/rev_registration.htm", context);
	}

	private boolean isActionEqualTo(String actionName, WebContext context) {
		HttpServletRequest request = context.getRequest();
		if (request.getParameter("action") != null
				&& request.getParameter("action").equalsIgnoreCase(actionName))
			return true;
		return false;
	}

	private Template showJobs(WebContext context) {
		Connection connection = null;
		MyConnectionManager ConnectionManager = new MyConnectionManager();
		HttpServletRequest request = context.getRequest();
		HttpSession session = request.getSession();
		String userId = (String) session.getAttribute("USERID");
		logger.info("starting method: showJobs by user: " + userId);

		try {
			connection = ConnectionManager.getConnection();
			Reviews[] reviews = ReviewsManager.getManager().loadByWhere(
					"where USE_ID=\'" + userId + "\'", connection);
			// System.out.println("Papers : " + submissions.length);

			for (int i = 0; i < reviews.length; i++) {

				Submissions subm = SubmissionsManager.getManager().loadByKey(
						reviews[i].getSubId(), connection);

				reviews[i].setForeignTitle(subm.getSubPaperTitle());
				reviews[i].setForeignStatus(subm.getSubStatus());
			}
			connection.close();
			context.put("jobs", reviews);
			logger.info("ended method: showJobs by user: " + userId);
			return returnMyTemplate("users/rev_home.htm", context);
		} catch (SQLException e) {
			return handleError(e, connection, context);
		}
	}

	private boolean validateUser(String login, String password,
			WebContext context) {
		MyConnectionManager ConnectionManager = new MyConnectionManager();
		HttpServletRequest request = context.getRequest();
		HttpSession session = request.getSession();
		Connection connection = null;
		logger.info("starting method: validateUser login: " + login
				+ " passwd: " + password);
		boolean userOK = false;
		try {
			connection = ConnectionManager.getConnection();
			Users[] foundUsers = UsersManager.getManager().loadByWhere(
					"where USE_EMAIL=\'" + login + "\' AND USE_PASSWORD=\'"
							+ password + "\'", connection);
			if (foundUsers.length != 0) {
				userOK = true;
				if (foundUsers[0].getUseActive() == 0) {
					session.setAttribute("FIRSTIME", "TRUE");
				}
				session.setAttribute("USERID", foundUsers[0]
						.getUseId()+"");
			}
			connection.close();
		} catch (SQLException e) {
			handleError(e, connection, context);
			return false;
		}

		logger.info("ended method: validateUser: " + userOK + " login: "
				+ login + " passwd: " + password);
		return userOK;
	}
}