Restrict Gitblit cookie to the context path

diff --git a/src/main/java/com/gitblit/manager/AuthenticationManager.java b/src/main/java/com/gitblit/manager/AuthenticationManager.java
index d1b1af0ab06db1df3d5bcea29762fd29189c2d73..bc1857bc9f8fe2f359d0c8caafdb564653a4443f 100644 (file)
--- a/src/main/java/com/gitblit/manager/AuthenticationManager.java
+++ b/src/main/java/com/gitblit/manager/AuthenticationManager.java
@@ -454,7 +454,20 @@ public class AuthenticationManager implements IAuthenticationManager {
         * @param user
         */
        @Override
+       @Deprecated
        public void setCookie(HttpServletResponse response, UserModel user) {
+               setCookie(null, response, user);
+       }
+
+       /**
+        * Sets a cookie for the specified user.
+        *
+        * @param request
+        * @param response
+        * @param user
+        */
+       @Override
+       public void setCookie(HttpServletRequest request, HttpServletResponse response, UserModel user) {
                if (settings.getBoolean(Keys.web.allowCookieAuthentication, true)) {
                        GitBlitWebSession session = GitBlitWebSession.get();
                        boolean standardLogin = session.authenticationType.isStandard();
@@ -477,7 +490,13 @@ public class AuthenticationManager implements IAuthenticationManager {
                                                userCookie.setMaxAge((int) TimeUnit.DAYS.toSeconds(7));
                                        }
                                }
-                               userCookie.setPath("/");
+                               String path = "/";
+                               if (request != null) {
+                                       if (!StringUtils.isEmpty(request.getContextPath())) {
+                                               path = request.getContextPath();
+                                       }
+                               }
+                               userCookie.setPath(path);
                                response.addCookie(userCookie);
                        }
                }
@@ -486,11 +505,25 @@ public class AuthenticationManager implements IAuthenticationManager {
        /**
         * Logout a user.
         *
+        * @param response
         * @param user
         */
        @Override
+       @Deprecated
        public void logout(HttpServletResponse response, UserModel user) {
-               setCookie(response,  null);
+               setCookie(null, response,  null);
+       }
+
+       /**
+        * Logout a user.
+        *
+        * @param request
+        * @param response
+        * @param user
+        */
+       @Override
+       public void logout(HttpServletRequest request, HttpServletResponse response, UserModel user) {
+               setCookie(request, response,  null);
        }
 
        /**

diff --git a/src/main/java/com/gitblit/manager/GitblitManager.java b/src/main/java/com/gitblit/manager/GitblitManager.java
index 08853a669d71c093bb74e3c6453473665449f864..88fa804ed45a38de62fc925f4eacb450176fab15 100644 (file)
--- a/src/main/java/com/gitblit/manager/GitblitManager.java
+++ b/src/main/java/com/gitblit/manager/GitblitManager.java
@@ -736,15 +736,27 @@ public class GitblitManager implements IGitblit {
        }
 
        @Override
+       @Deprecated
        public void setCookie(HttpServletResponse response, UserModel user) {
                authenticationManager.setCookie(response, user);
        }
 
        @Override
+       public void setCookie(HttpServletRequest request, HttpServletResponse response, UserModel user) {
+               authenticationManager.setCookie(request, response, user);
+       }
+
+       @Override
+       @Deprecated
        public void logout(HttpServletResponse response, UserModel user) {
                authenticationManager.logout(response, user);
        }
 
+       @Override
+       public void logout(HttpServletRequest request, HttpServletResponse response, UserModel user) {
+               authenticationManager.logout(request, response, user);
+       }
+
        @Override
        public boolean supportsCredentialChanges(UserModel user) {
                return authenticationManager.supportsCredentialChanges(user);

diff --git a/src/main/java/com/gitblit/manager/IAuthenticationManager.java b/src/main/java/com/gitblit/manager/IAuthenticationManager.java
index 2665b439b4a3005fce5831bdde989c989bf6b928..3600b32575ecd69617c3eafd42272255d189986b 100644 (file)
--- a/src/main/java/com/gitblit/manager/IAuthenticationManager.java
+++ b/src/main/java/com/gitblit/manager/IAuthenticationManager.java
@@ -85,16 +85,38 @@ public interface IAuthenticationManager extends IManager {
         * @param user
         * @since 1.4.0
         */
+       @Deprecated
        void setCookie(HttpServletResponse response, UserModel user);
 
+       /**
+        * Sets a cookie for the specified user.
+        *
+        * @param request
+        * @param response
+        * @param user
+        * @since 1.6.1
+        */
+       void setCookie(HttpServletRequest request, HttpServletResponse response, UserModel user);
+
        /**
         * Logout a user.
         *
         * @param user
         * @since 1.4.0
         */
+       @Deprecated
        void logout(HttpServletResponse response, UserModel user);
 
+       /**
+        * Logout a user.
+        *
+        * @param request
+        * @param response
+        * @param user
+        * @since 1.6.1
+        */
+       void logout(HttpServletRequest request, HttpServletResponse response, UserModel user);
+
        /**
         * Does the user service support changes to credentials?
         *

diff --git a/src/main/java/com/gitblit/wicket/pages/ChangePasswordPage.java b/src/main/java/com/gitblit/wicket/pages/ChangePasswordPage.java
index 4c8d3a1d5fd39604fe4279ef39260586eeca182d..a6aca22d78e2120fd2a62412dc44fcc5e6ed86e5 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/ChangePasswordPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/ChangePasswordPage.java
@@ -23,6 +23,7 @@ import org.apache.wicket.markup.html.form.PasswordTextField;
 import org.apache.wicket.markup.html.form.StatelessForm;\r
 import org.apache.wicket.model.IModel;\r
 import org.apache.wicket.model.Model;\r
+import org.apache.wicket.protocol.http.WebRequest;\r
 import org.apache.wicket.protocol.http.WebResponse;\r
 \r
 import com.gitblit.GitBlitException;\r
@@ -99,8 +100,10 @@ public class ChangePasswordPage extends RootSubPage {
                                try {\r
                                        app().gitblit().reviseUser(user.username, user);\r
                                        if (app().settings().getBoolean(Keys.web.allowCookieAuthentication, false)) {\r
+                                               WebRequest request = (WebRequest) getRequestCycle().getRequest();\r
                                                WebResponse response = (WebResponse) getRequestCycle().getResponse();\r
-                                               app().authentication().setCookie(response.getHttpServletResponse(), user);\r
+                                               app().authentication().setCookie(request.getHttpServletRequest(),\r
+                                                               response.getHttpServletResponse(), user);\r
                                        }\r
                                } catch (GitBlitException e) {\r
                                        error(e.getMessage());\r

diff --git a/src/main/java/com/gitblit/wicket/pages/LogoutPage.java b/src/main/java/com/gitblit/wicket/pages/LogoutPage.java
index 27542bd0b4923dab85b7d761bb4c25b62bd8eeb7..a8ae7d0fe86da81607a8b7ddcdc83e91fd34d63c 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/LogoutPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/LogoutPage.java
@@ -27,7 +27,8 @@ public class LogoutPage extends BasePage {
                super();\r
                GitBlitWebSession session = GitBlitWebSession.get();\r
                UserModel user = session.getUser();\r
-               app().authentication().logout(((WebResponse) getResponse()).getHttpServletResponse(), user);\r
+               app().authentication().logout(((WebRequest) getRequest()).getHttpServletRequest(),\r
+                               ((WebResponse) getResponse()).getHttpServletResponse(), user);\r
                session.invalidate();\r
 \r
                /*\r

diff --git a/src/main/java/com/gitblit/wicket/pages/RootPage.java b/src/main/java/com/gitblit/wicket/pages/RootPage.java
index b1c3639dfc68d83d522f6d0cd3d24511cab647dc..6a933b76b6518b3c754627be14e3a266fe64893f 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/RootPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/RootPage.java
@@ -46,6 +46,7 @@ import org.apache.wicket.markup.repeater.data.DataView;
 import org.apache.wicket.markup.repeater.data.ListDataProvider;
 import org.apache.wicket.model.IModel;
 import org.apache.wicket.model.Model;
+import org.apache.wicket.protocol.http.WebRequest;
 import org.apache.wicket.protocol.http.WebResponse;
 
 import com.gitblit.Constants;
@@ -269,8 +270,10 @@ public abstract class RootPage extends BasePage {
 
                        // Set Cookie
                        if (app().settings().getBoolean(Keys.web.allowCookieAuthentication, false)) {
+                               WebRequest request = (WebRequest) getRequestCycle().getRequest();
                                WebResponse response = (WebResponse) getRequestCycle().getResponse();
-                               app().authentication().setCookie(response.getHttpServletResponse(), user);
+                               app().authentication().setCookie(request.getHttpServletRequest(),
+                                               response.getHttpServletResponse(), user);
                        }
 
                        if (!session.continueRequest()) {

diff --git a/src/main/java/com/gitblit/wicket/pages/SessionPage.java b/src/main/java/com/gitblit/wicket/pages/SessionPage.java
index 7a58175fe05ea003903760a1a41b78f2228b98cb..7717854bb903c9f5abf07cc5cc717cce04f8b9de 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/SessionPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/SessionPage.java
@@ -58,9 +58,11 @@ public abstract class SessionPage extends WebPage {
 \r
                        if (user == null || user.disabled) {\r
                                // user was deleted/disabled during session\r
+                               HttpServletRequest request = ((WebRequest) getRequestCycle().getRequest())\r
+                                               .getHttpServletRequest();\r
                                HttpServletResponse response = ((WebResponse) getRequestCycle().getResponse())\r
                                                .getHttpServletResponse();\r
-                               app().authentication().logout(response, user);\r
+                               app().authentication().logout(request, response, user);\r
                                session.setUser(null);\r
                                session.invalidateNow();\r
                                return;\r
@@ -76,7 +78,7 @@ public abstract class SessionPage extends WebPage {
                                                // cookie was changed during our session\r
                                                HttpServletResponse response = ((WebResponse) getRequestCycle().getResponse())\r
                                                                .getHttpServletResponse();\r
-                                               app().authentication().logout(response, user);\r
+                                               app().authentication().logout(request, response, user);\r
                                                session.setUser(null);\r
                                                session.invalidateNow();\r
                                                return;\r
@@ -99,8 +101,10 @@ public abstract class SessionPage extends WebPage {
                        session.setUser(user);\r
 \r
                        // Set Cookie\r
+                       WebRequest request = (WebRequest) getRequestCycle().getRequest();\r
                        WebResponse response = (WebResponse) getRequestCycle().getResponse();\r
-                       app().authentication().setCookie(response.getHttpServletResponse(), user);\r
+                       app().authentication().setCookie(request.getHttpServletRequest(),\r
+                                       response.getHttpServletResponse(), user);\r
 \r
                        session.continueRequest();\r
                }\r