Changeset 339:f018669698a8 for kraken-dom/src/main/java/org/krakenapps/dom/api/impl/AdminApiImpl.java

Timestamp:

09/16/11 20:35:43 (8 months ago)

Author:

xeraph

Branch:

default

Convert:

svn:7c3792e6-d75b-4784-96a6-b298f655ee64/trunk@2773

Message:

added admin login access control by remote ip.

File:

• kraken-dom/src/main/java/org/krakenapps/dom/api/impl/AdminApiImpl.java (modified) (5 diffs)

kraken-dom/src/main/java/org/krakenapps/dom/api/impl/AdminApiImpl.java

@@ -37 +37 @@
 import org.krakenapps.dom.api.OtpApi;
 import org.krakenapps.dom.api.UserExtensionProvider;
+import org.krakenapps.dom.exception.AccessControlException;
 import org.krakenapps.dom.exception.AdminLockedException;
 import org.krakenapps.dom.exception.CannotRemoveRequestingAdminException;
@@ -79 +80 @@
         public Admin login(Session session, String nick, String hash, boolean force) throws LoginFailedException {
                 Admin admin = getAdmin(nick, session);
+
+                // check acl (trust host)
+                checkAcl(session, admin);
+
+                // check password
                 String password = null;
-
                 if (otpApi != null && admin.isUseOtp())
                         password = Sha1.hash(otpApi.getOtpValue(admin.getOtpSeed()));
@@ -87 +92 @@
 
                 if (hash.equals(Sha1.hash(password + session.getString("nonce")))) {
-                        OrganizationParameter param = orgParamApi.getOrganizationParameter(admin.getUser().getOrganization()
-                                        .getId(), "max_sessions");
+                        OrganizationParameter param = orgParamApi.getOrganizationParameter(admin.getUser().getOrganization().getId(),
+                                        "max_sessions");
                         if (param != null) {
                                 try {
@@ -111 +116 @@
                         for (LoginCallback callback : callbacks)
                                 callback.onLoginSuccess(admin, session);
-                        loggedIn.add(new LoggedInAdmin(admin.getRole().getLevel(), new Date(), session, admin.getUser()
-                                        .getLoginName()));
+                        loggedIn.add(new LoggedInAdmin(admin.getRole().getLevel(), new Date(), session, admin.getUser().getLoginName()));
                         return admin;
                 } else {
@@ -122 +126 @@
                         else
                                 throw new InvalidPasswordException();
+                }
+        }
+
+        private void checkAcl(Session session, Admin admin) {
+                if (admin.isUseAcl()) {
+                        boolean found = false;
+                        String remote = session.getRemoteAddress().getHostAddress();
+
+                        for (AdminTrustHost h : admin.getTrustHosts())
+                                if (h.getIp() != null && h.getIp().equals(remote))
+                                        found = true;
+
+                        if (!found) {
+                                updateLoginFailures(admin, false);
+                                throw new AccessControlException();
+                        }
                 }
         }