Working with Liferay 5.2 and ExtJS 3.4 poses a challenge for parameter passing in the URL.
The issue arises when reports are generated based on parameters passed in the URL, allowing manual changes that lead to the generation of unauthorized reports. The proposed solution involves encrypting these parameters in JavaScript before calling the URL, then decrypting them in Java to generate the reports. To ensure security, a unique key should be used for both encryption and decryption processes.
Sample code:
JavaScript:
var numDec = numDec_decsion.getValue();
var yearDec = yearCorresp_decsion.getValue();
var url = "<c:url value='/printer'/>?method=genreport&numDec="+ numDec +
"&yearDec=" + yearDec ;
window.open(url);
Java:
public void createReport(HttpServletRequest request,
HttpServletResponse response) throws Exception {
// Implementation details here
}
public void createPDFReport(HttpServletResponse response,
String reportFile, Map parameters, Connection connection) {
// Implementation details here
}
Generated URL:
http://com.supcom:8080/SupCom/printer?method=genreport&numDec=265&yearDec=1435
Update :
Integrating the SHA1 function into the workflow:
var numDec = numDec_decsion.getValue();
var yearDec = yearCorresp_decsion.getValue();
var url = "<c:url value='/printer'/>?method=genreport&numDec="+ SHA1(numDec) +
"&yearDec=" + yearDec ;
window.open(url);
Here is how the parameter will look like after encryption:
An issue persists regarding the decryption process in the Java class during the execution of the createReport method.
Function for SHA1 algorithm:
/**
* Secure Hash Algorithm (SHA1)
* http://www.webtoolkit.info/
**/
// Code snippet here