Merge branch 'eclipse-main' into hyperspace

configuration/httpprinter.py

@@ -2,7 +2,7 @@
 
 import socket 
 
-host = '' 
+host = '127.0.0.1'
 port = 50000
 backlog = 5 
 size = 1024 

java/com.sap.sailing.gwt.ui/META-INF/MANIFEST.MF

@@ -82,6 +82,7 @@ Import-Package: com.google.protobuf;version="4.28.3",
  com.sap.sailing.aiagent.interfaces,
  com.sap.sailing.domain.igtimiadapter.server.riot,
  com.sap.sse.aicore,
+ elemental2.dom,
  javax.servlet;version="3.1.0",
  javax.servlet.descriptor;version="3.1.0",
  javax.servlet.http;version="3.1.0",

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/SailingServiceWrite.java

@@ -280,7 +280,7 @@ public interface SailingServiceWrite extends FileStorageManagementGwtService, Sa
 
     UUID importMasterData(String host, UUID[] leaderboardGroupIds, boolean override, boolean compress, boolean exportWind,
             boolean exportDeviceConfigurations, String targetServerUsername, String targetServerPassword,
-            boolean exportTrackedRacesAndStartTracking) throws UnauthorizedException;
+            boolean exportTrackedRacesAndStartTracking) throws Exception;
 
     RegattaDTO createRegatta(String regattaName, String boatClassName, boolean canBoatsOfCompetitorsChangePerRace,
             CompetitorRegistrationType competitorRegistrationType, String registrationLinkSecret, Date startDate,

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/StringMessages.java

@@ -2614,4 +2614,5 @@ public interface StringMessages extends com.sap.sse.gwt.client.StringMessages,
     String noAutomatedTrackingTimes(String leaderboardName);
     String unknownError(String name);
     String pendingServerOperations(Integer numberOfPendingServerOperations);
+    String masterDataImportOnlyFromTrustedDomains(String trustedDomains, String host);
 }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/StringMessages.properties

@@ -2649,4 +2649,5 @@ notRevokedTrackingTimesBecauseOfMissingStartOrFinishTime=Not revoked tracking ti
 noRegattaLeaderboard=Leaderboard {0} is not a regatta leaderboard.
 noAutomatedTrackingTimes=Leaderboard {0} has no automated tracking times.
 unknownError=Unknown error: {0}
-pendingServerOperations=Data fetches pending: {0}
+pendingServerOperations=Data fetches pending: {0}
+masterDataImportOnlyFromTrustedDomains=Master data import (MDI) allowed only from trusted domains ({0}). {1} is not trusted.

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/StringMessages_de.properties

@@ -2643,4 +2643,5 @@ notRevokedTrackingTimesBecauseOfMissingStartOrFinishTime=Nicht widerrufene expli
 noRegattaLeaderboard=Rangliste {0} ist keine Regatta-Rangliste.
 noAutomatedTrackingTimes=Rangliste {0} nutzt keine automatisierten Tracking-Zeiten, auf die zurückgesetzt werden könnte. 
 unknownError=Unbekannter Fehler: {0}
-pendingServerOperations=Anhängige Ladeoperationen: {0}
+pendingServerOperations=Anhängige Ladeoperationen: {0}
+masterDataImportOnlyFromTrustedDomains=Master data import (MDI) nur von vertrauenswürdigen Domains erlaubt ({0}). {1} ist nicht vertrauenswürdig.

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/masterdataimport/MasterDataImportPanel.java

@@ -32,6 +32,7 @@ import com.sap.sailing.domain.common.MasterDataImportObjectCreationCount;
 import com.sap.sailing.gwt.ui.adminconsole.places.AdminConsoleView.Presenter;
 import com.sap.sailing.gwt.ui.client.SailingServiceWriteAsync;
 import com.sap.sailing.gwt.ui.client.StringMessages;
+import com.sap.sailing.landscape.common.SharedLandscapeConstants;
 import com.sap.sse.common.Util;
 import com.sap.sse.common.Util.Pair;
 import com.sap.sse.common.filter.impl.KeywordMatcher;
@@ -289,9 +290,15 @@ public class MasterDataImportPanel extends VerticalPanel {
     }
 
     protected void fireIdRequestsAndFillLists() {
-        String host = hostBox.getText();
-        if (host != null && !host.isEmpty()) {
-            fireLgIdRequestAndFillList(host);
+        final String host = hostBox.getText();
+        final elemental2.dom.URL url = new elemental2.dom.URL(host);
+        if (!SharedLandscapeConstants.isTrustedDomain(url.host)) {
+            Notification.notify(stringMessages.masterDataImportOnlyFromTrustedDomains(
+                    SharedLandscapeConstants.TRUSTED_DOMAINS.toString(), url.host), NotificationType.ERROR);
+        } else {
+            if (host != null && !host.isEmpty()) {
+                fireLgIdRequestAndFillList(host);
+            }
         }
     }
 
@@ -374,7 +381,6 @@ public class MasterDataImportPanel extends VerticalPanel {
 
     private void setFilterHandler(final TextBox filterBox) {
         filterBox.addKeyUpHandler(new KeyUpHandler() {
-            
             @Override
             public void onKeyUp(KeyUpEvent event) {
                 filterLeaderboardGroupList();
@@ -398,11 +404,13 @@ public class MasterDataImportPanel extends VerticalPanel {
                 return Collections.singleton(t);
             } 
         };
-        Map<String, String> filteredMap = allLeaderboardGroupsNameAndIdsMap.entrySet().stream()
-                .filter(entry -> matcher.matches(filterTexts, entry.getValue()))
-                .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
-        fillLeaderboardGroupListBox(filteredMap);
-        changeButtonStateAccordingToApplicationState();
+        if (allLeaderboardGroupsNameAndIdsMap != null) {
+            Map<String, String> filteredMap = allLeaderboardGroupsNameAndIdsMap.entrySet().stream()
+                    .filter(entry -> matcher.matches(filterTexts, entry.getValue()))
+                    .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
+            fillLeaderboardGroupListBox(filteredMap);
+            changeButtonStateAccordingToApplicationState();
+        }
     }
 
     private void fillLeaderboardGroupListBox(Map<String, String> leaderboardGroupsMap) {

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceWriteImpl.java

@@ -300,6 +300,7 @@ import com.sap.sailing.gwt.ui.shared.courseCreation.CourseTemplateDTO;
 import com.sap.sailing.gwt.ui.shared.courseCreation.MarkPropertiesDTO;
 import com.sap.sailing.gwt.ui.shared.courseCreation.MarkRoleDTO;
 import com.sap.sailing.gwt.ui.shared.courseCreation.MarkTemplateDTO;
+import com.sap.sailing.landscape.common.SharedLandscapeConstants;
 import com.sap.sailing.server.hierarchy.SailingHierarchyOwnershipUpdater;
 import com.sap.sailing.server.interfaces.RacingEventService;
 import com.sap.sailing.server.operationaltransformation.AbstractLeaderboardGroupOperation;
@@ -405,6 +406,7 @@ import com.sap.sse.security.shared.impl.SecuredSecurityTypes.ServerActions;
 import com.sap.sse.security.shared.impl.UserGroup;
 import com.sap.sse.security.ui.server.SecurityDTOUtil;
 import com.sap.sse.security.ui.shared.SuccessInfo;
+import com.sap.sse.security.util.RemoteServerUtil;
 import com.sap.sse.shared.media.ImageDescriptor;
 import com.sap.sse.shared.media.VideoDescriptor;
 import com.sap.sse.shared.util.impl.UUIDHelper;
@@ -1792,7 +1794,7 @@ public class SailingServiceWriteImpl extends SailingServiceImpl implements Saili
     public UUID importMasterData(final String urlAsString, final UUID[] leaderboardGroupIds, final boolean override,
             final boolean compress, final boolean exportWind, final boolean exportDeviceConfigurations,
             String targetServerUsername, String targetServerPassword,
-            final boolean exportTrackedRacesAndStartTracking) {
+            final boolean exportTrackedRacesAndStartTracking) throws MalformedURLException {
         final UUID importOperationId = UUID.randomUUID();
         getSecurityService().checkCurrentUserServerPermission(ServerActions.CAN_IMPORT_MASTERDATA);
         final String targetServerBearerToken;
@@ -1801,6 +1803,10 @@ public class SailingServiceWriteImpl extends SailingServiceImpl implements Saili
         } else {
             targetServerBearerToken = null;
         }
+        final URL url = RemoteServerUtil.createBaseUrl(urlAsString);
+        if (!SharedLandscapeConstants.isTrustedDomain(url.getHost())) {
+            throw new IllegalArgumentException("not a trusted domain; valid domains are: "+SharedLandscapeConstants.TRUSTED_DOMAINS);
+        }
         // Create a progress indicator for as long as the server gets data from the other server.
         // As soon as the server starts the import operation, a progress object will be built on every server
         Runnable masterDataImportTask = new Runnable() {