#743 Add proper error message for "invalid chars in password"

- Change password validation to return a ValidationResult object for passing message arguments
- Remove wrapping methods in ProcessService and CommandService and use ValidationService directly
This commit is contained in:
ljacqu
2016-06-03 12:51:49 +02:00
parent 6549ebbf5e
commit 55f7e8097a
15 changed files with 163 additions and 111 deletions
@@ -104,18 +104,6 @@ public class CommandService {
return settings;
}
/**
* Verifies whether a password is valid according to the plugin settings.
*
* @param password the password to verify
* @param username the username the password is associated with
* @return message key with the password error, or {@code null} if password is valid
*/
public MessageKey validatePassword(String password, String username) {
return validationService.validatePassword(password, username);
}
public boolean validateEmail(String email) {
return validationService.validateEmail(email);
}
@@ -10,6 +10,8 @@ import fr.xephi.authme.output.MessageKey;
import fr.xephi.authme.security.PasswordSecurity;
import fr.xephi.authme.security.crypts.HashedPassword;
import fr.xephi.authme.util.BukkitService;
import fr.xephi.authme.util.ValidationService;
import fr.xephi.authme.util.ValidationService.ValidationResult;
import org.bukkit.command.CommandSender;
import javax.inject.Inject;
@@ -32,6 +34,9 @@ public class ChangePasswordAdminCommand implements ExecutableCommand {
@Inject
private BukkitService bukkitService;
@Inject
private ValidationService validationService;
@Override
public void executeCommand(final CommandSender sender, List<String> arguments,
final CommandService commandService) {
@@ -40,9 +45,9 @@ public class ChangePasswordAdminCommand implements ExecutableCommand {
final String playerPass = arguments.get(1);
// Validate the password
MessageKey passwordError = commandService.validatePassword(playerPass, playerName);
if (passwordError != null) {
commandService.send(sender, passwordError);
ValidationResult validationResult = validationService.validatePassword(playerPass, playerName);
if (validationResult.hasError()) {
commandService.send(sender, validationResult.getMessageKey(), validationResult.getArgs());
return;
}
@@ -9,6 +9,8 @@ import fr.xephi.authme.output.MessageKey;
import fr.xephi.authme.security.PasswordSecurity;
import fr.xephi.authme.security.crypts.HashedPassword;
import fr.xephi.authme.util.BukkitService;
import fr.xephi.authme.util.ValidationService;
import fr.xephi.authme.util.ValidationService.ValidationResult;
import org.bukkit.command.CommandSender;
import org.bukkit.entity.Player;
@@ -29,6 +31,9 @@ public class RegisterAdminCommand implements ExecutableCommand {
@Inject
private BukkitService bukkitService;
@Inject
private ValidationService validationService;
@Override
public void executeCommand(final CommandSender sender, List<String> arguments,
final CommandService commandService) {
@@ -38,9 +43,9 @@ public class RegisterAdminCommand implements ExecutableCommand {
final String playerNameLowerCase = playerName.toLowerCase();
// Command logic
MessageKey passwordError = commandService.validatePassword(playerPass, playerName);
if (passwordError != null) {
commandService.send(sender, passwordError);
ValidationResult passwordValidation = validationService.validatePassword(playerPass, playerName);
if (passwordValidation.hasError()) {
commandService.send(sender, passwordValidation.getMessageKey(), passwordValidation.getArgs());
return;
}
@@ -8,6 +8,8 @@ import fr.xephi.authme.output.MessageKey;
import fr.xephi.authme.security.PasswordSecurity;
import fr.xephi.authme.task.ChangePasswordTask;
import fr.xephi.authme.util.BukkitService;
import fr.xephi.authme.util.ValidationService;
import fr.xephi.authme.util.ValidationService.ValidationResult;
import org.bukkit.entity.Player;
import javax.inject.Inject;
@@ -24,6 +26,9 @@ public class ChangePasswordCommand extends PlayerCommand {
@Inject
private BukkitService bukkitService;
@Inject
private ValidationService validationService;
@Inject
// TODO ljacqu 20160531: Remove this once change password task runs as a process (via Management)
private PasswordSecurity passwordSecurity;
@@ -40,9 +45,9 @@ public class ChangePasswordCommand extends PlayerCommand {
}
// Make sure the password is allowed
MessageKey passwordError = commandService.validatePassword(newPassword, name);
if (passwordError != null) {
commandService.send(player, passwordError);
ValidationResult passwordValidation = validationService.validatePassword(newPassword, name);
if (passwordValidation.hasError()) {
commandService.send(player, passwordValidation.getMessageKey(), passwordValidation.getArgs());
return;
}
@@ -63,6 +63,8 @@ public enum MessageKey {
PASSWORD_UNSAFE_ERROR("password_error_unsafe"),
PASSWORD_CHARACTERS_ERROR("password_error_chars", "REG_EX"),
SESSION_EXPIRED("invalid_session"),
MUST_REGISTER_MESSAGE("reg_only"),
@@ -5,6 +5,8 @@ import fr.xephi.authme.permission.PermissionsSystemType;
import org.bukkit.entity.Player;
import java.util.List;
public interface PermissionHandler {
/**
@@ -104,17 +104,6 @@ public class ProcessService {
pluginManager.callEvent(event);
}
/**
* Verifies whether a password is valid according to the plugin settings.
*
* @param password the password to verify
* @param username the username the password is associated with
* @return message key with the password error, or {@code null} if password is valid
*/
public MessageKey validatePassword(String password, String username) {
return validationService.validatePassword(password, username);
}
public boolean validateEmail(String email) {
return validationService.validateEmail(email);
}
@@ -20,6 +20,8 @@ import fr.xephi.authme.settings.properties.RestrictionSettings;
import fr.xephi.authme.settings.properties.SecuritySettings;
import fr.xephi.authme.util.StringUtils;
import fr.xephi.authme.util.Utils;
import fr.xephi.authme.util.ValidationService;
import fr.xephi.authme.util.ValidationService.ValidationResult;
import org.bukkit.Bukkit;
import org.bukkit.entity.Player;
@@ -51,6 +53,9 @@ public class AsyncRegister implements AsynchronousProcess {
@Inject
private PermissionsManager permissionsManager;
@Inject
private ValidationService validationService;
AsyncRegister() { }
private boolean preRegisterCheck(Player player, String password) {
@@ -65,9 +70,9 @@ public class AsyncRegister implements AsynchronousProcess {
//check the password safety only if it's not a automatically generated password
if (service.getProperty(SecuritySettings.PASSWORD_HASH) != HashAlgorithm.TWO_FACTOR) {
MessageKey passwordError = service.validatePassword(password, player.getName());
if (passwordError != null) {
service.send(player, passwordError);
ValidationResult passwordValidation = validationService.validatePassword(password, player.getName());
if (passwordValidation.hasError()) {
service.send(player, passwordValidation.getMessageKey(), passwordValidation.getArgs());
return false;
}
}
@@ -1,6 +1,7 @@
package fr.xephi.authme.util;
import fr.xephi.authme.datasource.DataSource;
import fr.xephi.authme.initialization.Reloadable;
import fr.xephi.authme.output.MessageKey;
import fr.xephi.authme.permission.PermissionsManager;
import fr.xephi.authme.permission.PlayerStatePermission;
@@ -15,21 +16,29 @@ import org.bukkit.command.CommandSender;
import javax.inject.Inject;
import java.util.Collection;
import java.util.List;
import java.util.regex.Pattern;
/**
* Validation service.
*/
public class ValidationService {
public class ValidationService implements Reloadable {
private final NewSetting settings;
private final DataSource dataSource;
private final PermissionsManager permissionsManager;
private Pattern passwordRegex;
@Inject
public ValidationService(NewSetting settings, DataSource dataSource, PermissionsManager permissionsManager) {
this.settings = settings;
this.dataSource = dataSource;
this.permissionsManager = permissionsManager;
reload();
}
@Override
public void reload() {
passwordRegex = Pattern.compile(settings.getProperty(RestrictionSettings.ALLOWED_PASSWORD_REGEX));
}
/**
@@ -37,21 +46,21 @@ public class ValidationService {
*
* @param password the password to verify
* @param username the username the password is associated with
* @return message key with the password error, or {@code null} if password is valid
* @return the validation result
*/
public MessageKey validatePassword(String password, String username) {
public ValidationResult validatePassword(String password, String username) {
String passLow = password.toLowerCase();
if (!passLow.matches(settings.getProperty(RestrictionSettings.ALLOWED_PASSWORD_REGEX))) {
return MessageKey.PASSWORD_MATCH_ERROR;
if (!passwordRegex.matcher(passLow).matches()) {
return new ValidationResult(MessageKey.PASSWORD_CHARACTERS_ERROR, passwordRegex.pattern());
} else if (passLow.equalsIgnoreCase(username)) {
return MessageKey.PASSWORD_IS_USERNAME_ERROR;
return new ValidationResult(MessageKey.PASSWORD_IS_USERNAME_ERROR);
} else if (password.length() < settings.getProperty(SecuritySettings.MIN_PASSWORD_LENGTH)
|| password.length() > settings.getProperty(SecuritySettings.MAX_PASSWORD_LENGTH)) {
return MessageKey.INVALID_PASSWORD_LENGTH;
return new ValidationResult(MessageKey.INVALID_PASSWORD_LENGTH);
} else if (settings.getProperty(SecuritySettings.UNSAFE_PASSWORDS).contains(passLow)) {
return MessageKey.PASSWORD_UNSAFE_ERROR;
return new ValidationResult(MessageKey.PASSWORD_UNSAFE_ERROR);
}
return null;
return new ValidationResult();
}
/**
@@ -130,4 +139,44 @@ public class ValidationService {
}
return false;
}
public static final class ValidationResult {
private final MessageKey messageKey;
private final String[] args;
/**
* Constructor for a successful validation.
*/
public ValidationResult() {
this.messageKey = null;
this.args = null;
}
/**
* Constructor for a failed validation.
*
* @param messageKey message key of the validation error
* @param args arguments for the message key
*/
public ValidationResult(MessageKey messageKey, String... args) {
this.messageKey = messageKey;
this.args = args;
}
/**
* Returns whether an error was found during the validation, i.e. whether the validation failed.
*
* @return true if there is an error, false if the validation was successful
*/
public boolean hasError() {
return messageKey != null;
}
public MessageKey getMessageKey() {
return messageKey;
}
public String[] getArgs() {
return args;
}
}
}