Revize 36927924

SaveDiagram and RemoveDiagram servlets validate diagram_id parameter for both null and empty string

sources/src/main/java/cz/zcu/kiv/offscreen/servlets/api/RemoveDiagram.java

@@ -1 +1 @@
 package cz.zcu.kiv.offscreen.servlets.api;
 
+import com.google.common.base.Strings;
 import cz.zcu.kiv.offscreen.servlets.BaseServlet;
 import cz.zcu.kiv.offscreen.user.DB;
 import cz.zcu.kiv.offscreen.user.Diagram;
@@ -17 +18 @@
             return;
         }
 
-        if (request.getParameter("diagram_id") == null) {
+        int loggedUserId = getUserId(request);
+
+        String diagramId = request.getParameter("diagram_id");
+
+        if (Strings.isNullOrEmpty(diagramId)) {
             response.sendError(HttpServletResponse.SC_BAD_REQUEST);
             return;
         }
 
-        int loggedUserId = getUserId(request);
-
-        Integer diagramId = Integer.parseInt(request.getParameter("diagram_id"));
         DB db = new DB(getServletContext());
-        Diagram diagram = new Diagram(db, diagramId);
+        Diagram diagram = new Diagram(db, Integer.parseInt(diagramId));
 
         if (diagram.getUserId() != loggedUserId) {
             response.sendError(HttpServletResponse.SC_UNAUTHORIZED);

sources/src/main/java/cz/zcu/kiv/offscreen/servlets/api/SaveDiagram.java

@@ -21 +21 @@
             return;
         }
 
+        request.setCharacterEncoding("UTF-8");
+
         int loggedUserId = getUserId(request);
 
-        request.setCharacterEncoding("UTF-8");
+        String diagramId = request.getParameter("diagram_id");
         String name = request.getParameter("name");
         String graphJson = request.getParameter("graph_json");
         String isPublic = StringUtils.defaultIfBlank(request.getParameter("public"), "0");
@@ -37 +39 @@
         DB db = new DB(getServletContext());
         Diagram diagram;
 
-        if (request.getParameter("diagram_id") == null) {
+        if (Strings.isNullOrEmpty(diagramId)) {
             // new diagram
             diagram = new Diagram(db);
 
         } else {
             // diagram exists
-            Integer diagramId = Integer.parseInt(request.getParameter("diagram_id"));
-            diagram = new Diagram(db, diagramId);
+            diagram = new Diagram(db, Integer.parseInt(diagramId));
 
             // user is not owner of the diagram
             if (loggedUserId != diagram.getUserId()) {