CSRF 추가 확장 적용

src/main/java/nlib/cmm/NlibCommonController.java

@@ -334,6 +334,22 @@ public class NlibCommonController {
 		return redirectAttrs;
 	}
 	
+
+	public String addParamsToUrl(String url, String paramName, String paramValue) {
+		
+		if(StringUtil.isEmpty(url)) return null;
+		if(StringUtil.isEmpty(paramName)) return url;
+		
+		String newUrl = url;
+		
+		if(url.contains("?")) newUrl += "&";
+		else newUrl += "?";
+		
+		newUrl += paramName + "=" + StringUtil.getString(paramValue, "").trim();
+			
+		return newUrl;
+	}
+
 	/**
 	 * paramMap에 이전 요청에서 전달할 때 추가한 POST방식의 매개변수값을 paramMap에 추가한다.
 	 *  

src/main/java/nlib/col/web/CartController.java

@@ -117,6 +117,10 @@ public class CartController extends NlibCommonController
 			message = StringUtil.decodeUrl(message);
 		}
 		
+		// CSRF 토큰 생성
+		String token = generateCsrfToken(request);
+		model.addAttribute("csrfToken", token);
+		
 		model.addAttribute("cartTypeCd1Cnt", cartTypeCd1Cnt);
 		model.addAttribute("cartTypeCd2Cnt", cartTypeCd2Cnt);
 		

src/main/java/nlib/col/web/ReadController.java

@@ -70,7 +70,7 @@ public class ReadController extends NlibCommonController {
      */
 	@Secured("ROLE_USER")
     @RequestMapping(value={"/read/confirmReadFromCart.do", "/read/confirmRead.do"})
-    public String confirmRent(HttpServletRequest request, CollectionVO readVO, String csrfToken, ModelMap model) throws Exception {
+    public String confirmRead(HttpServletRequest request, CollectionVO readVO, String csrfToken, String fromPage, ModelMap model) throws Exception {
     	
     	String retJsp = "nlib/read/confirmRead";
     	boolean fromCart = request.getServletPath().contains("Cart.do");
@@ -82,17 +82,26 @@ public class ReadController extends NlibCommonController {
     		return retJsp;
     	}
     	
-    	if(!fromCart && !isValidCsrfToken(request, csrfToken)) {
+    	if(!isValidCsrfToken(request, csrfToken)) {
-    		model.addAttribute("message", "잘못된 접근입니다.");
+    		if(fromCart && StringUtil.getString(fromPage, "").equalsIgnoreCase("login")) {
-    		return retJsp;
+    			// 비로그인자의 카트에서 신청을 실행하여 로그인 후 신청 진입으로 돌아온 경우 
+    			return "redirect:/cart/listCartItems.do?cartTypeCd=2";
+    		} else {
+        		model.addAttribute("message", "잘못된 접근입니다.");
+        		return retJsp;
+    		}
     	}
     	
     	if(readVO == null || StringUtil.isEmpty(readVO.getSelItems())) {
-    		model.addAttribute("message", "대출(예약)신청할 정보가 없습니다.");
+    		if(fromCart && StringUtil.getString(fromPage, "").equalsIgnoreCase("login")) {
-    		return retJsp;
+    			// 비로그인자의 카트에서 신청을 실행하여 로그인 후 신청 진입으로 돌아온 경우 
+    			return "redirect:/cart/listCartItems.do";
+    		} else {
+        		model.addAttribute("message", "신청할 정보가 없습니다.");
+        		return "nlib/read/confirmRead";
+    		}    		
     	}
     	
-    	
 		String selItems = readVO.getSelItems();
 		
 		List<CollectionVO> list = collectionService.makeInfoListOfCollectionVO(selItems, mbInfoId);
@@ -103,6 +112,10 @@ public class ReadController extends NlibCommonController {
 			readVO.setMngOrgNm(list.get(0).getMngOrgNm());
 		}
 		
+		// CSRF 토큰 생성
+		String token = generateCsrfToken(request);
+		model.addAttribute("csrfToken", token);
+				
 		model.addAttribute("readVO", readVO);
     	model.addAttribute("list", list);
     	model.addAttribute("listDates", listDates);
@@ -122,7 +135,7 @@ public class ReadController extends NlibCommonController {
      */
 	@Secured("ROLE_USER")
     @RequestMapping(value={"/read/insertReadItemsFromCart.do", "/read/insertReadItems.do"})
-    public String insertReadItems(HttpServletRequest request, CollectionVO readVO, ModelMap model) throws Exception {
+    public String insertReadItems(HttpServletRequest request, CollectionVO readVO, String csrfToken, ModelMap model) throws Exception {
     	
     	boolean fromCart = request.getServletPath().contains("Cart.do");
     	String retJsp = "nlib/read/insertReadItems";
@@ -133,6 +146,11 @@ public class ReadController extends NlibCommonController {
     		return retJsp;
     	}
     	
+    	if(!isValidCsrfToken(request, csrfToken)) {
+    		model.addAttribute("message", "잘못된 접근입니다.");
+    		return retJsp;
+    	}
+    	
     	if(readVO == null || StringUtil.isEmpty(readVO.getSelItems())) {
     		model.addAttribute("message", "대출(예약)신청할 정보가 없습니다.");
     		return retJsp;
@@ -196,6 +214,10 @@ public class ReadController extends NlibCommonController {
     		return "nlib/read/listReadItems";
     	}
 
+		// CSRF 토큰 생성
+		String token = generateCsrfToken(request);
+		model.addAttribute("csrfToken", token);
+		
     	// 대출자료 문화원 목록 조회 
     	List<HashMap<String, String>> readMngOrgList = readService.listReadMngOrg(mbInfoId);
     	model.addAttribute("rentMngOrgList"  , readMngOrgList);
@@ -273,6 +295,7 @@ public class ReadController extends NlibCommonController {
 	@RequestMapping(value="/read/cancelReadItemAjax.do")
 	public ResponseEntity<String> cancelReadItemAjax (
 			HttpServletRequest request,
+			String csrfToken,
 			@RequestBody CollectionVO searchVO)  {
 	
 		String resultMessage = null;
@@ -284,6 +307,10 @@ public class ReadController extends NlibCommonController {
     		resultMessage = "로그인하신 후, 이용바랍니다.";
     	}
     	
+    	if(!isValidCsrfToken(request, csrfToken)) {
+    		resultMessage = "잘못된 접근입니다.";
+    	}
+    	
     	if(resultMessage != null && StringUtil.isEmpty(searchVO.getMngOrgCd())) {
     		resultMessage = "문화원정보가 부적합합니다. 다시 요청하여 주시기 바랍니다.";
     	}

src/main/java/nlib/col/web/RentController.java

@@ -98,6 +98,10 @@ public class RentController extends NlibCommonController
     	List<HashMap<String, String>> rentMngOrgList = rentService.listRentMngOrg(mbInfoId);
     	model.addAttribute("rentMngOrgList"  , rentMngOrgList);
     	
+    	// CSRF 토큰 생성
+    	String token = generateCsrfToken(request);
+    	model.addAttribute("csrfToken", token);
+    			
     	model.addAttribute("bookLtRvStatusCd", StringUtil.getString(searchVO.getBookLtRvStatusCd(), "A"));
     	model.addAttribute("pageSize"        , searchVO.getPageSize());
     	model.addAttribute("pageIndex"       , searchVO.getPageIndex());
@@ -171,6 +175,7 @@ public class RentController extends NlibCommonController
 	@RequestMapping(value="/rent/cancelRentItemAjax.do")
 	public ResponseEntity<String> cancelRentItemAjax(
 			HttpServletRequest request,
+			String csrfToken,
 			@RequestBody CollectionVO searchVO)  {
 	
 		String resultMessage = null;
@@ -182,6 +187,10 @@ public class RentController extends NlibCommonController
     		resultMessage = "로그인하신 후, 이용바랍니다.";
     	}
 
+    	if(!isValidCsrfToken(request, csrfToken)) {
+    		resultMessage = "잘못된 접근입니다.";
+    	}
+    	
     	if(StringUtil.isEmpty(searchVO.getMngOrgCd())) {
     		resultMessage = "문화원정보가 부적합합니다. 다시 요청하여 주시기 바랍니다.";
     	}
@@ -218,7 +227,7 @@ public class RentController extends NlibCommonController
 	
 	@Secured("ROLE_USER")
     @RequestMapping(value={"/rent/confirmRentFromCart.do", "/rent/confirmRent.do"})
-    public String confirmRent(HttpServletRequest request, CollectionVO rentVO, ModelMap model, String csrfToken) throws Exception {
+    public String confirmRent(HttpServletRequest request, CollectionVO rentVO, ModelMap model, String csrfToken, String fromPage) throws Exception {
     	
     	boolean fromCart = request.getServletPath().contains("Cart.do");
     	
@@ -229,14 +238,24 @@ public class RentController extends NlibCommonController
     		return "nlib/rent/confirmRent";
     	}
     	
-    	if(!fromCart && !isValidCsrfToken(request, csrfToken)) {
+    	if(!isValidCsrfToken(request, csrfToken)) {
-    		model.addAttribute("message", "잘못된 접근입니다.");
+    		if(fromCart && StringUtil.getString(fromPage, "").equalsIgnoreCase("login")) {
-    		return "nlib/rent/confirmRent";
+    			// 비로그인자의 카트에서 신청을 실행하여 로그인 후 신청 진입으로 돌아온 경우 
+    			return "redirect:/cart/listCartItems.do";
+    		} else {
+        		model.addAttribute("message", "잘못된 접근입니다.");
+        		return "nlib/rent/confirmRent";
+    		}
     	}
     	
     	if(rentVO == null || StringUtil.isEmpty(rentVO.getSelItems())) {
-    		model.addAttribute("message", "대출(예약)신청할 정보가 없습니다.");
+    		if(fromCart && StringUtil.getString(fromPage, "").equalsIgnoreCase("login")) {
-    		return "nlib/rent/confirmRent";
+    			// 비로그인자의 카트에서 신청을 실행하여 로그인 후 신청 진입으로 돌아온 경우 
+    			return "redirect:/cart/listCartItems.do";
+    		} else {
+        		model.addAttribute("message", "대출(예약)신청할 정보가 없습니다.");
+        		return "nlib/rent/confirmRent";
+    		}
     	}
     	
 		String selItems = rentVO.getSelItems();
@@ -248,6 +267,10 @@ public class RentController extends NlibCommonController
 			rentVO.setMngOrgNm(list.get(0).getMngOrgNm());
 		}
 		
+		// CSRF 토큰 생성
+		String token = generateCsrfToken(request);
+		model.addAttribute("csrfToken", token);
+		
 		model.addAttribute("rentVO", rentVO);
     	model.addAttribute("list", list);
     	if(fromCart) model.addAttribute("fromCart", fromCart ? "Y" : "N");
@@ -257,7 +280,7 @@ public class RentController extends NlibCommonController
     
 	@Secured("ROLE_USER")
     @RequestMapping(value={"/rent/insertRentItemsFromCart.do", "/rent/insertRentItems.do"})
-    public String insertRentItems(HttpServletRequest request, CollectionVO rentVO, ModelMap model) throws Exception {
+    public String insertRentItems(HttpServletRequest request, CollectionVO rentVO, String csrfToken, ModelMap model) throws Exception {
     	
     	boolean fromCart = request.getServletPath().contains("Cart.do");
     	String retJsp = "nlib/rent/insertRentItems";
@@ -268,6 +291,11 @@ public class RentController extends NlibCommonController
     		return retJsp;
     	}
     	
+    	if(!isValidCsrfToken(request, csrfToken)) {
+    		model.addAttribute("message", "잘못된 접근입니다.");
+    		return retJsp;
+    	}
+    	
     	if(rentVO == null || StringUtil.isEmpty(rentVO.getSelItems())) {
     		model.addAttribute("message", "대출(예약)신청할 정보가 없습니다.");
     		return retJsp;

src/main/java/nlib/user/web/LoginController.java

@@ -535,7 +535,7 @@ public class LoginController extends NlibCommonController {
 			cartService.mergeCart(mbInfoId, request, response);
 			SessionConfig.removeLoginInfo(jsessionId);
 			// 세션에 설정된 redirect 주소 확인
-			return "redirect:" + councilReturnUrl;
+			return "redirect:" + addParamsToUrl(councilReturnUrl, "fromPage", "login");
 		}
 		
 		// 휴면계좌

src/main/webapp/WEB-INF/jsp/nlib/cart/listCartItems.jsp

@@ -184,52 +184,40 @@ function fn_changeCartItems(cartTypeCd, cartTypeNm) {
 // 대출신청으로 이동 
 function fn_appRent() {
     
-    <sec:authorize access="not isAuthenticated()">
+       if($("[id^=chk_item_]:checked").length < 1) {
-        alert("먼저 로그인하신 후, 이용해 주시기 바랍니다.");
+           alert("선택된 자료가 없습니다.");
-    </sec:authorize>
+           return;
+       }
        
-    <sec:authorize access="isAuthenticated()">
+       if(fn_verifyCheckedCartItems("ableRentNow") > 0) {
-        if($("[id^=chk_item_]:checked").length < 1) {
+       	alert("대출신청/예약불가 상태의 자료가 포함되어 있습니다.")
-            alert("선택된 자료가 없습니다.");
+       	return;
-            return;
+       };
-        }
        
-        if(fn_verifyCheckedCartItems("ableRentNow") > 0) {
+       $("#selItems").val(fn_getCheckedCartItemsValues());
-        	alert("대출신청/예약불가 상태의 자료가 포함되어 있습니다.")
+       $("#frm").attr("action","${pageContext.request.contextPath}/rent/confirmRentFromCart.do");
-        	return;
-        };
        
-        $("#selItems").val(fn_getCheckedCartItemsValues());
+       $("#frm").submit();    
-        $("#frm").attr("action","${pageContext.request.contextPath}/rent/confirmRentFromCart.do");
-        
-        $("#frm").submit();    
-    </sec:authorize>
     
 }
 
 // 열람신청으로 이동 
 function fn_appRead() {
 
-    <sec:authorize access="not isAuthenticated()">
+       if($("[id^=chk_item_]:checked").length < 1) {
-        alert("먼저 로그인하신 후, 이용해 주시기 바랍니다.");
+           alert("방문열람할 대상을 선택해 주세요.");
-    </sec:authorize>
+           return;
+       }
 
-    <sec:authorize access="isAuthenticated()">
+       if(fn_verifyCheckedCartItems("ableReadNow") > 0) {
-        if($("[id^=chk_item_]:checked").length < 1) {
+           alert("신청불가 상태의 자료가 포함되어 있습니다.")
-            alert("방문열람할 대상을 선택해 주세요.");
+           return;
-            return;
+       };
-        }
        
-        if(fn_verifyCheckedCartItems("ableReadNow") > 0) {
+       $("#selItems").val(fn_getCheckedCartItemsValues());
-            alert("신청불가 상태의 자료가 포함되어 있습니다.")
+       $("#frm").attr("action","${pageContext.request.contextPath}/read/confirmReadFromCart.do");
-            return;
-        };
        
-        $("#selItems").val(fn_getCheckedCartItemsValues());
+       $("#frm").submit();    
-        $("#frm").attr("action","${pageContext.request.contextPath}/read/confirmReadFromCart.do");
-        
-        $("#frm").submit();    
-    </sec:authorize>
     
 }
 
@@ -262,6 +250,7 @@ $(document).ready(function() {
       <input type="hidden" id="mngOrgNm" name="mngOrgNm" value="${mngOrgNm }" />
       <input type="hidden" id="mngOrgCd" name="mngOrgCd" value="" />
       <input type="hidden" id="selItems" name="selItems" value="" />
+      <input type="hidden" id="csrfToken" name="csrfToken" value="${csrfToken }" />
       
     <!-- 카트 섹션 -->
     <section class="location cart">

src/main/webapp/WEB-INF/jsp/nlib/read/confirmRead.jsp

@@ -167,6 +167,7 @@ $(document).ready(function() {
       <input type="hidden" id="cartTypeCd" name="cartTypeCd" value="${readVO.cartTypeCd }" />
       <input type="hidden" id="mngOrgCd" name="mngOrgCd" value="${readVO.mngOrgCd }" />
       <input type="hidden" id="mngOrgNm" name="mngOrgNm" value="${readVO.mngOrgNm }" />
+      <input type="hidden" id="csrfToken" name="csrfToken" value="${csrfToken }" />
       
     <!-- 카트 섹션 -->
     <section class="location cart cart-confirm">

src/main/webapp/WEB-INF/jsp/nlib/read/listReadItems.jsp

@@ -184,7 +184,7 @@ function fn_search(reqStatusDivCd) {
 	 
 	 if(!confirm(title + " 방문열람을 취소하시겠습니까?")) return;
 	 
-     var reqUrl = "${pageContext.request.contextPath}/read/cancelReadItemAjax.do";
+     var reqUrl = "${pageContext.request.contextPath}/read/cancelReadItemAjax.do?csrfToken=" + $("#csrfToken").val();
      
      var inputData = {
                "mngOrgCd" : mngOrgCd
@@ -245,9 +245,10 @@ function fn_search(reqStatusDivCd) {
                 <div class="list-box visit-box">
                     <form name="frm" id="frm" method="post">
                     <input type="hidden" name="reqStatusDivCd" id="reqStatusDivCd" value="${reqStatusDivCd }" />
-                    <input type="hidden" name="pageIndex" id="pageIndex" title="페이지번호" value="${pageIndex }" />
+                    <input type="hidden" name="pageIndex" id="pageIndex" value="${pageIndex }" />
-                    <input type="hidden" name="pageSize" id="pageSize" title="페이지크기" value="${pageSize }" />
+                    <input type="hidden" name="pageSize" id="pageSize" value="${pageSize }" />
-                    <input type="hidden" name="masterId" id="masterId" title="페이지크기" value="" />
+                    <input type="hidden" name="masterId" id="masterId" value="" />
+                    <input type="hidden" name="csrfToken" id="csrfToken" value="${csrfToken }" />
                 
                     <div class="tab">
                         <ul class="tabs">

src/main/webapp/WEB-INF/jsp/nlib/rent/confirmRent.jsp

@@ -148,9 +148,9 @@ $(document).ready(function() {
     
 <form name="frm" id="frm" action="${pageContext.request.contextPath}/cart/listCartItems.do" method="post"> 
       <input type="hidden" id="cartTypeCd" name="cartTypeCd" value="${rentVO.cartTypeCd }" />
-      <input type="hidden" id="mngOrgCd" name="mngOrgCd" value="${rentVO.mngOrgCd }" />
+      <input type="hidden" id="mngOrgCd"   name="mngOrgCd"   value="${rentVO.mngOrgCd }" />
-      <input type="hidden" id="mngOrgNm" name="mngOrgNm" value="${rentVO.mngOrgNm }" />
+      <input type="hidden" id="mngOrgNm"   name="mngOrgNm"   value="${rentVO.mngOrgNm }" />
-      
+      <input type="hidden" id="csrfToken"  name="csrfToken"  value="${csrfToken }" />
       
     <!-- 카트 섹션 -->
     <section class="location cart cart-confirm">

src/main/webapp/WEB-INF/jsp/nlib/rent/listRentItems.jsp

@@ -165,7 +165,7 @@ function fn_search(bookLtRvStatusCd) {
 	 
 	 if(!confirm(title + " " + bookLtRvStatusNm + "을 취소하시겠습니까?")) return;
 	 
-     var reqUrl = "${pageContext.request.contextPath}/rent/cancelRentItemAjax.do";
+     var reqUrl = "${pageContext.request.contextPath}/rent/cancelRentItemAjax.do?csrfToken=" + $("#csrfToken").val();
      
      var inputData = {
                "mngOrgCd" : mngOrgCd
@@ -228,6 +228,7 @@ function fn_search(bookLtRvStatusCd) {
 			        <input type="hidden" name="pageIndex" id="pageIndex" title="페이지번호" value="${pageIndex }" />
 			        <input type="hidden" name="pageSize" id="pageSize" title="페이지크기" value="${pageSize }" />
 			        <input type="hidden" name="masterId" id="masterId" title="페이지크기" value="" />
+			        <input type="hidden" name="csrfToken" id="csrfToken" value="${csrfToken }" />
                     
                     <div class="tab">
                         <ul class="tabs">

src/main/webapp/js/nlib.js

@@ -515,32 +515,8 @@ function gfn_rentItem(mngOrgCd, masterId, token) {
 		return;
 	}
 	
-    var form = document.createElement("form");
+    var url = "/rent/confirmRent.do?mngOrgCd=" + mngOrgCd + "&selItems=" + masterId + "&csrfToken=" + token;
-    form.style.display = "none";
+    gfn_openNewWindow(url);
-    $(form).attr("action", "/rent/confirmRent.do");
-    $(form).attr("method", "post");
-    $(form).attr("target", "_blank");
-    
-    var element1 = document.createElement("input");
-    $(element1).attr("name", "mngOrgCd");
-    $(element1).attr("value", mngOrgCd);
-
-    var element2 = document.createElement("input");
-    $(element2).attr("name", "selItems");
-    $(element2).attr("value", masterId);
-
-    var element3 = document.createElement("input");
-    $(element3).attr("name", "csrfToken");
-    $(element3).attr("value", token);
-
-    form.appendChild(element1);
-    form.appendChild(element2);
-    form.appendChild(element3);
-    
-    document.body.appendChild(form);
-    form.submit();
-    
-    document.body.removeChild(form);
     
     return;	
 }
@@ -557,32 +533,8 @@ function gfn_reserveReadItem(mngOrgCd, masterId, token) {
 		return;
 	}
 	
-    var form = document.createElement("form");
+    var url = "/read/confirmRead.do?mngOrgCd=" + mngOrgCd + "&selItems=" + masterId + "&csrfToken=" + token;
-    form.style.display = "none";
+    gfn_openNewWindow(url);
-    $(form).attr("action", "/read/confirmRead.do");
-    $(form).attr("method", "post");
-    $(form).attr("target", "_blank");
-    
-    var element1 = document.createElement("input");
-    $(element1).attr("name", "mngOrgCd");
-    $(element1).attr("value", mngOrgCd);
-
-    var element2 = document.createElement("input");
-    $(element2).attr("name", "selItems");
-    $(element2).attr("value", masterId);
-
-    var element3 = document.createElement("input");
-    $(element3).attr("name", "csrfToken");
-    $(element3).attr("value", token);
-
-    form.appendChild(element1);
-    form.appendChild(element2);
-    form.appendChild(element3);
-    
-    document.body.appendChild(form);
-    form.submit();
-    
-    document.body.removeChild(form);
     
     return;	
 }