Hotfix 20170728

stack/config/src/main/resources/usergrid-default.properties

@@ -750,6 +750,7 @@ usergrid.api.url.base=http://localhost:8080/ROOT
 # instead, use character class ([.] instead of backslash-period)
 usergrid.org.config.property.regex=usergrid[.]view[.].*
 
+usergrid.viewable.loginEndpoint=http://localhost:8080
 
 
 ###########################  Usergrid Email Templates  ########################

stack/core/src/main/java/org/apache/usergrid/corepersistence/CpSetup.java

@@ -76,12 +76,18 @@ public CpSetup( final EntityManagerFactory emf,
 
     @Override
     public void initSchema() throws Exception {
+        initSchema(false);
+    }
+
+
+    @Override
+    public void initSchema(boolean dropKeyspace) throws Exception {
 
         // Initialize the management app index in Elasticsearch
         this.emf.initializeManagementIndex();
 
         // Create the schema (including keyspace) in Cassandra
-        setupSchema();
+        setupSchema(dropKeyspace);
         setupLegacySchema();
 
     }
@@ -138,11 +144,11 @@ private void setupLegacySchema() throws Exception {
      *
      */
 
-    private void setupSchema() throws Exception {
+    private void setupSchema(boolean dropKeyspace) throws Exception {
 
         MigrationManager m = injector.getInstance( MigrationManager.class );
         try {
-            m.migrate();
+            m.migrate(dropKeyspace);
         }
         catch ( MigrationException ex ) {
             throw new RuntimeException( "Error migrating Core Persistence", ex );

stack/core/src/main/java/org/apache/usergrid/persistence/cassandra/Setup.java

@@ -25,6 +25,14 @@ public interface Setup {
     void initSchema() throws Exception;
 
 
+    /**
+     * Initialize all configuration for the system setup. Creates keyspaces and elasticsearch indexes,
+     * dropping keyspaces first if requested
+     * @throws Exception
+     */
+    void initSchema(boolean dropKeyspace) throws Exception;
+
+
     /**
      * Bootstrap the root application to allow the system to function.
      * @throws Exception

stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java

@@ -50,8 +50,14 @@ public CoreSchemaManager( final Setup setup, final Cluster cluster, Injector inj
 
     @Override
     public void create() {
+        create(false);
+    }
+
+
+    @Override
+    public void create(boolean dropKeyspace) {
         try {
-            setup.initSchema();
+            setup.initSchema(dropKeyspace);
             lockManager.setup();
         }
         catch ( Exception ex ) {
@@ -81,24 +87,7 @@ public void populateBaseData() {
 
     @Override
     public void destroy() {
-        logger.info( "dropping keyspaces" );
-        try {
-            cluster.dropKeyspace( CassandraService.getApplicationKeyspace() );
-        }
-        catch ( RuntimeException ire ) {
-            //swallow if it just doesn't exist
-        }
-
-
-        try {
-            cluster.dropKeyspace( CassandraService.getApplicationKeyspace() );
-        }
-        catch ( RuntimeException ire ) {
-            //swallow if it just doesn't exist
-        }
-
-        logger.info( "keyspaces dropped" );
-
+        logger.info( "keyspace dropping deferred" );
 
         final EsProvider provider =
             SpringResource.getInstance().getBean( Injector.class ).getInstance( EsProvider.class );

stack/core/src/test/resources/usergrid-custom-test.properties

@@ -14,7 +14,7 @@
 
 # these settings allow tests to run and consistently pass on 16GB MacBook Pro
 # with ug.heapmax=5000m and ug.heapmin=3000m (set in Maven settings.xml)
-cassandra.timeout=2000
+cassandra.timeout=20000
 cassandra.connections=1000
 
 

stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManager.java

@@ -31,4 +31,9 @@ public interface MigrationManager {
      * not exist
      */
     public void migrate() throws MigrationException;
+
+    /**
+     * Perform any migration necessary in the application.  Will drop keyspaces first if requested.
+     */
+    public void migrate(boolean dropKeyspace) throws MigrationException;
 }

stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java

@@ -68,11 +68,22 @@ public MigrationManagerImpl( final Keyspace keyspace, final Set<Migration> migra
 
     @Override
     public void migrate() throws MigrationException {
+        migrate(false);
+    }
+
+
+    @Override
+    public void migrate(boolean dropKeyspace) throws MigrationException {
 
 
         try {
 
-            testAndCreateKeyspace();
+            if (dropKeyspace) {
+                dropKeyspace();
+                createKeyspace();
+            } else {
+                testAndCreateKeyspace();
+            }
 
             for ( Migration migration : migrations ) {
 
@@ -120,6 +131,22 @@ private void testAndCreateColumnFamilyDef( MultiTenantColumnFamilyDefinition col
     }
 
 
+    /**
+     * Drop keyspace.
+     */
+    private void dropKeyspace() throws ConnectionException {
+        try {
+            keyspace.dropKeyspace();
+        }
+        catch (NotFoundException nfe) {
+            logger.info( "Received a NotFoundException when attempting to drop keyspace.  It does not exist" );
+        }
+        catch (ConnectionException e) {
+            logger.info( "Received a ConnectionException when attempting to drop keyspace: {}", e.getMessage());
+        }
+    }
+
+
     /**
      * Check if they keyspace exists.  If it doesn't create it
      */
@@ -137,6 +164,7 @@ private void testAndCreateKeyspace() throws ConnectionException {
             logger.info( "Received a NotFoundException when attempting to describe keyspace.  It does not exist" );
         }
         catch(Exception e){
+            logger.info("describeKeyspace exception: {}", e.getMessage());
             AstayanxUtils.isKeyspaceMissing("Unable to connect to cassandra", e);
         }
 
@@ -145,13 +173,20 @@ private void testAndCreateKeyspace() throws ConnectionException {
             return;
         }
 
+        createKeyspace();
 
+    }
+
+    /**
+     * Create keyspace, it must not exist (either have checked for it or dropped it).
+     */
+    private void createKeyspace() throws ConnectionException {
         ImmutableMap.Builder<String, Object> strategyOptions = getKeySpaceProps();
 
 
         ImmutableMap<String, Object> options =
-                ImmutableMap.<String, Object>builder().put( "strategy_class", fig.getStrategyClass() )
-                            .put( "strategy_options", strategyOptions.build() ).build();
+            ImmutableMap.<String, Object>builder().put( "strategy_class", fig.getStrategyClass() )
+                .put( "strategy_options", strategyOptions.build() ).build();
 
 
         keyspace.createKeyspace( options );

stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/util/AstayanxUtils.java

@@ -35,13 +35,10 @@ public static void isKeyspaceMissing(final String rethrowMessage,  final Excepti
 
         if ( cassandraException instanceof BadRequestException ) {
 
-            //check if it's b/c the keyspace is missing, if so
-            final String message = cassandraException.getMessage();
-
-            //no op, just swallow
-            if(message.contains( "why:Keyspace" ) && message.contains( "does not exist" )){
+            //check if it's b/c the keyspace is missing
+            if (((BadRequestException) cassandraException).isKeyspaceDoestNotExist()) {
                 return;
-            };
+            }
         }
 
        throw new RuntimeException( rethrowMessage, cassandraException );

stack/corepersistence/graph/src/test/resources/usergrid-UNIT.properties

@@ -5,7 +5,7 @@ cassandra.version=1.2
 cassandra.hosts=localhost
 cassandra.cluster_name=Usergrid
 collections.keyspace=Usergrid_Collections
-cassandra.timeout=2000
+cassandra.timeout=20000
 cassandra.embedded=true
 
 

stack/rest/src/main/java/org/apache/usergrid/rest/applications/users/UserResource.java

@@ -17,6 +17,7 @@
 package org.apache.usergrid.rest.applications.users;
 
 
+import java.util.Collection;
 import java.util.Map;
 import java.util.UUID;
 
@@ -465,6 +466,13 @@ public Viewable handlePasswordResetForm( @Context UriInfo ui, @FormParam("token"
             if ( ( password1 != null ) || ( password2 != null ) ) {
                 if ( management.checkPasswordResetTokenForAppUser( getApplicationId(), getUserUuid(), token ) ) {
                     if ( ( password1 != null ) && password1.equals( password2 ) ) {
+                        // validate password
+                        Collection<String> violations = management.passwordPolicyCheck(password1, false);
+                        if (violations.size() > 0) {
+                            // password not valid
+                            errorMsg = management.getPasswordDescription(false);
+                            return handleViewable( "resetpw_set_form", this, getOrganizationName() );
+                        }
                         management.setAppUserPassword( getApplicationId(), getUser().getUuid(), password1 );
                         management.revokeAccessTokenForAppUser( token );
                         return handleViewable( "resetpw_set_success", this, getOrganizationName() );

stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java

@@ -43,6 +43,7 @@
 import javax.ws.rs.core.Context;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.UriInfo;
+import java.util.Collection;
 import java.util.Map;
 import java.util.UUID;
 
@@ -66,6 +67,9 @@ public class UserResource extends AbstractContextResource {
 
     String token = null;
 
+    String loginEndpoint;
+
+
 
     public UserResource() {
     }
@@ -294,8 +298,17 @@ public Viewable handlePasswordResetForm( @Context UriInfo ui, @FormParam( "token
             if ( ( password1 != null ) || ( password2 != null ) ) {
                 if ( management.checkPasswordResetTokenForAdminUser( user.getUuid(), tokenInfo ) ) {
                     if ( ( password1 != null ) && password1.equals( password2 ) ) {
+                        // validate password
+                        Collection<String> violations = management.passwordPolicyCheck(password1, true);
+                        if (violations.size() > 0) {
+                            // password not valid
+                            errorMsg = management.getPasswordDescription(true);
+                            return handleViewable( "resetpw_set_form", this, organizationId );
+                        }
+
                         management.setAdminUserPassword( user.getUuid(), password1 );
                         management.revokeAccessTokenForAdminUser( user.getUuid(), token );
+                        loginEndpoint = properties.getProperty("usergrid.viewable.loginEndpoint");
                         return handleViewable( "resetpw_set_success", this, organizationId );
                     }
                     else {
@@ -342,6 +355,9 @@ public String getErrorMsg() {
         return errorMsg;
     }
 
+    public String getLoginEndpoint() {
+        return loginEndpoint;
+    }
 
     public String getToken() {
         return token;

stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/error.jsp

@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
+</html>

stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/test.jsp

@@ -1,5 +1,6 @@
 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
     pageEncoding="ISO-8859-1"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -24,6 +25,6 @@ limitations under the License.
 	<link rel="stylesheet" type="text/css" href="/css/styles.css" />
 </head>
 <body>
-<h1>${it.foo}</h1> 
+<h1>${fn:escapeXml(it.foo)}</h1>
 </body>
-</html>
+</html>

stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp

@@ -2,6 +2,7 @@
 	pageEncoding="ISO-8859-1"%>
 <%@ page import="org.apache.usergrid.rest.AbstractContextResource"%>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -28,13 +29,13 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${it.errorMsg}</div></c:if>
+		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
-			<input type="hidden" name="response_type" value="${it.responseType}">
-			<input type="hidden" name="client_id" value="${it.clientId}">
-			<input type="hidden" name="redirect_uri" value="${it.redirectUri}">
-			<input type="hidden" name="scope" value="${it.scope}">
-			<input type="hidden" name="state" value="${it.state}">
+			<input type="hidden" name="response_type" value="${fn:escapeXml(it.responseType)}">
+			<input type="hidden" name="client_id" value="${fn:escapeXml(it.clientId)}">
+			<input type="hidden" name="redirect_uri" value="${fn:escapeXml(it.redirectUri)}">
+			<input type="hidden" name="scope" value="${fn:escapeXml(it.scope)}">
+			<input type="hidden" name="state" value="${fn:escapeXml(it.state)}">
 			<fieldset>
 				<p>
 					<label for="username">Username</label>
@@ -56,4 +57,4 @@ limitations under the License.
 	</div>
 
 </body>
-</html>
+</html>

stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/error.jsp

@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
+</html>

stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/activate.jsp

@@ -26,7 +26,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your account with email address <c:out value="${it.user.email}"/> has been successfully activated.</p>
+	<p>Your account with email address <c:out value="${it.user.email}" escapeXml="true"/> has been successfully activated.</p>
 
 </body>
-</html>
+</html>

stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/confirm.jsp

@@ -26,8 +26,8 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your account with email address <c:out value="${it.user.email}"/> has been successfully confirmed.
+	<p>Your account with email address <c:out value="${it.user.email}" escapeXml="true"/> has been successfully confirmed.
 	You will received an email soon to let you know when you account has been activated</p>
 
 </body>
-</html>
+</html>

stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/error.jsp

@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
+</html>