The pure-java-web-app from helen1337

pure-java-web-app's People

Contributors

Stargazers

Watchers

pure-java-web-app's Issues

saveURL doesn't work

This form will never submit:

            <form action="/article" method="post">
                <input type="hidden" id="checkAuthor" name="checkAuthor" value="${sessionScope.user.login}">
                <c:if test="${sessionScope.user.login eq article.author}">
                    <nav class="blog-pagination" aria-label="Pagination">
                        <a class="btn btn-outline-primary rounded-pill" href="/my-blog/article?id=${article.id}&action=edit">Edit</a>
                        <a class="btn btn-outline-secondary rounded-pill" href="/my-blog/article?id=${article.id}&action=delete">Delete</a>
                    </nav>
                </c:if>
            </form>

Therefore, the checkAuthor parameter will never be retrieved, moreover the author parameter does not exist:

    /**
     * Checks if the current user has permission for the specified action.
     * Ensures data security when manually entering URL.
     *
     * @param request The HttpServletRequest object
     * @param action  The action to be performed
     * @return true if user's authenticated and is the article's author or action == "add"
     * otherwise false
     */
    private boolean saveURL(HttpServletRequest request, String action) {
        if (action.equals("add")) {
            return true;
        }
        if (!SessionManager.isUserInSession(request)) {
            return false;
        }
        String checkAuthor = request.getParameter("checkAuthor");
        String authorArticle = request.getParameter("author");
        return Objects.equals(authorArticle, checkAuthor);
    }

Need to solve the issue and rework the access logic in accordance with it.

linking published content (articles) and users

Now the author of an article is identified by comparing models.Article.author and models.User.login. It can lead to conflicts when deleting a user and creating a new one with an identical login. Thus, existing articles will be assigned to the new user based on the nickname criterion.

Recommend Projects