cato447/AbizeitungVotingSystem
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[FATAL ] SQL-Injektions werden verhindert

Browse Source 
-Es werden  nur Eingaben des Typs '[a-z]+\\.[a- z]+@adolfinum+\\.de$' an die mySQL Tabelle weiter gebeben.
This commit is contained in:
cato447
2020-11-12 22:54:10 +01:00
parent 37b45d998d
commit ad944b9616
1 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
src/main/java/com/github/cato447/AbizeitungVotingSystem/controller/VotingController.java
View File

@@ -68,21 +68,24 @@ public class VotingController {
@RequestMapping("/vote") @RequestMapping("/vote")
public String VerifyName(@RequestParam String name, Model model) { public String VerifyName(@RequestParam String name, Model model) {
try { if (name.strip().toLowerCase().matches("[a-z]+\\.[a-z]+@adolfinum+\\.de$")) {
Voter voter = voterRepository.findByEmail(name); try {
if (voter.getVote_status()) { Voter voter = voterRepository.findByEmail(name.toLowerCase().strip());
LOGGER.warn(name + " has already voted"); if (voter.getVote_status()) {
return "errors/alreadyVoted.html"; LOGGER.warn(name + " has already voted");
} else { return "errors/alreadyVoted.html";
List<Candidate> candidates = candidateRepository.findAll(); } else {
model.addAttribute("candidates", candidates); List<Candidate> candidates = candidateRepository.findAll();
LOGGER.info(name + " is voting now"); model.addAttribute("candidates", candidates);
return "voting.html"; LOGGER.info(name + " is voting now");
return "voting.html";
}
} catch (Exception e) {
LOGGER.error(name + " is not allowed to vote");
return "errors/notRegistered.html";
} }
} catch (Exception e) {
LOGGER.error(name + " is not allowed to vote");
return "errors/notRegistered.html";
} }
return "errors/wrongEmail.html";
} }
@RequestMapping("/processVote") @RequestMapping("/processVote")