    001/*
    002 * Copyright 2025 The Apache Software Foundation.
    003 *
    004 * Licensed under the Apache License, Version 2.0 (the "License");
    005 * you may not use this file except in compliance with the License.
    006 * You may obtain a copy of the License at
    007 *
    008 *      http://www.apache.org/licenses/LICENSE-2.0
    009 *
    010 * Unless required by applicable law or agreed to in writing, software
    011 * distributed under the License is distributed on an "AS IS" BASIS,
    012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    013 * See the License for the specific language governing permissions and
    014 * limitations under the License.
    015 */
    016package org.apache.wiki.auth;
    017
    018import jakarta.mail.MessagingException;
    019import jakarta.mail.event.MailEvent;
    020import java.util.logging.Level;
    021import org.apache.commons.validator.routines.EmailValidator;
    022import org.apache.logging.log4j.LogManager;
    023import org.apache.logging.log4j.Logger;
    024import org.apache.wiki.WikiSession;
    025import org.apache.wiki.api.core.Context;
    026import org.apache.wiki.api.core.Engine;
    027import org.apache.wiki.api.core.Session;
    028import org.apache.wiki.util.MailUtil;
    029
    030/**
    031 *
    032 * @since 3.0.0
    033 */
    034public class SecurityVerificationUtility {
    035
    036    private static final Logger LOG = LogManager.getLogger(SecurityVerificationUtility.class);
    037
    038    public void verify(Engine wiki) {
    039        //Context wikiContext = Wiki.context().create(wiki, request, ContextEnum.PAGE_NONE.getRequestContext());
    040
    041
    042        Session m_session = WikiSession.guestSession(wiki);
    043        new SecurityVerifier(wiki, m_session);
    044        StringBuilder sb = new StringBuilder();
    045        String[] messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_JAAS);
    046        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_JAAS);
    047
    048        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_JAAS);
    049        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_JAAS);
    050
    051        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_POLICY);
    052        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_POLICY);
    053
    054        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_POLICY);
    055        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_POLICY);
    056
    057        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_DB);
    058        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_DB);
    059
    060        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_DB);
    061        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_DB);
    062
    063        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_GROUPS);
    064        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_GROUPS);
    065
    066        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_GROUPS);
    067        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_GROUPS);
    068
    069        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_ROLES);
    070        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_ROLES);
    071
    072        if (sb.length() > 0) {
    073            //uh oh
    074            LOG.warn("The following errors/warnings were found when verifying the security profile of this server. You might want to look at this. " + sb.toString());
    075            //TODO dispatch an email to the sysadmins
    076            if ("true".equalsIgnoreCase(wiki.getWikiProperties().getProperty("jspwiki.securitycheck.enableEmailOfBootCheck", "false"))) {
    077                String addresses = wiki.getWikiProperties().getProperty("jspwiki.securitycheck.destination", "");
    078                if (addresses != null && addresses.length() > 0) {
    079                    String[] addresslist = addresses.split("\\;");
    080                    for (String addr : addresslist) {
    081                        try {
    082                            MailUtil.sendMessage(wiki.getWikiProperties(), addr, "JSPWIki Security Check", sb.toString());
    083                        } catch (MessagingException ex) {
    084                            LOG.warn("send mail failed to " + addr + " " + ex.getMessage(), ex);
    085                        }
    086                    }
    087                }
    088            }
    089        }
    090    }
    091
    092    private void apply(StringBuilder sb, String[] messages, String category) {
    093        if (messages == null) {
    094            return;
    095        }
    096        for (String s : messages) {
    097            sb.append(category).append(",").append(s).append("\n");
    098        }
    099    }
    100}