From ec7ed84b04cd3981ae01b104bd52fc010f31e6a7 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Thu, 25 Sep 2014 09:06:39 -0400
Subject: Restrict Gitblit cookie to the context path

---
 .../com/gitblit/manager/AuthenticationManager.java | 37 ++++++++++++++++++++--
 .../java/com/gitblit/manager/GitblitManager.java   | 12 +++++++
 .../gitblit/manager/IAuthenticationManager.java    | 22 +++++++++++++
 3 files changed, 69 insertions(+), 2 deletions(-)

(limited to 'src/main/java/com/gitblit/manager')

diff --git a/src/main/java/com/gitblit/manager/AuthenticationManager.java b/src/main/java/com/gitblit/manager/AuthenticationManager.java
index d1b1af0a..bc1857bc 100644
--- a/src/main/java/com/gitblit/manager/AuthenticationManager.java
+++ b/src/main/java/com/gitblit/manager/AuthenticationManager.java
@@ -454,7 +454,20 @@ public class AuthenticationManager implements IAuthenticationManager {
 	 * @param user
 	 */
 	@Override
+	@Deprecated
 	public void setCookie(HttpServletResponse response, UserModel user) {
+		setCookie(null, response, user);
+	}
+
+	/**
+	 * Sets a cookie for the specified user.
+	 *
+	 * @param request
+	 * @param response
+	 * @param user
+	 */
+	@Override
+	public void setCookie(HttpServletRequest request, HttpServletResponse response, UserModel user) {
 		if (settings.getBoolean(Keys.web.allowCookieAuthentication, true)) {
 			GitBlitWebSession session = GitBlitWebSession.get();
 			boolean standardLogin = session.authenticationType.isStandard();
@@ -477,7 +490,13 @@ public class AuthenticationManager implements IAuthenticationManager {
 						userCookie.setMaxAge((int) TimeUnit.DAYS.toSeconds(7));
 					}
 				}
-				userCookie.setPath("/");
+				String path = "/";
+				if (request != null) {
+					if (!StringUtils.isEmpty(request.getContextPath())) {
+						path = request.getContextPath();
+					}
+				}
+				userCookie.setPath(path);
 				response.addCookie(userCookie);
 			}
 		}
@@ -486,11 +505,25 @@ public class AuthenticationManager implements IAuthenticationManager {
 	/**
 	 * Logout a user.
 	 *
+	 * @param response
 	 * @param user
 	 */
 	@Override
+	@Deprecated
 	public void logout(HttpServletResponse response, UserModel user) {
-		setCookie(response,  null);
+		setCookie(null, response,  null);
+	}
+
+	/**
+	 * Logout a user.
+	 *
+	 * @param request
+	 * @param response
+	 * @param user
+	 */
+	@Override
+	public void logout(HttpServletRequest request, HttpServletResponse response, UserModel user) {
+		setCookie(request, response,  null);
 	}
 
 	/**
diff --git a/src/main/java/com/gitblit/manager/GitblitManager.java b/src/main/java/com/gitblit/manager/GitblitManager.java
index 08853a66..88fa804e 100644
--- a/src/main/java/com/gitblit/manager/GitblitManager.java
+++ b/src/main/java/com/gitblit/manager/GitblitManager.java
@@ -736,15 +736,27 @@ public class GitblitManager implements IGitblit {
 	}
 
 	@Override
+	@Deprecated
 	public void setCookie(HttpServletResponse response, UserModel user) {
 		authenticationManager.setCookie(response, user);
 	}
 
 	@Override
+	public void setCookie(HttpServletRequest request, HttpServletResponse response, UserModel user) {
+		authenticationManager.setCookie(request, response, user);
+	}
+
+	@Override
+	@Deprecated
 	public void logout(HttpServletResponse response, UserModel user) {
 		authenticationManager.logout(response, user);
 	}
 
+	@Override
+	public void logout(HttpServletRequest request, HttpServletResponse response, UserModel user) {
+		authenticationManager.logout(request, response, user);
+	}
+
 	@Override
 	public boolean supportsCredentialChanges(UserModel user) {
 		return authenticationManager.supportsCredentialChanges(user);
diff --git a/src/main/java/com/gitblit/manager/IAuthenticationManager.java b/src/main/java/com/gitblit/manager/IAuthenticationManager.java
index 2665b439..3600b325 100644
--- a/src/main/java/com/gitblit/manager/IAuthenticationManager.java
+++ b/src/main/java/com/gitblit/manager/IAuthenticationManager.java
@@ -85,16 +85,38 @@ public interface IAuthenticationManager extends IManager {
 	 * @param user
 	 * @since 1.4.0
 	 */
+	@Deprecated
 	void setCookie(HttpServletResponse response, UserModel user);
 
+	/**
+	 * Sets a cookie for the specified user.
+	 *
+	 * @param request
+	 * @param response
+	 * @param user
+	 * @since 1.6.1
+	 */
+	void setCookie(HttpServletRequest request, HttpServletResponse response, UserModel user);
+
 	/**
 	 * Logout a user.
 	 *
 	 * @param user
 	 * @since 1.4.0
 	 */
+	@Deprecated
 	void logout(HttpServletResponse response, UserModel user);
 
+	/**
+	 * Logout a user.
+	 *
+	 * @param request
+	 * @param response
+	 * @param user
+	 * @since 1.6.1
+	 */
+	void logout(HttpServletRequest request, HttpServletResponse response, UserModel user);
+
 	/**
 	 * Does the user service support changes to credentials?
 	 *
-- 
cgit v1.2.3