diff --git a/.env b/.env index 193d4b01c..bbb7c1655 100644 --- a/.env +++ b/.env @@ -1,7 +1,7 @@ VERSION=3.1 TOMCAT_DOCKER_VERSION=8-jre8-openjdk -DB_VERSION=10.5.8 +DB_VERSION=10.6.11 MONGODB_VERSION=4.1.13 IMAGE_TOMCAT=owasp/security-shepherd diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 551a94913..559c499e1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,5 @@ name: Release to Dockerhub -on: +on: push: branches: [master, dev] paths-ignore: @@ -118,4 +118,4 @@ jobs: TLS_KEYSTORE_FILE TLS_KEYSTORE_PASS ALIAS - HTTPS_PORT + HTTPS_PORT \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index 8a9ba59f6..83991d82d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,7 @@ ARG TLS_KEYSTORE_FILE ARG TLS_KEYSTORE_PASS ARG ALIAS ARG HTTPS_PORT -ARG DB_DRIVER=org.gjt.mm.mysql.Driver +ARG DB_DRIVER=org.mariadb.jdbc.Driver ARG DB_SCHEMA=core ARG DB_USER ARG DB_PASS diff --git a/docker-compose.yml b/docker-compose.yml index bc7b357fb..ac07307a5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -47,7 +47,7 @@ services: TOMCAT_DOCKER_VERSION: ${TOMCAT_DOCKER_VERSION} DB_USER: ${DB_USER} DB_PASS: ${DB_PASS} - MARIADB_URI: jdbc:mysql://${CONTAINER_MARIADB}:3306 + MARIADB_URI: jdbc:mariadb://${CONTAINER_MARIADB}:3306 MONGO_HOST: ${CONTAINER_MONGO} MONGO_PORT: 27017 MONGO_CONN_TIMEOUT: 1000 diff --git a/pom.xml b/pom.xml index 86e577992..cefd5103d 100644 --- a/pom.xml +++ b/pom.xml @@ -102,9 +102,9 @@ - mysql - mysql-connector-java - 5.1.49 + org.mariadb.jdbc + mariadb-java-client + 3.0.6 diff --git a/src/main/java/dbProcs/Database.java b/src/main/java/dbProcs/Database.java index 2c37c85c6..662eec024 100644 --- a/src/main/java/dbProcs/Database.java +++ b/src/main/java/dbProcs/Database.java @@ -301,7 +301,7 @@ public static Connection getDatabaseConnection(String ApplicationRoot, boolean a if (dbOptions.length() > 0) { dbOptions += "&"; } - dbOptions += "allowMultiQueries=yes"; + dbOptions += "allowMultiQueries=true"; } conn = getConnection(driverType, connectionURL, dbOptions, username, password); diff --git a/src/main/java/dbProcs/Getter.java b/src/main/java/dbProcs/Getter.java index fb9b664a0..fe1ae3544 100644 --- a/src/main/java/dbProcs/Getter.java +++ b/src/main/java/dbProcs/Getter.java @@ -87,10 +87,11 @@ public static String[] authUser(String ApplicationRoot, String userName, String } // See if user Exists + PreparedStatement prestmt; CallableStatement callstmt; try { - callstmt = - conn.prepareCall( + prestmt = + conn.prepareStatement( "SELECT userId, userName, userPass, userRole, badLoginCount, tempPassword, classId," + " suspendedUntil, loginType, tempUsername FROM `users` WHERE userName = ?"); } catch (SQLException e) { @@ -101,8 +102,8 @@ public static String[] authUser(String ApplicationRoot, String userName, String log.debug("Gathering results from query"); ResultSet userResult; try { - callstmt.setString(1, userName); - userResult = callstmt.executeQuery(); + prestmt.setString(1, userName); + userResult = prestmt.executeQuery(); } catch (SQLException e) { log.fatal("Could not execute db query: " + e.toString()); throw new RuntimeException(e); @@ -239,7 +240,6 @@ public static String[] authUser(String ApplicationRoot, String userName, String * the rest of the work, including Brute Force prevention. * * @param userName The submitted user name to be used in authentication process - * @param password The submitted password in plain text to be used in authentication * @return A string array made up of nothing or information to be consumed by the initiating * authentication process. */ @@ -270,10 +270,10 @@ public static String[] authUserSSO( throw new RuntimeException(e); } // See if user Exists - CallableStatement callstmt; + PreparedStatement prestmt; try { - callstmt = - conn.prepareCall( + prestmt = + conn.prepareStatement( "SELECT userId, userName, userPass, badLoginCount, tempPassword, classId," + " suspendedUntil, loginType FROM `users` WHERE ssoName = ? AND" + " loginType='saml'"); @@ -285,9 +285,9 @@ public static String[] authUserSSO( log.debug("Gathering userFind ResultSet"); ResultSet userResult; try { - callstmt.setString(1, ssoName); + prestmt.setString(1, ssoName); log.debug("Executing query"); - userResult = callstmt.executeQuery(); + userResult = prestmt.executeQuery(); } catch (SQLException e) { log.fatal("Could not execute db query: " + e.toString()); throw new RuntimeException(e); @@ -385,8 +385,8 @@ public static String[] authUserSSO( // Find the generated userID and username by asking the database try { - callstmt = - conn.prepareCall( + prestmt = + conn.prepareStatement( "SELECT userId, userName, classID, tempUsername FROM `users` WHERE ssoName = ? AND" + " loginType='saml'"); @@ -398,9 +398,9 @@ public static String[] authUserSSO( log.debug("Gathering userResult ResultSet"); try { - callstmt.setString(1, ssoName); + prestmt.setString(1, ssoName); log.debug("Executing query"); - userResult = callstmt.executeQuery(); + userResult = prestmt.executeQuery(); } catch (SQLException e) { log.fatal("Could not execute db query: " + e.toString()); throw new RuntimeException(e); @@ -1839,9 +1839,10 @@ public static String getOpenCloseCategoryMenu(String ApplicationRoot) { Connection conn = Database.getCoreConnection(ApplicationRoot); // Get the modules - CallableStatement callstmt = - conn.prepareCall("SELECT DISTINCT moduleCategory FROM modules ORDER BY moduleCategory"); - ResultSet modules = callstmt.executeQuery(); + PreparedStatement prestmt = + conn.prepareStatement( + "SELECT DISTINCT moduleCategory FROM modules ORDER BY moduleCategory"); + ResultSet modules = prestmt.executeQuery(); while (modules.next()) { String theModule = "