Browse code Various improvements master
1 parent 41e2b38 commit a5bc08773aae8ac704423467099e16eb1da893ac Mark George authored on 29 Oct 2021

Showing 27 changed files

• README.md
• README.txt
• build.gradle
• db/db/h2.sh
• db/db/users.h2.db
• db/h2.sh
• db/users.h2.db
• gradle/wrapper/gradle-wrapper.properties
• schema.sql
• src/main/java/Start.java
• src/main/java/dao/DbConnection.java
• src/main/java/filters/AuthorisationFilter.java
• src/main/java/servlets/BetterLoginServlet.java
• src/main/java/servlets/DodgyLoginServlet.java
• src/main/java/servlets/SignOutServlet.java
• src/main/webapp/WEB-INF/jspf/menu.jspf
• src/main/webapp/css/forms.css
• src/main/webapp/css/style.css
• src/main/webapp/fake-cat.png
• src/main/webapp/fake-dog.png
• src/main/webapp/index.jsp
• src/main/webapp/login.jsp
• src/main/webapp/protected/fake-cat.png
• src/main/webapp/protected/fake-dog.png
• src/main/webapp/protected/welcome.jsp
• src/main/webapp/sign-in.jsp
• src/main/webapp/welcome.jsp

Ignore Space Show notes View README.md 0 → 100644

# Jetty With The Works The intention here is to have a self-contained project that has: * Servlet support. * Filter support. * Annotation based configuration for servlets and filters. * JSP support. * JSP fragment support. * An embedded H2 database. * An embedded Jetty server that runs the entire application from a `main` method. * Generation of a WAR file that can be deployed to Tomcat if necessary. * Everything can be done via Gradle. Basically, anything that we are likely to need for COMP210 and injection flaw demos. The example application has simple form-based authentication and path-based authorisation via a filter. It currently has intentional SQL injection flaws. ## Running Run with: ``` > gradle run ``` The application defaults to a context path of `/shop`. The database is deployed in the WAR, so should be considered to be a disposable copy of the original database (the WAR is extracted into `${TEMP}`, so you can actually get at the deployed database file if really necessary). The main method will start the H2 console for the deployed database. ## Generate WAR file The WAR file is actually being used when running the embedded server, but if you only want the WAR you can use: ``` > gradle war ``` It is generated in `build/libs` The application should use whatever context path it ends up with once deployed. ## Database Access The deployed DB will be opened in the H2 web console by default. As mentioned, this is a copy of the original DB that was embedded in the WAR file. To work on the original version of the database (in the `db/db` directory of the project) you can run the following: ``` > gradle db ```

Show notes View README.txt 100644 → 0
Build with: >gradle assemble WAR file is in build/libs Deploy WAR file to Tomcat.

Ignore Space Show notes View build.gradle

import org.h2.tools.Console; buildscript { repositories { mavenCentral() } dependencies { classpath group: "com.h2database", name: "h2", version: "1.4.200" } } plugins { id "war" id "application" } repositories { mavenCentral() } dependencies { providedCompile group: "javax.servlet", name: "javax.servlet-api", version: "4.0.1" // jetty 10 supports servlet 4 def jettyVer = "10.+" implementation group: "org.eclipse.jetty", name: "jetty-webapp", version: jettyVer implementation group: "org.eclipse.jetty", name: "jetty-annotations", version: jettyVer implementation group: "org.eclipse.jetty", name: "apache-jsp", version: jettyVer implementation group: "org.eclipse.jetty", name: "jetty-slf4j-impl", version: jettyVer implementation group: "com.h2database", name: "h2", version: "1.4.200" implementation group: "ch.qos.logback", name: "logback-classic", version: "1.2.5" } war { // add db to WAR from 'db' } run { dependsOn war } task db { doLast { new org.h2.tools.Console().runTool("-user", "sa", "-url", "jdbc:h2:${projectDir}/db/db/users;AUTO_SERVER=TRUE;IFEXISTS=TRUE"); } } mainClassName = "Start" plugins { id 'war' id 'application' } repositories { mavenCentral() } dependencies { providedCompile group: 'javax.servlet', name: 'javax.servlet-api', version: '4.0.1' // jetty 10 supports servlet 4 def jettyVer = "10.+" implementation group: 'org.eclipse.jetty', name: 'jetty-webapp', version: jettyVer implementation group: 'org.eclipse.jetty', name: 'jetty-annotations', version: jettyVer implementation group: 'org.eclipse.jetty', name: 'apache-jsp', version: jettyVer implementation group: 'org.eclipse.jetty', name: 'jetty-slf4j-impl', version: jettyVer implementation group: 'com.h2database', name: 'h2', version: '1.4.200' implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.5' } task deployWar(type: Copy) { into "${projectDir}/deploy" with war } clean { delete "${projectDir}/deploy" } war.dependsOn deployWar mainClassName = "Start"

Ignore Space Show notes View db/db/h2.sh 0 → 100755
#!/bin/sh java -cp "../WEB-INF/lib/h2-1.4.200.jar" org.h2.tools.Console -web -tcp -browser -user sa -url "jdbc:h2:./users;AUTO_SERVER=TRUE;IFEXISTS=TRUE"

Ignore Space Show notes View db/db/users.h2.db 0 → 100644
Not supported

Show notes View db/h2.sh 100755 → 0
#!/bin/sh java -cp "../WEB-INF/lib/h2-1.4.200.jar" org.h2.tools.Console -ifExists -web -tcp -browser -user sa -url "jdbc:h2:./users;AUTO_SERVER=FALSE"

Show notes View db/users.h2.db 100644 → 0
Not supported

Ignore Space Show notes View gradle/wrapper/gradle-wrapper.properties
distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists distributionUrl=https\://services.gradle.org/distributions/gradle-7.2-bin.zip zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists distributionUrl=https\://services.gradle.org/distributions/gradle-6.8-bin.zip zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists

Ignore Space Show notes View schema.sql

CREATE TABLE USERS( USERNAME VARCHAR NOT NULL PRIMARY KEY, PASSWORD VARCHAR NOT NULL, NAME VARCHAR NOT NULL, CREDIT_CARD VARCHAR ); INSERT INTO USERS(USERNAME, PASSWORD, NAME, CREDIT_CARD) VALUES ('admin', 'cn3cG2pQBhdYsn6AbX', 'Administrator', NULL), ('fred', 'derf', 'Frederick', 'Visa,4367322176856339,3/20,794'), ('homer', 'doh', 'Homer', 'Visa,4779866477763533,8/19,343'), ('sally', 'petr0lhe4d', 'Sally', 'Mastercard,6556432454327654,12/18,177'); CREATE TABLE USERS( USERNAME VARCHAR NOT NULL PRIMARY KEY, PASSWORD VARCHAR ); INSERT INTO PUBLIC.USERS(USERNAME, PASSWORD) VALUES('bob', 'bob');

Ignore Space Show notes View src/main/java/Start.java

import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; import java.sql.SQLException; import java.util.concurrent.CompletableFuture; import java.util.logging.Level; import java.util.logging.Logger; import org.eclipse.jetty.annotations.AnnotationConfiguration; import org.eclipse.jetty.plus.webapp.EnvConfiguration; import org.eclipse.jetty.plus.webapp.PlusConfiguration; import org.eclipse.jetty.server.Server; import org.eclipse.jetty.webapp.Configuration; import org.eclipse.jetty.webapp.FragmentConfiguration; import org.eclipse.jetty.webapp.MetaInfConfiguration; import org.eclipse.jetty.webapp.WebAppConfiguration; import org.eclipse.jetty.webapp.WebAppContext; import org.eclipse.jetty.webapp.WebInfConfiguration; import org.eclipse.jetty.webapp.WebXmlConfiguration; /** * * @author Mark George <mark.george@otago.ac.nz> */ public class Start { public static void main(String[] args) throws Exception { Server server = new Server(8080); WebAppContext context = new WebAppContext(); context.setWar("build/libs/jetty.war"); context.setConfigurations( new Configuration[]{ new AnnotationConfiguration(), new WebAppConfiguration(), new WebXmlConfiguration(), new WebInfConfiguration(), new PlusConfiguration(), new MetaInfConfiguration(), new FragmentConfiguration(), new EnvConfiguration() } ); context.setContextPath("/shop"); context.setParentLoaderPriority(true); server.setHandler(context); server.start(); String path = context.getServletContext().getRealPath(File.separator); String dbUri = "jdbc:h2:file:" + path + "/db/users;AUTO_SERVER=TRUE;IFEXISTS=TRUE"; // // open the web console for the deployed database (comment out block if you don't want the console) // CompletableFuture.runAsync(() -> { // try { // new org.h2.tools.Console().runTool("-user", "sa", "-url", dbUri); // } catch (Exception ex) { // Logger.getLogger(Start.class.getName()).log(Level.SEVERE, null, ex); // } // }); // h2 has a pretty comprehensive openBrowser method that seems more reliable than the Desktop.browse method org.h2.tools.Server.openBrowser("http://localhost:8080/shop/"); server.join(); } } import java.awt.Desktop; import java.net.URI; import java.sql.SQLException; import java.util.concurrent.CompletableFuture; import java.util.logging.Level; import java.util.logging.Logger; import org.eclipse.jetty.annotations.AnnotationConfiguration; import org.eclipse.jetty.plus.webapp.EnvConfiguration; import org.eclipse.jetty.plus.webapp.PlusConfiguration; import org.eclipse.jetty.server.Server; import org.eclipse.jetty.webapp.Configuration; import org.eclipse.jetty.webapp.FragmentConfiguration; import org.eclipse.jetty.webapp.MetaInfConfiguration; import org.eclipse.jetty.webapp.WebAppConfiguration; import org.eclipse.jetty.webapp.WebAppContext; import org.eclipse.jetty.webapp.WebInfConfiguration; import org.eclipse.jetty.webapp.WebXmlConfiguration; /** * * @author Mark George <mark.george@otago.ac.nz> */ public class Start { public static void main(String[] args) throws Exception { Server server = new Server(8080); WebAppContext context = new WebAppContext(); context.setResourceBase("deploy"); context.setConfigurations( new Configuration[]{ new AnnotationConfiguration(), new WebAppConfiguration(), new WebXmlConfiguration(), new WebInfConfiguration(), new PlusConfiguration(), new MetaInfConfiguration(), new FragmentConfiguration(), new EnvConfiguration() } ); CompletableFuture.runAsync(() -> { try { new org.h2.tools.Console().runTool("-web", "-tcp", "-browser", "-user", "sa", "-url", "jdbc:h2:./db/users;AUTO_SERVER=TRUE;IFEXISTS=TRUE"); } catch (SQLException ex) { Logger.getLogger(Start.class.getName()).log(Level.SEVERE, null, ex); } }); context.setContextPath("/"); context.setParentLoaderPriority(true); server.setHandler(context); server.start(); // h2 has a pretty comprehensive openBrowser method that seems more reliable than the Desktop.browse method org.h2.tools.Server.openBrowser("http://localhost:8080"); server.join(); } }

Ignore Space Show notes View src/main/java/dao/DbConnection.java

package dao; import java.io.File; import java.sql.Connection; import java.sql.SQLException; import org.h2.jdbcx.JdbcConnectionPool; import javax.servlet.ServletContext; public class DbConnection { private static final String USERNAME = "sa"; private static final String PASSWORD = ""; private static JdbcConnectionPool pool; public static Connection getConnection(ServletContext ctx) { String path = ctx.getRealPath(File.separator); String uri = "jdbc:h2:file:" + path + "/db/users;AUTO_SERVER=TRUE;IFEXISTS=TRUE"; System.out.println(uri); if (pool == null) { pool = JdbcConnectionPool.create(uri, USERNAME, PASSWORD); } try { return pool.getConnection(); } catch (SQLException ex) { throw new RuntimeException(ex); } } } package dao; import java.io.File; import java.sql.Connection; import java.sql.SQLException; import org.h2.jdbcx.JdbcConnectionPool; import javax.servlet.ServletContext; public class DbConnection { private static final String USERNAME = "sa"; private static final String PASSWORD = ""; private static JdbcConnectionPool pool; public static Connection getConnection(ServletContext ctx) { String path = ctx.getRealPath(File.separator); String uri = "jdbc:h2:file:"+path+"/../db/users;AUTO_SERVER=TRUE;IFEXISTS=true"; System.out.println(uri); if (pool == null) { pool = JdbcConnectionPool.create(uri, USERNAME, PASSWORD); } try { return pool.getConnection(); } catch (SQLException ex) { throw new RuntimeException(ex); } } }

Ignore Space Show notes View src/main/java/filters/AuthorisationFilter.java 0 → 100644

package filters; import javax.servlet.*; import javax.servlet.annotation.WebFilter; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; @WebFilter("/protected/*") public class AuthorisationFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { // noop } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest) request; Boolean signedIn = (Boolean) req.getSession().getAttribute("signedIn"); String ctx = req.getContextPath(); if(signedIn != null && signedIn) { chain.doFilter(request, response); } else { HttpServletResponse rsp = (HttpServletResponse) response; req.getSession().setAttribute("authSuccess", Boolean.FALSE); rsp.sendRedirect(ctx + "/sign-in.jsp"); } } @Override public void destroy() { // noop } }

Show notes View src/main/java/servlets/BetterLoginServlet.java 100644 → 0

package servlets; import dao.DbConnection; import java.io.IOException; import java.sql.Connection; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; //@WebServlet(urlPatterns = {"/login"}) public class BetterLoginServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = ? and password = ?"; try ( Connection con = DbConnection.getConnection(getServletContext()); PreparedStatement stmt = con.prepareStatement(sql); ) { stmt.setString(1, username); stmt.setString(2, password); ResultSet rs = stmt.executeQuery(); if (rs.next()) { String result = rs.getString("name"); request.getSession().setAttribute("user", result); response.sendRedirect("welcome.jsp"); } else { response.sendRedirect("login.jsp?login=fail"); } } catch (SQLException ex) { Logger.getLogger(BetterLoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } }

Ignore Space Show notes View src/main/java/servlets/DodgyLoginServlet.java

package servlets; import dao.DbConnection; import java.io.IOException; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @WebServlet(urlPatterns = {"/sign-in"}) public class DodgyLoginServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String ctx = request.getContextPath(); String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = '" + username + "' and password = '" + password + "';"; System.out.println(sql); try ( Connection con = DbConnection.getConnection(getServletContext()); Statement s = con.createStatement(); ) { ResultSet rs = s.executeQuery(sql); if (rs.next()) { String name = rs.getString("name"); request.getSession().setAttribute("name", name); request.getSession().setAttribute("signedIn",Boolean.TRUE); response.sendRedirect(ctx + "/protected/welcome.jsp"); } else { request.getSession().setAttribute("signedIn", Boolean.FALSE); response.sendRedirect(ctx + "/sign-in.jsp"); } } catch (SQLException ex) { Logger.getLogger(DodgyLoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } } package servlets; import dao.DbConnection; import java.io.IOException; import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @WebServlet(urlPatterns = {"/login"}) public class DodgyLoginServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String username = request.getParameter("username"); String password = request.getParameter("password"); String sql = "select name from users where username = '" + username + "' and password = '" + password + "';"; System.out.println(sql); try ( Connection con = DbConnection.getConnection(getServletContext()); Statement s = con.createStatement(); ) { ResultSet rs = s.executeQuery(sql); if (rs.next()) { String result = rs.getString("name"); request.getSession().setAttribute("user", result); response.sendRedirect("welcome.jsp"); } else { response.sendRedirect("login.jsp?login=fail"); } } catch (SQLException ex) { Logger.getLogger(DodgyLoginServlet.class.getName()).log(Level.SEVERE, null, ex); } } }

Ignore Space Show notes View src/main/java/servlets/SignOutServlet.java 0 → 100644

package servlets; import dao.DbConnection; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.sql.Connection; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException; import java.util.logging.Level; import java.util.logging.Logger; @WebServlet(urlPatterns = {"/sign-out"}) public class SignOutServlet extends HttpServlet { @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String ctx = request.getContextPath(); request.getSession().invalidate(); response.sendRedirect(ctx + "/index.jsp"); } }

Ignore Space Show notes View src/main/webapp/WEB-INF/jspf/menu.jspf
<% Boolean isSignedIn = (Boolean)session.getAttribute("signedIn"); isSignedIn = isSignedIn != null ? isSignedIn : Boolean.FALSE; %> <nav> <a href="<%= ctx %>">Home</a> <% if (isSignedIn) { %> <a href="<%= ctx %>/sign-out">Sign Out</a> <% } else { %> <a href="<%= ctx %>/sign-in.jsp">Sign In</a> <% } %> </nav> <div id="menu"> <a href=".">Home</a> <a href="login.jsp">Log In</a> </div>

Ignore Space Show notes View src/main/webapp/css/forms.css

/* Two column form layout that collapses to a single column as necessary. */ form { display: grid; grid-template-columns: max-content 1fr; grid-gap: 0.75em 0.5em; } label { grid-column: 1 / 2; text-align: right; } input, select, button, textarea { grid-column: 2 / 3; } button { width: 10em; margin-left: auto; } textarea { height: 4em; resize: vertical; } @media screen and (max-width: 600px) { form { grid-template-columns: 1fr; grid-gap: 0em; } label { text-align: left; } input, select, button, textarea { grid-column: 1 / 2; margin-bottom: 1em; width: 100%; } button { max-width: 10em; margin-left: auto; } } /* Two column form layout, with right aligned labels. This has been tested (using HTML4.01 strict) with: - Firefox 3 - 6, - IE 8 (earlier versions do NOT work) - Chrome 2 - 13 (WebKit) - Opera 10 - 11.5 If font family and size is fixed then the forms should look the same in all of the above browsers. The HTML to use this layout should use the following structure: <form> <fieldset> <legend>legend</legend> <label>Label 1:<input type="text"></label> <label>Label 2:<input type="text"></label> <button type="submit">Submit</button> </fieldset> </form> The labels surround the input components to ensure they stay together. Oversized labels will break the layout so resize the fieldsets to suit. Author: Mark George <mgeorge@infoscience.otago.ac.nz> */ fieldset { width: 20em; /* effective width of field set */ padding: 10px; /* padding to space the components from the fieldset border */ padding-top: 0px; /* IE counts the top of the legend as the top of the fieldset meaning backgound color also covers the legend. padding-top makes this effect worse so set it to 0. */ } fieldset label, fieldset input, fieldset textarea, fieldset select { vertical-align: middle; /* ensure labels and input components are vertically centred */ margin-top: 4px; /* add some spacing between form 'rows' */ margin-bottom: 4px; /* add some spacing between form 'rows' */ } fieldset label { text-align: right; /* align the label text right */ display: block; /* make the label represent a single row in the layout */ } fieldset input, fieldset textarea, fieldset select { width: 150px; /* width of the form components */ margin-left: 5px; /* add some spacing between the label and the component */ } fieldset *[type="submit"], fieldset *[type="reset"] { margin: auto; /* restore margin for submit/reset buttons */ margin-top: 5px; /* add some top margin to space submit button from rest of form */ width: 100%; /* make submit buttons full width */ }

Ignore Space Show notes View src/main/webapp/css/style.css

@import url("forms.css"); /* import forms layout */ body { background: rgb(60,60,60); font-family: Arial; font-size: 12pt; } h1 { background: black; color: white; padding: 5px; margin-left:-20px; margin-right:-20px; text-align: center; } main { border:thick; border-style:solid; border-color:black; border-radius: 6px 6px 6px 6px; background:rgb(210,210,210); margin-left:auto; margin-right:auto; margin-top:50px; padding: 20px; width:90%; max-width:800px; } nav { text-align:center; } div#images { margin:auto; text-align:center; } nav a { border: medium; border-style: solid; border-radius: 6px 6px 6px 6px; background-color: rgb(200,200,200); text-decoration: none; font-weight: bolder; color: black; padding: 5px; margin: 3px; } fieldset { border-color:silver; background:rgb(200,200,200); margin:auto; } fieldset legend { color:black; font-weight:bold; } input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover, button:hover, input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus, button:focus { background-color:#E5E5E5; } nav a:hover { background-color: rgb(230,230,230); } @import url("forms.css"); /* import forms layout */ body { background: rgb(60,60,60); font-family: Arial; font-size: 12pt; } h1 { background: black; color: white; padding: 5px; margin-left:-20px; margin-right:-20px; text-align: center; } #content { border:thick; border-style:solid; border-color:black; border-radius: 25px 25px 25px 25px; /* CSS3 */ background:rgb(210,210,210); margin-top:10pt; margin-left:auto; margin-right:auto; margin-top:50px; padding: 20px; width:90%; max-width:800px; } table { margin-left:auto; margin-right:auto; position:relative; border-style:none; border-collapse: collapse; width: 90%; } td, th { border:thin; border-width: 1px 0px 1px 0px; border-style: dotted; padding-left: 5px; padding-right: 5px; } th { text-align: left; } div#menu { text-align:center; } div#welcome { text-align: left; } div#images { margin:auto; text-align:center; } div#menu a { border: medium; border-style: solid; border-radius: 10px 10px 10px 10px; background: rgb(200,200,200); text-decoration: none; font-weight: bolder; color: black; padding: 5px; margin: 3px; } input#quantityToAdd { width:3em; margin-right: 10px; } /* fieldset fonts/colors/margins */ fieldset { border-color:silver; background:rgb(200,200,200); margin:auto; } fieldset legend { color:black; font-weight:bold; } /* make input components change color when focused */ /*input[type="text"]:hover, textarea:hover, select:hover, input[type="password"]:hover, input[type="text"]:focus, textarea:focus, select:focus, input[type="password"]:focus { background-color:#ffff99; border-color:#999999; }*/ /* numeric table cells */ table .currency, table .quantity { text-align:right; } /* fieldset widths */ fieldset#login { width:245px; } fieldset#createaccount { width:250px; } fieldset#quantitytobuy { width:245px; } img { /*display: block;*/ margin: auto; }

Show notes View src/main/webapp/fake-cat.png 100644 → 0

Show notes View src/main/webapp/fake-dog.png 100644 → 0

Ignore Space Show notes View src/main/webapp/index.jsp

<%@page contentType="text/html" pageEncoding="UTF-8"%> <% String ctx = request.getContextPath(); %> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <main> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <p>Please sign in to continue.</p> </main> </body> </html> <%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html>

Show notes View src/main/webapp/login.jsp 100644 → 0

<!DOCTYPE html> <!-- used to demonstrate data theft via SQL injection --> <html> <head> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site - Login</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <h1>Welcome to our awesome web site!</h1> <fieldset><legend>Login</legend> <% if ("fail".equals(request.getParameter("login"))) { %> <p>Log in attempt failed. Please try again.</p> <% } %> <form action="login" method="POST"> <label>Username: <input type="text" name="username"></label> <label>Password: <input type="password" name="password"></label> <input type="submit" value="Login"> </form> </fieldset> </div> </body> </html>

Ignore Space Show notes View src/main/webapp/protected/fake-cat.png 0 → 100644

Ignore Space Show notes View src/main/webapp/protected/fake-dog.png 0 → 100644

Ignore Space Show notes View src/main/webapp/protected/welcome.jsp 0 → 100644

<%@page contentType="text/html" pageEncoding="UTF-8"%> <% String ctx = request.getContextPath(); %> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="<%= ctx %>/css/style.css"/> <title>Awesome Web Site</title> </head> <body> <main> <%@include file="/WEB-INF/jspf/menu.jspf" %> <% String name = (String) session.getAttribute("name");%> <h1>Welcome back <%=name%></h1> <div id="images"> <img width="250" src="<%= ctx %>/protected/fake-cat.png" alt="Image of cat"/> <img width="250" src="<%= ctx %>/protected/fake-dog.png" alt="Image of dog"/> </div> </main> </body> </html>

Ignore Space Show notes View src/main/webapp/sign-in.jsp 0 → 100644

<%@page contentType="text/html" pageEncoding="UTF-8"%> <% String ctx = request.getContextPath(); %> <!DOCTYPE html> <html> <head> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site - Login</title> </head> <body> <main> <%@include file="/WEB-INF/jspf/menu.jspf" %> <% String cp = request.getContextPath(); Boolean signedIn = (Boolean)session.getAttribute("signedIn"); String message = signedIn == null ? "Please sign in to continue." : "Username or password is not correct. Try again." ; %> <h1>Welcome to our awesome web site!</h1> <fieldset> <legend>Sign In</legend> <p><%= message %></p> <form action=<%= cp + "/sign-in"%> method="POST"> <label for="username">Username:</label><input type="text" id="username" name="username" required> <label for="password">Password:</label><input type="password" id="password" name="password" required> <button type="submit">Sign In</button> </form> </fieldset> </main> </body> </html>

Show notes View src/main/webapp/welcome.jsp 100644 → 0

<%@page contentType="text/html" pageEncoding="UTF-8"%> <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="stylesheet" type="text/css" href="css/style.css"/> <title>Awesome Web Site</title> </head> <body> <div id="content"> <%@include file="/WEB-INF/jspf/menu.jspf" %> <% String user = (String) session.getAttribute("user");%> <h1>Welcome back <%=user%></h1> <div id="images"> <img width="250" src="fake-cat.png" alt="Image of cat"/> <img width="250" src="fake-dog.png" alt="Image of dog"/> </div> </div> </body> </html>

Show line notes below