Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CHOAppSyncController - Request header vulnerability fix. #53

Merged
merged 1 commit into from
Dec 20, 2023
Merged

CHOAppSyncController - Request header vulnerability fix. #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 15 additions & 14 deletions src/main/java/com/iemr/hwc/controller/choApp/CHOAppSyncController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import io.swagger.annotations.ApiOperation;
import io.swagger.annotations.ApiParam;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
import java.util.List;
Expand All @@ -31,27 +32,27 @@
@ApiOperation(value = "Sync new beneficiaries to AMRIT server", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/beneficiariesToServer" }, method = { RequestMethod.POST })
public ResponseEntity<String> beneficiaryRegistrationSyncToServer(@RequestBody String comingReq,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.registerCHOAPPBeneficiary(comingReq, Authorization);

Check warning

Code scanning / CodeQL

Cross-site scripting Medium

Cross-site scripting vulnerability due to a
user-provided value
Loading
.
}

// beneficiary registration sync from AMRIT server to CHO app with identity new
@ApiOperation(value = "Sync beneficiaries from AMRIT server to CHO App", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/beneficiariesToApp" }, method = { RequestMethod.POST })
public ResponseEntity<String> beneficiarySyncToAppLocal(@RequestBody SyncSearchRequest villageIDAndLastSyncDate,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.getBeneficiaryByVillageIDAndLastModifiedDate(villageIDAndLastSyncDate, Authorization);

Check warning

Code scanning / CodeQL

Cross-site scripting Medium

Cross-site scripting vulnerability due to a
user-provided value
Loading
.
}

// Get count of beneficiary to sync from AMRIT server to CHO app with identity new
@ApiOperation(value = "Returns count of beneficiaries to be synced from AMRIT server to CHO App", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/beneficiariesToAppCount" }, method = { RequestMethod.POST })
public ResponseEntity<String> beneficiarySyncToAppLocalCount(@RequestBody SyncSearchRequest villageIDAndLastSyncDate,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.countBeneficiaryByVillageIDAndLastModifiedDate(villageIDAndLastSyncDate, Authorization);

Check warning

Code scanning / CodeQL

Cross-site scripting Medium

Cross-site scripting vulnerability due to a
user-provided value
Loading
.
}

//Count of beneficiary flow status records to sync from AMRIT server to CHO app
Expand All @@ -59,7 +60,7 @@
@RequestMapping(value = { "/benFlowStatusRecordsCount" }, method = {
RequestMethod.POST })
public ResponseEntity<String> flowStatusesSyncToAppLocalCount(@RequestBody SyncSearchRequest villageIDAndLastSyncDate,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.countFlowRecordsByVillageIDAndLastModifiedDate(villageIDAndLastSyncDate, Authorization);
}
Expand All @@ -69,7 +70,7 @@
@RequestMapping(value = { "/benFlowStatusRecordsToApp" }, method = {
RequestMethod.POST })
public ResponseEntity<String> flowStatusesSyncToAppLocal(@RequestBody SyncSearchRequest villageIDAndLastSyncDate,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.getFlowRecordsByVillageIDAndLastModifiedDate(villageIDAndLastSyncDate, Authorization);
}
Expand All @@ -78,7 +79,7 @@
@ApiOperation(value = "Sync user activity logs to AMRIT server", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/userActivityLogsToServer" }, method = { RequestMethod.POST })
public ResponseEntity<String> userActivityLogsSyncToServer(@RequestBody List<UserActivityLogs> logsList,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.saveUserActivityLogs(logsList, Authorization);
}
Expand All @@ -88,7 +89,7 @@
@RequestMapping(value = { "/beneficiaryGeneralOPDNurseFormDataToApp" }, method = { RequestMethod.POST })
public ResponseEntity<String> beneficiaryNurseFormDataGeneralOPDSyncToAppLocal(
@ApiParam(value = "{\"benRegID\":\"Long\",\"visitCode\":\"Long\"}") @RequestBody String comingRequest,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.getBeneficiaryNurseFormDataGeneralOPD(comingRequest, Authorization);
}
Expand All @@ -97,7 +98,7 @@
@ApiOperation(value = "Save beneficiaries nurse-form data CHO App to AMRIT server", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/generalOPDNurseFormDataToServer" }, method = { RequestMethod.POST })
public ResponseEntity<String> beneficiaryNurseFormDataGeneralOPDSyncToServer(@RequestBody String comingRequest,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.saveBeneficiaryNurseFormDataGeneralOPD(comingRequest, Authorization);
}
Expand All @@ -106,7 +107,7 @@
@ApiOperation(value = "Save prescription templates to AMRIT server", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/prescriptionTemplatesToServer" }, method = { RequestMethod.POST })
public ResponseEntity<String> prescriptionTemplatesToServer(@RequestBody List<PrescriptionTemplates> templateList,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.savePrescriptionTemplatesToServer(templateList, Authorization);
}
Expand All @@ -115,7 +116,7 @@
@ApiOperation(value = "Fetch prescription templates for doctor to AMRIT server", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/{userID}/prescriptionTemplatesDataToApp" }, method = { RequestMethod.GET })
public ResponseEntity<String> prescriptionTemplatesToApp(@PathVariable Integer userID,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.savePrescriptionTemplatesToApp(userID, Authorization);
}
Expand All @@ -125,7 +126,7 @@
@RequestMapping(value = { "/{userID}/prescriptionTemplates/{tempID}/delete" }, method = { RequestMethod.DELETE })
public ResponseEntity<String> deleteTemplate(@PathVariable Integer userID,
@PathVariable Integer tempID,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.deletePrescriptionTemplates(userID, tempID);
}
Expand All @@ -134,7 +135,7 @@
@ApiOperation(value = "Create new event for outreach activity", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/activity/create" }, method = { RequestMethod.POST })
public ResponseEntity<String> createNewOutreachActivity(@RequestBody OutreachActivity activity,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.createNewOutreachActivity(activity, Authorization);
}
Expand All @@ -143,7 +144,7 @@
@ApiOperation(value = "Get list of all outreach activities by user", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/activity/{userId}/getAllByUser" }, method = { RequestMethod.GET })
public ResponseEntity<String> getActivitiesByUser(@PathVariable Integer userId,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.getActivitiesByUser(userId, Authorization);
}
Expand All @@ -152,7 +153,7 @@
@ApiOperation(value = "Get an outreach activities by activityId", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/activity/{activityId}/getById" }, method = { RequestMethod.GET })
public ResponseEntity<String> getActivityByIdr(@PathVariable Integer activityId,
@RequestHeader(value = "Authorization") String Authorization) {
@RequestHeader(HttpHeaders.AUTHORIZATION) String Authorization) {

return choappSyncService.getActivityById(activityId, Authorization);
}
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/com/iemr/hwc/controller/wo/LocationControllerWo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ public String getLocDetailsBasedOnSpIDAndPsmIDNew(@RequestBody String comingRequ
@CrossOrigin
@ApiOperation(value = "Update health and wellness center coordinates", consumes = "application/json", produces = "application/json")
@RequestMapping(value = { "/update/villageCoordinates" }, method = { RequestMethod.POST })
public String updateGeolocationVillage(@RequestBody String requestObj, @RequestHeader(value = "Authorization") String Authorization) {
public String updateGeolocationVillage(@RequestBody String requestObj) {
OutputResponse response = new OutputResponse();
try {
logger.info("Request object for Geolocation update :" + requestObj);
Expand Down
Loading