From df529650d03296bf03ade8c0eed4a2fcc404a041 Mon Sep 17 00:00:00 2001
From: Ugnich Anton
Date: Fri, 21 Jun 2013 00:16:11 +0700
Subject: Bugfix

---
 src/java/com/juick/api/Main.java  |  2 +-
 src/java/com/juick/api/Users.java | 36 ++++++++++++++++++++++--------------
 src/java/com/juick/api/Utils.java |  2 +-
 3 files changed, 24 insertions(+), 16 deletions(-)

(limited to 'src')

diff --git a/src/java/com/juick/api/Main.java b/src/java/com/juick/api/Main.java
index d32a00aa..ebbeb103 100644
--- a/src/java/com/juick/api/Main.java
+++ b/src/java/com/juick/api/Main.java
@@ -125,7 +125,7 @@ public class Main extends HttpServlet {
         response.setHeader("Access-Control-Allow-Origin", "*");
 
         String callback = request.getParameter("callback");
-        if (callback.length() > 64 || !callback.matches("a-zA-Z0-9\\-")) {
+        if (callback != null && (callback.length() > 64 || !callback.matches("[a-zA-Z0-9\\-]+"))) {
             callback = null;
         }
 
diff --git a/src/java/com/juick/api/Users.java b/src/java/com/juick/api/Users.java
index 5810ddba..2c60a95f 100644
--- a/src/java/com/juick/api/Users.java
+++ b/src/java/com/juick/api/Users.java
@@ -21,17 +21,21 @@ public class Users {
     }
 
     public void doGetUserRead(HttpServletRequest request, HttpServletResponse response, int vuid) throws ServletException, IOException {
-        int uid = vuid;
-        String paramUID = request.getParameter("user_id");
-        if (paramUID != null) {
-            try {
-                uid = Integer.parseInt(paramUID);
-            } catch (NumberFormatException e) {
+        int uid = 0;
+        String uname = request.getParameter("uname");
+        if (uname == null) {
+            uid = vuid;
+        } else {
+            if (UserQueries.checkUserNameValid(uname)) {
+                com.juick.User u = UserQueries.getUserByNick(sql, uname);
+                if (u != null && u.UID > 0) {
+                    uid = u.UID;
+                }
             }
         }
 
         if (uid > 0) {
-            ArrayList<Integer> uids = UserQueries.getUserRead(sql, vuid);
+            ArrayList<Integer> uids = UserQueries.getUserRead(sql, uid);
             if (uids.size() > 0) {
                 ArrayList<com.juick.User> users = UserQueries.getUsersByID(sql, uids);
                 if (users.size() > 0) {
@@ -45,17 +49,21 @@ public class Users {
     }
 
     public void doGetUserReaders(HttpServletRequest request, HttpServletResponse response, int vuid) throws ServletException, IOException {
-        int uid = vuid;
-        String paramUID = request.getParameter("user_id");
-        if (paramUID != null) {
-            try {
-                uid = Integer.parseInt(paramUID);
-            } catch (NumberFormatException e) {
+        int uid = 0;
+        String uname = request.getParameter("uname");
+        if (uname == null) {
+            uid = vuid;
+        } else {
+            if (UserQueries.checkUserNameValid(uname)) {
+                com.juick.User u = UserQueries.getUserByNick(sql, uname);
+                if (u != null && u.UID > 0) {
+                    uid = u.UID;
+                }
             }
         }
 
         if (uid > 0) {
-            ArrayList<Integer> uids = UserQueries.getUserReaders(sql, vuid);
+            ArrayList<Integer> uids = UserQueries.getUserReaders(sql, uid);
             if (uids.size() > 0) {
                 ArrayList<com.juick.User> users = UserQueries.getUsersByID(sql, uids);
                 if (users.size() > 0) {
diff --git a/src/java/com/juick/api/Utils.java b/src/java/com/juick/api/Utils.java
index b325b19a..cac5612d 100644
--- a/src/java/com/juick/api/Utils.java
+++ b/src/java/com/juick/api/Utils.java
@@ -75,7 +75,7 @@ public class Utils {
             try {
                 BASE64Decoder dec = new BASE64Decoder();
                 String loginpassw[] = new String(dec.decodeBuffer(auth.substring(6))).split(":", 2);
-                if (loginpassw.length == 2 && loginpassw[0].length() > 1 && loginpassw[0].length() < 16 && loginpassw[0].matches("a-zA-Z0-9\\-") && !loginpassw[1].isEmpty()) {
+                if (loginpassw.length == 2 && loginpassw[0].length() > 1 && loginpassw[0].length() < 16 && loginpassw[0].matches("[a-zA-Z0-9\\-]+") && !loginpassw[1].isEmpty()) {
                     return UserQueries.checkPassword(sql, loginpassw[0], loginpassw[1]);
                 }
             } catch (IOException e) {
-- 
cgit v1.2.3