public void updatePassword(Password updatePassword)
{
LOG.debug("updating password");
Date now = new Date();
String action = "update password";
User loggedInUser = getLoggedInUser();
Password password = passwordDAO.findAllowedPasswordById(updatePassword.getId(), loggedInUser, AccessLevel.WRITE);
if (password != null)
{
if (updatePassword.getPermissions().size() > 0)
{
String passwordMessage = (updatePassword.getName().equals(password.getName())) ? "" : ("was: "+passwordTarget(password));
// update simple fields
password.setName(updatePassword.getName());
password.setUsername(updatePassword.getUsername());
password.setNotes(updatePassword.getNotes());
password.setDateLastUpdate(now);
password.setUserLastUpdate(loggedInUser);
password.setActive(updatePassword.isActive());
password.setMaxHistory(updatePassword.getMaxHistory());
// update tags
password.removeTags();
for (Tag tag : updatePassword.getTags())
{
Tag pTag = tagDAO.findTagByName(tag.getName());
if (null != pTag)
{
password.addTag(pTag);
}
else
{
password.addTag(tag);
}
}
// update password data, push others back in history if applicable
PasswordData updatePasswordData = updatePassword.getCurrentPasswordData();
String updatePasswordVal = updatePasswordData.getPassword();
// if user entered a password value and its not the same as the current one...
if (!"".equals(updatePasswordVal))
{
String currentPasswordVal = encryptor.decrypt(password.getCurrentPasswordData().getPassword());
if (!updatePasswordVal.equals(currentPasswordVal))
{
updatePasswordData.setUserCreated(loggedInUser);
updatePasswordData.setDateCreated(now);
updatePasswordData.setPassword(encryptor.encrypt(updatePasswordVal));
password.addPasswordData(updatePasswordData);
}
}
// trim history if not infinite
password.pruneDataHistory();
// update permissions if allowed to grant
if (passwordDAO.findAllowedPasswordById(updatePassword.getId(), loggedInUser, AccessLevel.GRANT) != null)
{
// keep the permissions that haven't changed
password.getPermissions().retainAll(updatePassword.getPermissions());
// add the permissions that have changed
for (Permission permission : updatePassword.getPermissions())
{
if (permission.getId() == 0)
{
password.addPermission(permission);
}
}
}
else
{
LOG.debug("no access to grant permissions");
}
auditLogger.log(now, loggedInUser.getUsername(), ServerSessionUtil.getIP(), action, passwordTarget(updatePassword), true, passwordMessage);
}
else
{
auditLogger.log(now, loggedInUser.getUsername(), ServerSessionUtil.getIP(), action, passwordTarget(updatePassword), false, "missing permissions");
throw new RuntimeException("Missing Permissions");
}
}
else
{
auditLogger.log(now, loggedInUser.getUsername(), ServerSessionUtil.getIP(), action, passwordTarget(updatePassword), false, "write access denied");
}
}