001/*
002 * Copyright 2025 The Apache Software Foundation.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 *      http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 */
016package org.apache.wiki.auth;
017
018import jakarta.mail.MessagingException;
019import jakarta.mail.event.MailEvent;
020import java.util.logging.Level;
021import org.apache.commons.validator.routines.EmailValidator;
022import org.apache.logging.log4j.LogManager;
023import org.apache.logging.log4j.Logger;
024import org.apache.wiki.WikiSession;
025import org.apache.wiki.api.core.Context;
026import org.apache.wiki.api.core.Engine;
027import org.apache.wiki.api.core.Session;
028import org.apache.wiki.util.MailUtil;
029
030/**
031 *
032 * @since 3.0.0
033 */
034public class SecurityVerificationUtility {
035
036    private static final Logger LOG = LogManager.getLogger(SecurityVerificationUtility.class);
037
038    public void verify(Engine wiki) {
039        //Context wikiContext = Wiki.context().create(wiki, request, ContextEnum.PAGE_NONE.getRequestContext());
040        
041
042        Session m_session = WikiSession.guestSession(wiki);
043        new SecurityVerifier(wiki, m_session);
044        StringBuilder sb = new StringBuilder();
045        String[] messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_JAAS);
046        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_JAAS);
047
048        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_JAAS);
049        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_JAAS);
050
051        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_POLICY);
052        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_POLICY);
053
054        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_POLICY);
055        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_POLICY);
056
057        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_DB);
058        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_DB);
059
060        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_DB);
061        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_DB);
062
063        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_GROUPS);
064        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_GROUPS);
065
066        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.WARNING_GROUPS);
067        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.WARNING_GROUPS);
068
069        messages = m_session.getMessages(org.apache.wiki.auth.SecurityVerifier.ERROR_ROLES);
070        apply(sb, messages, org.apache.wiki.auth.SecurityVerifier.ERROR_ROLES);
071
072        if (sb.length() > 0) {
073            //uh oh
074            LOG.warn("The following errors/warnings were found when verifying the security profile of this server. You might want to look at this. " + sb.toString());
075            //TODO dispatch an email to the sysadmins
076            if ("true".equalsIgnoreCase(wiki.getWikiProperties().getProperty("jspwiki.securitycheck.enableEmailOfBootCheck", "false"))) {
077                String addresses = wiki.getWikiProperties().getProperty("jspwiki.securitycheck.destination", "");
078                if (addresses != null && addresses.length() > 0) {
079                    String[] addresslist = addresses.split("\\;");
080                    for (String addr : addresslist) {
081                        try {
082                            MailUtil.sendMessage(wiki.getWikiProperties(), addr, "JSPWIki Security Check", sb.toString());
083                        } catch (MessagingException ex) {
084                            LOG.warn("send mail failed to " + addr + " " + ex.getMessage(), ex);
085                        }
086                    }
087                }
088            }
089        }
090    }
091
092    private void apply(StringBuilder sb, String[] messages, String category) {
093        if (messages == null) {
094            return;
095        }
096        for (String s : messages) {
097            sb.append(category).append(",").append(s).append("\n");
098        }
099    }
100}