Skip to content

Commit 8cd1590

Browse files
david-blasbyjodygarnett
david-blasby
authored and
jodygarnett
committed
hide private info on about page
1 parent 5100897 commit 8cd1590

File tree

3 files changed

+79
-35
lines changed

3 files changed

+79
-35
lines changed

‎src/web/core/src/main/java/org/geoserver/web/AboutGeoServerPage.html

+33-31
Original file line numberDiff line numberDiff line change
@@ -2,37 +2,39 @@
22
<body>
33
<wicket:extend>
44
<form>
5-
<fieldset class="mt-3">
6-
<legend>
7-
<wicket:message key="buildInformation">Build Information</wicket:message>
8-
</legend>
9-
<ul>
10-
<li>
11-
<label for="version"><wicket:message key="geoserverVersion">Version</wicket:message></label>
12-
<span id="version"><wicket:message key="version"></wicket:message></span>
13-
</li>
14-
<li>
15-
<label for="buildRevision"><wicket:message key="gitRevision">Git Revision</wicket:message></label>
16-
<span id="buildRevision"><wicket:message key="build.revision"></wicket:message></span>
17-
</li>
18-
<li>
19-
<label for="buildDate"><wicket:message key="buildDate">Build Date</wicket:message></label>
20-
<span id="buildDate"><wicket:message key="build.date"></wicket:message></span>
21-
</li>
22-
<li>
23-
<label for="geotoolsInfo"><wicket:message key="geotoolsVersion">GeoTools Version</wicket:message></label>
24-
<span id="geotoolsInfo">
25-
<span wicket:id="geotoolsVersion"></span> (rev <span wicket:id="geotoolsRevision"></span>)
26-
</span>
27-
</li>
28-
<li>
29-
<label for="geowebcacheInfo"><wicket:message key="geowebcacheVersion">GeoWebCache Version</wicket:message></label>
30-
<span id="geotoolsInfo">
31-
<span wicket:id="geowebcacheVersion"></span> (rev <span wicket:id="geowebcacheRevision"></span>)
32-
</span>
33-
</li>
34-
</ul>
35-
</fieldset>
5+
<wicket:container wicket:id="privateInfo">
6+
<fieldset class="mt-3">
7+
<legend>
8+
<wicket:message key="buildInformation">Build Information</wicket:message>
9+
</legend>
10+
<ul>
11+
<li>
12+
<label for="version"><wicket:message key="geoserverVersion">Version</wicket:message></label>
13+
<span id="version"><wicket:message key="version"></wicket:message></span>
14+
</li>
15+
<li>
16+
<label for="buildRevision"><wicket:message key="gitRevision">Git Revision</wicket:message></label>
17+
<span id="buildRevision"><wicket:message key="build.revision"></wicket:message></span>
18+
</li>
19+
<li>
20+
<label for="buildDate"><wicket:message key="buildDate">Build Date</wicket:message></label>
21+
<span id="buildDate"><wicket:message key="build.date"></wicket:message></span>
22+
</li>
23+
<li>
24+
<label for="geotoolsInfo"><wicket:message key="geotoolsVersion">GeoTools Version</wicket:message></label>
25+
<span id="geotoolsInfo">
26+
<span wicket:id="geotoolsVersion"></span> (rev <span wicket:id="geotoolsRevision"></span>)
27+
</span>
28+
</li>
29+
<li>
30+
<label for="geowebcacheInfo"><wicket:message key="geowebcacheVersion">GeoWebCache Version</wicket:message></label>
31+
<span id="geotoolsInfo">
32+
<span wicket:id="geowebcacheVersion"></span> (rev <span wicket:id="geowebcacheRevision"></span>)
33+
</span>
34+
</li>
35+
</ul>
36+
</fieldset>
37+
</wicket:container>
3638
<fieldset>
3739
<legend><wicket:message key="moreInformation">More Information</wicket:message></legend>
3840
<p>

‎src/web/core/src/main/java/org/geoserver/web/AboutGeoServerPage.java

+24-4
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,10 @@
66
package org.geoserver.web;
77

88
import java.util.logging.Level;
9+
import org.apache.wicket.markup.html.WebMarkupContainer;
910
import org.apache.wicket.markup.html.basic.Label;
11+
import org.geoserver.platform.GeoServerExtensions;
12+
import org.geoserver.security.GeoServerSecurityManager;
1013
import org.geotools.util.factory.GeoTools;
1114

1215
/**
@@ -16,11 +19,28 @@
1619
*/
1720
public class AboutGeoServerPage extends GeoServerBasePage {
1821

22+
GeoServerSecurityManager getManager() {
23+
return GeoServerExtensions.bean(GeoServerSecurityManager.class);
24+
}
25+
1926
public AboutGeoServerPage() {
20-
add(new Label("geotoolsVersion", GeoTools.getVersion().toString()));
21-
add(new Label("geotoolsRevision", GeoTools.getBuildRevision()));
22-
add(new Label("geowebcacheVersion", getGwcVersion()));
23-
add(new Label("geowebcacheRevision", getGwcRevision()));
27+
// hide info based on if the user is admin or not
28+
var privateInfo = new WebMarkupContainer("privateInfo");
29+
add(privateInfo);
30+
31+
var isAdmin = getManager().checkAuthenticationForAdminRole();
32+
if (isAdmin) {
33+
privateInfo.add(new Label("geotoolsVersion", GeoTools.getVersion().toString()));
34+
privateInfo.add(new Label("geotoolsRevision", GeoTools.getBuildRevision()));
35+
privateInfo.add(new Label("geowebcacheVersion", getGwcVersion()));
36+
privateInfo.add(new Label("geowebcacheRevision", getGwcRevision()));
37+
} else {
38+
add(new Label("geotoolsVersion", GeoTools.getVersion().toString()));
39+
add(new Label("geotoolsRevision", GeoTools.getBuildRevision()));
40+
add(new Label("geowebcacheVersion", getGwcVersion()));
41+
add(new Label("geowebcacheRevision", getGwcRevision()));
42+
privateInfo.setVisible(false);
43+
}
2444
}
2545

2646
public String getGwcVersion() {

‎src/web/core/src/test/java/org/geoserver/web/GeoServerAboutPageTest.java

+22
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
import static org.hamcrest.CoreMatchers.instanceOf;
88
import static org.hamcrest.MatcherAssert.assertThat;
99
import static org.junit.Assert.assertEquals;
10+
import static org.junit.Assert.assertFalse;
11+
import static org.junit.Assert.assertTrue;
1012

1113
import org.apache.wicket.util.tester.TagTester;
1214
import org.junit.Test;
@@ -26,4 +28,24 @@ public void testLoginFormAction() throws Exception {
2628
"http://localhost/context/j_spring_security_check",
2729
tagTester.getAttribute("action"));
2830
}
31+
32+
/**
33+
* The About page should hide the sensitive information (like version info, etc...). This test:
34+
* gets the page as a non-admin -> version info should NOT be there gets the page as ADMIN ->
35+
* version info SHOULD be there
36+
*/
37+
@Test
38+
public void testHideSensitiveInfo() throws Exception {
39+
logout();
40+
tester.executeUrl("./wicket/bookmarkable/org.geoserver.web.AboutGeoServerPage");
41+
42+
String responseTxt = tester.getLastResponse().getDocument();
43+
assertFalse(responseTxt.contains("geotoolsInfo"));
44+
45+
login();
46+
tester.executeUrl("./wicket/bookmarkable/org.geoserver.web.AboutGeoServerPage");
47+
48+
responseTxt = tester.getLastResponse().getDocument();
49+
assertTrue(responseTxt.contains("geotoolsInfo"));
50+
}
2951
}

0 commit comments

Comments
 (0)