Skip to content

Commit 5dbf22f

Browse files
vanitha1822vanitha1822
authored
Merge pull request #102 from PSMRI/nd/vs/wasa_1922
Fix the WASA Issue : IDOR Vulnerability
2 parents dc84bd9 + c455c66 commit 5dbf22f

6 files changed

Lines changed: 109 additions & 38 deletions

File tree

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>com.iemr.tm</groupId>
88
<artifactId>tm-api</artifactId>
9-
<version>3.4.0</version>
9+
<version>3.6.1</version>
1010
<packaging>war</packaging>
1111

1212
<name>TM-API</name>

‎src/main/java/com/iemr/tm/controller/common/main/WorklistController.java‎

Lines changed: 38 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,14 @@
4141
import com.iemr.tm.service.common.transaction.CommonDoctorServiceImpl;
4242
import com.iemr.tm.service.common.transaction.CommonNurseServiceImpl;
4343
import com.iemr.tm.service.common.transaction.CommonServiceImpl;
44+
import com.iemr.tm.utils.CookieUtil;
45+
import com.iemr.tm.utils.JwtUtil;
4446
import com.iemr.tm.utils.mapper.InputMapper;
4547
import com.iemr.tm.utils.response.OutputResponse;
4648

4749
import io.lettuce.core.dynamic.annotation.Param;
4850
import io.swagger.v3.oas.annotations.Operation;
51+
import jakarta.servlet.http.HttpServletRequest;
4952

5053
@RestController
5154
@RequestMapping(value = "/common", headers = "Authorization", consumes = "application/json", produces = "application/json")
@@ -57,6 +60,9 @@ public class WorklistController {
5760
private CommonServiceImpl commonServiceImpl;
5861
private InputMapper inputMapper = new InputMapper();
5962

63+
@Autowired
64+
private JwtUtil jwtUtil;
65+
6066
@Autowired
6167
public void setCommonServiceImpl(CommonServiceImpl commonServiceImpl) {
6268
this.commonServiceImpl = commonServiceImpl;
@@ -676,20 +682,24 @@ public String getBeneficiaryCaseSheetHistory(
676682

677683
// TC specialist worklist new
678684
@Operation(summary = "Get teleconsultation specialist worklist")
679-
@GetMapping(value = { "/getTCSpecialistWorklist/{providerServiceMapID}/{serviceID}/{userID}" })
685+
@GetMapping(value = { "/getTCSpecialistWorklist/{providerServiceMapID}/{serviceID}" })
680686
public String getTCSpecialistWorkListNew(@PathVariable("providerServiceMapID") Integer providerServiceMapID,
681-
@PathVariable("userID") Integer userID, @PathVariable("serviceID") Integer serviceID) {
687+
@PathVariable("serviceID") Integer serviceID, HttpServletRequest request) {
682688
OutputResponse response = new OutputResponse();
683689
try {
684-
if (providerServiceMapID != null && userID != null) {
690+
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
691+
String userId = jwtUtil.getUserIdFromToken(jwtToken);
692+
Integer userID=Integer.parseInt(userId);
693+
if (providerServiceMapID != null && userId != null ) {
685694
String s = commonDoctorServiceImpl.getTCSpecialistWorkListNewForTM(providerServiceMapID, userID,
686695
serviceID);
687696
if (s != null)
688697
response.setResponse(s);
698+
} else if(userId == null || jwtToken == null) {
699+
response.setError(403, "Unauthorized access!");
689700
} else {
690-
logger.error("Invalid request, either ProviderServiceMapID or userID is invalid. PSMID = "
691-
+ providerServiceMapID + " SID = " + userID);
692-
response.setError(5000, "Invalid request, either ProviderServiceMapID or userID is invalid");
701+
logger.error("Invalid request");
702+
response.setError(5000, "Invalid request");
693703
}
694704

695705
} catch (Exception e) {
@@ -702,21 +712,25 @@ public String getTCSpecialistWorkListNew(@PathVariable("providerServiceMapID") I
702712
// TC specialist worklist new, patient App, 14-08-2020
703713
@Operation(summary = "Get teleconsultation specialist worklist for patient app")
704714
@GetMapping(value = {
705-
"/getTCSpecialistWorklistPatientApp/{providerServiceMapID}/{serviceID}/{userID}/{vanID}" })
715+
"/getTCSpecialistWorklistPatientApp/{providerServiceMapID}/{serviceID}/{vanID}" })
706716
public String getTCSpecialistWorkListNewPatientApp(
707-
@PathVariable("providerServiceMapID") Integer providerServiceMapID, @PathVariable("userID") Integer userID,
708-
@PathVariable("serviceID") Integer serviceID, @PathVariable("vanID") Integer vanID) {
717+
@PathVariable("providerServiceMapID") Integer providerServiceMapID,
718+
@PathVariable("serviceID") Integer serviceID, @PathVariable("vanID") Integer vanID, HttpServletRequest request) {
709719
OutputResponse response = new OutputResponse();
710720
try {
721+
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
722+
String userId = jwtUtil.getUserIdFromToken(jwtToken);
723+
Integer userID=Integer.parseInt(userId);
711724
if (providerServiceMapID != null && userID != null) {
712725
String s = commonDoctorServiceImpl.getTCSpecialistWorkListNewForTMPatientApp(providerServiceMapID,
713726
userID, serviceID, vanID);
714727
if (s != null)
715728
response.setResponse(s);
729+
} else if(userId == null || jwtToken == null) {
730+
response.setError(403, "Unauthorized access!");
716731
} else {
717-
logger.error("Invalid request, either ProviderServiceMapID or userID is invalid. PSMID = "
718-
+ providerServiceMapID + " SID = " + userID);
719-
response.setError(5000, "Invalid request, either ProviderServiceMapID or userID is invalid");
732+
logger.error("Invalid request");
733+
response.setError(5000, "Invalid request");
720734
}
721735

722736
} catch (Exception e) {
@@ -729,21 +743,26 @@ public String getTCSpecialistWorkListNewPatientApp(
729743
// TC specialist worklist new future scheduled
730744
@Operation(summary = "Get teleconsultation specialist future scheduled")
731745
@GetMapping(value = {
732-
"/getTCSpecialistWorklistFutureScheduled/{providerServiceMapID}/{serviceID}/{userID}" })
746+
"/getTCSpecialistWorklistFutureScheduled/{providerServiceMapID}/{serviceID}" })
733747
public String getTCSpecialistWorklistFutureScheduled(
734-
@PathVariable("providerServiceMapID") Integer providerServiceMapID, @PathVariable("userID") Integer userID,
735-
@PathVariable("serviceID") Integer serviceID) {
748+
@PathVariable("providerServiceMapID") Integer providerServiceMapID,
749+
@PathVariable("serviceID") Integer serviceID, HttpServletRequest request) {
736750
OutputResponse response = new OutputResponse();
737751
try {
738-
if (providerServiceMapID != null && userID != null) {
752+
753+
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
754+
String userId = jwtUtil.getUserIdFromToken(jwtToken);
755+
Integer userID=Integer.parseInt(userId);
756+
if (providerServiceMapID != null && userID != null ) {
739757
String s = commonDoctorServiceImpl.getTCSpecialistWorkListNewFutureScheduledForTM(providerServiceMapID,
740758
userID, serviceID);
741759
if (s != null)
742760
response.setResponse(s);
761+
} else if(userId == null || jwtToken == null) {
762+
response.setError(403, "Unauthorized access!");
743763
} else {
744-
logger.error("Invalid request, either ProviderServiceMapID or userID is invalid. PSMID = "
745-
+ providerServiceMapID + " UserID = " + userID);
746-
response.setError(5000, "Invalid request, either ProviderServiceMapID or userID is invalid");
764+
logger.error("Invalid request");
765+
response.setError(5000, "Invalid request");
747766
}
748767

749768
} catch (Exception e) {

‎src/main/java/com/iemr/tm/controller/login/IemrMmuLoginController.java‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,13 @@
3535

3636
import com.iemr.tm.controller.registrar.main.RegistrarController;
3737
import com.iemr.tm.service.login.IemrMmuLoginServiceImpl;
38+
import com.iemr.tm.utils.CookieUtil;
39+
import com.iemr.tm.utils.JwtUtil;
3840
import com.iemr.tm.utils.mapper.InputMapper;
3941
import com.iemr.tm.utils.response.OutputResponse;
4042

4143
import io.swagger.v3.oas.annotations.Operation;
44+
import jakarta.servlet.http.HttpServletRequest;
4245

4346
@RestController
4447
@RequestMapping(value = "/user", headers = "Authorization", consumes = "application/json", produces = "application/json")
@@ -49,6 +52,10 @@ public class IemrMmuLoginController {
4952

5053
private IemrMmuLoginServiceImpl iemrMmuLoginServiceImpl;
5154

55+
56+
@Autowired
57+
private JwtUtil jwtUtil;
58+
5259
@Autowired
5360
public void setIemrMmuLoginServiceImpl(IemrMmuLoginServiceImpl iemrMmuLoginServiceImpl) {
5461
this.iemrMmuLoginServiceImpl = iemrMmuLoginServiceImpl;
@@ -57,13 +64,21 @@ public void setIemrMmuLoginServiceImpl(IemrMmuLoginServiceImpl iemrMmuLoginServi
5764
@Operation(summary = "Get user service point van details")
5865
@PostMapping(value = "/getUserServicePointVanDetails", produces = {
5966
"application/json" })
60-
public String getUserServicePointVanDetails(@RequestBody String comingRequest) {
67+
public String getUserServicePointVanDetails(@RequestBody String comingRequest, HttpServletRequest request) {
6168
OutputResponse response = new OutputResponse();
6269
try {
6370

71+
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
72+
String userId = jwtUtil.getUserIdFromToken(jwtToken);
73+
Integer userID=Integer.parseInt(userId);
74+
6475
JSONObject obj = new JSONObject(comingRequest);
6576
logger.info("getUserServicePointVanDetails request " + comingRequest);
66-
String responseData = iemrMmuLoginServiceImpl.getUserServicePointVanDetails(obj.getInt("userID"));
77+
if (userId == null || jwtToken ==null) {
78+
response.setError(403, "Unauthorized access: Missing or invalid token");
79+
return response.toString();
80+
}
81+
String responseData = iemrMmuLoginServiceImpl.getUserServicePointVanDetails(userID);
6782
response.setResponse(responseData);
6883
} catch (Exception e) {
6984
// e.printStackTrace();
@@ -97,17 +112,23 @@ public String getServicepointVillages(@RequestBody String comingRequest) {
97112

98113
@Operation(summary = "Get user service point van details")
99114
@PostMapping(value = "/getUserVanSpDetails", produces = { "application/json" })
100-
public String getUserVanSpDetails(@RequestBody String comingRequest) {
115+
public String getUserVanSpDetails(@RequestBody String comingRequest, HttpServletRequest request) {
101116
OutputResponse response = new OutputResponse();
102117
try {
118+
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
119+
String userId = jwtUtil.getUserIdFromToken(jwtToken);
120+
Integer userID=Integer.parseInt(userId);
103121

104122
JSONObject obj = new JSONObject(comingRequest);
105123
logger.info("getServicepointVillages request " + comingRequest);
106-
if (obj.has("userID") && obj.has("providerServiceMapID")) {
107-
String responseData = iemrMmuLoginServiceImpl.getUserVanSpDetails(obj.getInt("userID"),
108-
obj.getInt("providerServiceMapID"));
109-
response.setResponse(responseData);
110-
} else {
124+
125+
if (userId !=null && obj.has("providerServiceMapID")) {
126+
String responseData = iemrMmuLoginServiceImpl.getUserVanSpDetails(userID,
127+
obj.getInt("providerServiceMapID"));
128+
response.setResponse(responseData);
129+
} else if(userId == null || jwtToken ==null) {
130+
response.setError(403, "Unauthorized access : Missing or invalid token");
131+
} else {
111132
response.setError(5000, "Invalid request");
112133
}
113134
} catch (Exception e) {

‎src/main/java/com/iemr/tm/controller/teleconsultation/TeleConsultationController.java‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
import org.springframework.web.bind.annotation.RequestHeader;
3131
import org.springframework.web.bind.annotation.RequestMapping;
3232
import org.springframework.web.bind.annotation.RestController;
33+
import jakarta.servlet.http.HttpServletRequest;
34+
import com.iemr.tm.utils.CookieUtil;
35+
import com.iemr.tm.utils.JwtUtil;
3336

3437
import com.google.gson.JsonElement;
3538
import com.google.gson.JsonObject;
@@ -47,6 +50,9 @@ public class TeleConsultationController {
4750
@Autowired
4851
private TeleConsultationServiceImpl teleConsultationServiceImpl;
4952

53+
@Autowired
54+
private JwtUtil jwtUtil;
55+
5056
@Operation(summary = "Update beneficiary arrival status based on request")
5157
@PostMapping(value = { "/update/benArrivalStatus" })
5258
public String benArrivalStatusUpdater(@RequestBody String requestOBJ) {
@@ -137,24 +143,30 @@ public String createTCRequestForBeneficiary(@RequestBody String requestOBJ, @Req
137143
// TC request List
138144
@Operation(summary = "Get teleconsultation request list for a specialist")
139145
@PostMapping(value = { "/getTCRequestList" })
140-
public String getTCSpecialistWorkListNew(@RequestBody String requestOBJ) {
146+
public String getTCSpecialistWorkListNew(@RequestBody String requestOBJ, HttpServletRequest request) {
141147
OutputResponse response = new OutputResponse();
142148
try {
149+
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
150+
String userId = jwtUtil.getUserIdFromToken(jwtToken);
151+
Integer userID=Integer.parseInt(userId);
152+
143153
if (requestOBJ != null) {
144154
JsonObject jsnOBJ = new JsonObject();
145155
JsonParser jsnParser = new JsonParser();
146156
JsonElement jsnElmnt = jsnParser.parse(requestOBJ);
147157
jsnOBJ = jsnElmnt.getAsJsonObject();
148-
158+
if (userId != null) {
149159
String s = teleConsultationServiceImpl.getTCRequestListBySpecialistIdAndDate(
150-
jsnOBJ.get("psmID").getAsInt(), jsnOBJ.get("userID").getAsInt(),
160+
jsnOBJ.get("psmID").getAsInt(), userID,
151161
jsnOBJ.get("date").getAsString());
152162
if (s != null)
153163
response.setResponse(s);
154164
} else {
155-
logger.error("Invalid request, either ProviderServiceMapID or userID or reqDate is invalid");
165+
response.setError(403, "Unauthorized access!");
166+
} } else {
167+
logger.error("Invalid request, either ProviderServiceMapID or reqDate is invalid");
156168
response.setError(5000,
157-
"Invalid request, either ProviderServiceMapID or UserID or RequestDate is invalid");
169+
"Invalid request, either ProviderServiceMapID or RequestDate is invalid");
158170
}
159171

160172
} catch (Exception e) {

‎src/main/java/com/iemr/tm/controller/videoconsultationcontroller/VideoConsultationController.java‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@
3232

3333
import com.iemr.tm.service.videoconsultation.VideoConsultationService;
3434
import com.iemr.tm.utils.response.OutputResponse;
35+
import jakarta.servlet.http.HttpServletRequest;
36+
import com.iemr.tm.utils.CookieUtil;
37+
import com.iemr.tm.utils.JwtUtil;
3538

3639
import io.swagger.v3.oas.annotations.Operation;
3740

@@ -44,19 +47,26 @@ public class VideoConsultationController {
4447
@Autowired
4548
private VideoConsultationService videoConsultationService;
4649

50+
@Autowired
51+
private JwtUtil jwtUtil;
52+
4753
@Operation(summary = "Login to video consultation service")
4854
@GetMapping(value = "/login/{userID}", headers = "Authorization", produces = {
4955
"application/json" })
50-
public String login(@PathVariable("userID") Long userID) {
56+
public String login(@PathVariable("userID") Long userID, HttpServletRequest request) {
5157

5258
OutputResponse response = new OutputResponse();
53-
5459
try {
60+
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
61+
String userId = jwtUtil.getUserIdFromToken(jwtToken);
5562

56-
String createdData = videoConsultationService.login(userID);
57-
58-
response.setResponse(createdData.toString());
63+
if(userID.toString().equals(userId)) {
64+
String createdData = videoConsultationService.login(userID);
5965

66+
response.setResponse(createdData.toString());
67+
} else {
68+
response.setError(403, "Unauthorized access!");
69+
}
6070
} catch (Exception e) {
6171
logger.error(e.getMessage());
6272
response.setError(e);

‎src/main/java/com/iemr/tm/utils/JwtUtil.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,4 +66,13 @@ private Claims extractAllClaims(String token) {
6666
.parseSignedClaims(token)
6767
.getPayload();
6868
}
69+
70+
public String getUserIdFromToken(String token) {
71+
Claims claims = validateToken(token);
72+
if (claims == null) {
73+
return null;
74+
}
75+
return claims.get("userId", String.class);
76+
}
6977
}
78+

0 commit comments

Comments
 (0)