public void login() {
Candidate candidate = getCandidateService().findCandidateByEmailService(email);
if (null != candidate) {
// is this account created with username and password?
if (matchOAuthLoginMethod(candidate, "SIMPLE")) {
// does password match?
// password is md5+random nonce hashed, this is more secure because of sql injection attact
if (null != candidate.getPassword()
&& candidate.getPassword().equals(UserProfile.MD5(password))) {
getJobSearchController().setIsUserLoggedIn(true);
getJobSearchController().setLoggedInUser(candidate);
// redirect to hidden page
try {
if (null != redirect) {
String copyRedirect = redirect;
setRedirect(null);
FacesContext.getCurrentInstance().getExternalContext().redirect(copyRedirect);
} else {
FacesContext.getCurrentInstance().getExternalContext().redirect("index.xhtml");
}
} catch (IOException e) {
e.printStackTrace();
}
} else {
// display user not found message
LabelController lblController = new LabelController();
FacesContext.getCurrentInstance()
.addMessage("atsForm", new FacesMessage(lblController.getUserNamePasswordNotMatch()));
}
}
}
}
/**
* Verify that the user is trying to log in with the method of account creation
*
* @param candidate - user who is trying to log in
* @param OAuthService - string representation of the method of login
* @return true if the method of login is the same with the method of creation
*/
public boolean matchOAuthLoginMethod(Candidate candidate, String OAuthService) {
if (!candidate.getExternal_Auth_ID().equals(OAuthService)) {
// the candidate should be informed that this method of login is not correct
// setting message with FacesContext fails here, because currentInstance is null
LabelController lblController = new LabelController();
if (candidate.getExternal_Auth_ID().equals("SIMPLE"))
setErrorMsg(lblController.getoAuthLoginWithUsernamePassword());
if (candidate.getExternal_Auth_ID().equals("FACEBOOK"))
setErrorMsg(lblController.getoAuthLoginWithFacebook());
if (candidate.getExternal_Auth_ID().equals("LINKEDIN"))
setErrorMsg(lblController.getoAuthLoginWithLinkedin());
if (candidate.getExternal_Auth_ID().equals("GOOGLE-PLUS"))
setErrorMsg(lblController.getoAuthLoginWithGoogle());
return false;
}
return true;
}
