Skip to content

Commit 62b8a74

Browse files
michaeldevermichaeldever
committed
Merge branch 'master' of github.com:michaeldever/WebGoat-Legacy
2 parents 16afa4a + f7a1892 commit 62b8a74

File tree

3 files changed

+49
-19
lines changed

3 files changed

+49
-19
lines changed

‎src/main/java/org/owasp/webgoat/session/UserDatabase.java‎

Lines changed: 48 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,28 +6,33 @@
66

77
class UserDatabase {
88
private Connection userDB;
9-
private final String USER_DB_URI = "jdbc:h2:userDatabase";
9+
private final String USER_DB_URI = "jdbc:h2:userDatabase:./users";
1010

11-
private final String CREATE_USERS_TABLE = "CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY, username VARCHAR(255) NOT NULL UNIQUE, password VARCHAR(255) NOT NULL);";
12-
private final String CREATE_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS roles (id INTEGER PRIMARY KEY, rolename VARCHAR(255) NOT NULL UNIQUE);";
13-
private final String CREATE_USER_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS user_roles (id INTEGER PRIMARY KEY, user_id INTEGER NOT NULL, role_id INTEGER NOT NULL);";
14-
private final String CREATE_USER_ROLES_USER_KEY = "ALTER TABLE user_roles ADD CONSTRAINT user_key FOREIGN KEY user_id REFERENCES users(id);";
15-
private final String CREATE_USER_ROLES_ROLE_KEY = "ALTER TABLE user_roles ADD CONSTRAINT role_key FOREIGN KEY role_id REFERENCES roles(id);";
11+
private final String CREATE_USERS_TABLE = "CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTO_INCREMENT, username VARCHAR(255) NOT NULL UNIQUE, password VARCHAR(255) NOT NULL);";
12+
private final String CREATE_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS roles (id INTEGER PRIMARY KEY AUTO_INCREMENT, rolename VARCHAR(255) NOT NULL UNIQUE);";
13+
private final String CREATE_USER_ROLES_TABLE = "CREATE TABLE IF NOT EXISTS user_roles (id INTEGER PRIMARY KEY AUTO_INCREMENT, user_id INTEGER NOT NULL, role_id INTEGER NOT NULL, FOREIGN KEY (user_id) REFERENCES users(id), FOREIGN KEY (role_id) REFERENCES roles(id));";
1614
private final String ADD_DEFAULT_USERS = "INSERT INTO users (username, password) VALUES ('webgoat','webgoat'),('basic','basic'),('guest','guest');";
1715
private final String ADD_DEFAULT_ROLES = "INSERT INTO roles (rolename) VALUES ('webgoat_basic'),('webgoat_admin'),('webgoat_user');";
18-
private final String ADD_ROLE_TO_USER = "INSERT INTO user_roles (user_id, role_id) VALUES SELECT users.id, roles.id FROM users, roles WHERE users.username = ? AND roles.rolename = ?;";
16+
private final String ADD_ROLE_TO_USER = "INSERT INTO user_roles (user_id, role_id) SELECT users.id, roles.id FROM users, roles WHERE users.username = ? AND roles.rolename = ?;";
1917

2018
private final String QUERY_ALL_USERS = "SELECT username FROM users;";
21-
private final String QUERY_ALL_ROLES_FOR_USERNAME = "SELECT rolename FROM roles WHERE roles.id = user_roles.role_id AND user_roles.user_id = users.id AND users.username = ?;";
19+
private final String QUERY_ALL_ROLES_FOR_USERNAME = "SELECT rolename FROM roles, user_roles, users WHERE roles.id = user_roles.role_id AND user_roles.user_id = users.id AND users.username = ?;";
20+
private final String QUERY_TABLE_COUNT = "SELECT count(id) AS count FROM table;";
2221

23-
private final String DELETE_ALL_ROLES_FOR_USER = "DELETE FROM roles WHERE roles.user_id = users.id and users.username = ?;";
24-
private final String DELETE_USER = "DELETE FROM users WHERE user.username = ?;";
22+
private final String DELETE_ALL_ROLES_FOR_USER = "DELETE FROM user_roles WHERE user_id IN (SELECT id FROM users WHERE username = ?);";
23+
private final String DELETE_USER = "DELETE FROM users WHERE username = ?;";
2524

2625
public UserDatabase() {
2726
createDefaultTables();
28-
createDefaultUsers();
29-
createDefaultRoles();
30-
addDefaultRolesToDefaultUsers();
27+
if (getTableCount("users") <= 0) {
28+
createDefaultUsers();
29+
}
30+
if (getTableCount("roles") <= 0) {
31+
createDefaultRoles();
32+
}
33+
if (getTableCount("user_roles") <= 0) {
34+
addDefaultRolesToDefaultUsers();
35+
}
3136
}
3237

3338
public boolean open() {
@@ -36,7 +41,8 @@ public boolean open() {
3641
Class.forName("org.h2.Driver");
3742
userDB = DriverManager.getConnection(USER_DB_URI, "webgoat_admin", "");
3843
}
39-
} catch (Exception e) {
44+
} catch (SQLException e) {
45+
e.printStackTrace();
4046
return false;
4147
}
4248
return true;
@@ -47,11 +53,31 @@ public boolean close() {
4753
if (userDB != null && !userDB.isClosed())
4854
userDB.close();
4955
} catch (SQLException e) {
56+
e.printStackTrace();
5057
return false;
5158
}
5259
return true;
5360
}
5461

62+
public int getTableCount(String tableName) {
63+
int count = 0;
64+
try {
65+
open();
66+
Statement statement = userDB.createStatement();
67+
ResultSet countResult = statement.executeQuery(QUERY_TABLE_COUNT.replace("table", tableName));
68+
if (countResult.next()) {
69+
count = countResult.getInt("count");
70+
}
71+
countResult.close();
72+
statement.close();
73+
close();
74+
} catch (SQLException e) {
75+
e.printStackTrace();
76+
count = -1;
77+
}
78+
return count;
79+
}
80+
5581
public Iterator<User> getUsers() {
5682
ArrayList<User> users = new ArrayList<User>();
5783
User currentUser;
@@ -76,6 +102,7 @@ public Iterator<User> getUsers() {
76102
userResults.close();
77103
close();
78104
} catch (SQLException e) {
105+
e.printStackTrace();
79106
users = new ArrayList<User>();
80107
}
81108

@@ -92,6 +119,7 @@ public boolean addRoleToUser(String username, String rolename) {
92119
statement.close();
93120
close();
94121
} catch (SQLException e) {
122+
e.printStackTrace();
95123
return false;
96124
}
97125
return true;
@@ -119,6 +147,7 @@ public boolean removeUser(String username) {
119147

120148
close();
121149
} catch (SQLException e) {
150+
e.printStackTrace();
122151
return false;
123152
}
124153
return true;
@@ -135,11 +164,10 @@ private boolean createDefaultTables() {
135164
statement.execute(CREATE_USERS_TABLE);
136165
statement.execute(CREATE_ROLES_TABLE);
137166
statement.execute(CREATE_USER_ROLES_TABLE);
138-
statement.execute(CREATE_USER_ROLES_USER_KEY);
139-
statement.execute(CREATE_USER_ROLES_ROLE_KEY);
140167
statement.close();
141168
close();
142169
} catch (SQLException e) {
170+
e.printStackTrace();
143171
return false;
144172
}
145173
return true;
@@ -153,6 +181,7 @@ private boolean createDefaultUsers() {
153181
statement.close();
154182
close();
155183
} catch (SQLException e) {
184+
e.printStackTrace();
156185
return false;
157186
}
158187
return true;
@@ -166,6 +195,7 @@ private boolean createDefaultRoles() {
166195
statement.close();
167196
close();
168197
} catch (SQLException e) {
198+
e.printStackTrace();
169199
return false;
170200
}
171201
return true;
@@ -176,5 +206,6 @@ private void addDefaultRolesToDefaultUsers() {
176206
addRoleToUser("basic", "webgoat_user");
177207
addRoleToUser("basic", "webgoat_basic");
178208
addRoleToUser("guest", "webgoat_user");
209+
addRoleToUser("michael", "webgoat_user");
179210
}
180-
}
211+
}

‎src/main/java/org/owasp/webgoat/session/WebSession.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,6 @@ public class WebSession {
227227
public WebSession(WebgoatContext webgoatContext, ServletContext context) {
228228
this.webgoatContext = webgoatContext;
229229
// initialize from web.xml
230-
System.out.println("Here");
231230
showParams = webgoatContext.isShowParams();
232231
showCookies = webgoatContext.isShowCookies();
233232
showSource = webgoatContext.isShowSource();

‎src/main/tomcatconf/tomcat-users.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@
88
<user password="basic" roles="webgoat_user,webgoat_basic" username="basic"/>
99
<user password="tomcat" roles="tomcat" username="tomcat"/>
1010
<user password="guest" roles="webgoat_user" username="guest"/>
11-
</tomcat-users>
11+
</tomcat-users>

0 commit comments

Comments
 (0)