public @ResponseBody String processSubmit(@PathVariable("appId") int appId,
@PathVariable("orgId") int orgId,
@Valid @ModelAttribute Application application,
BindingResult result, Model model) throws IOException {
ObjectWriter writer = ControllerUtils.getObjectWriter(AllViews.FormInfo.class);
if (!PermissionUtils.isAuthorized(Permission.CAN_MANAGE_APPLICATIONS, orgId, appId)) {
return writer.writeValueAsString(RestResponse.failure("You don't have permission."));
}
Application databaseApplication = applicationService.loadApplication(appId);
if (databaseApplication == null || !databaseApplication.isActive()) {
log.warn(ResourceNotFoundException.getLogMessage("Application", appId));
throw new ResourceNotFoundException();
}
// These should not be editable in this method.
// TODO split into 3 controllers and use setAllowedFields
application.setWaf(databaseApplication.getWaf());
application.setDefectTracker(databaseApplication.getDefectTracker());
application.setUserName(databaseApplication.getUserName());
application.setPassword(databaseApplication.getPassword());
if(!result.hasErrors()) {
applicationService.validateAfterEdit(application, result);
}
if (application.getName() != null && application.getName().trim().equals("")
&& !result.hasFieldErrors("name")) {
result.rejectValue("name", null, null, "This field cannot be blank");
}
if (result.hasErrors()) {
PermissionUtils.addPermissions(model, orgId, appId, Permission.CAN_MANAGE_DEFECT_TRACKERS,
Permission.CAN_MANAGE_WAFS);
if (application.getWaf() != null && application.getWaf().getId() == null) {
application.setWaf(null);
}
if (application.getDefectTracker() != null &&
application.getDefectTracker().getId() == null) {
application.setDefectTracker(null);
}
return writer.writeValueAsString(FormRestResponse.failure("Errors", result));
} else {
application.setOrganization(organizationService.loadById(application.getOrganization().getId()));
applicationService.storeApplication(application);
vulnerabilityService.updateOrgsVulnerabilityReport();
String user = SecurityContextHolder.getContext().getAuthentication().getName();
log.debug("The Application " + application.getName() + " (id=" + application.getId() + ") has been edited by user " + user);
return writer.writeValueAsString(RestResponse.success(application));
}
}