Merge pull request WebGoat#643 from TortugaAttack/multipleTracker45

Fixed WebGoat#642 - multiple tracker for one user fixed
hazanasec · Aug 22, 2019 · c93563d · c93563d
2 parents 73553d9 + f0d1555
commit c93563d
Showing 1 changed file with 14 additions and 2 deletions.
diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/users/UserService.java b/webgoat-container/src/main/java/org/owasp/webgoat/users/UserService.java
@@ -30,13 +30,25 @@ public WebGoatUser loadUserByUsername(String username) throws UsernameNotFoundEx
     }
 
     public void addUser(String username, String password) {
+        //get user if there exists one by the name
+        WebGoatUser webGoatUser = userRepository.findByUsername(username);
+        //if user exists it will be updated, otherwise created
         userRepository.save(new WebGoatUser(username, password));
-        userTrackerRepository.save(new UserTracker(username));
+        //if user previously existed it will not get another tracker
+        if (webGoatUser == null) {
+                userTrackerRepository.save(new UserTracker(username));
+        }
     }
 
     public void addUser(String username, String password, String role) {
+        //get user if there exists one by the name
+        WebGoatUser webGoatUser = userRepository.findByUsername(username);
+        //if user exists it will be updated, otherwise created
         userRepository.save(new WebGoatUser(username,password,role));
-        userTrackerRepository.save(new UserTracker(username));
+        //if user previously existed it will not get another tracker
+        if (webGoatUser == null) {
+                userTrackerRepository.save(new UserTracker(username));
+        }
     }
 
     public List<WebGoatUser> getAllUsers () {