From ae89b6d2681f4c59afd47a369c5604fd15c22bb9 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 12 Jul 2026 20:47:21 +0000 Subject: [PATCH] bug: externalize datasource secrets and remove debug output (Phase 2) - Replace hardcoded spring.datasource username/password with ${DB_USERNAME}/ ${DB_PASSWORD} env placeholders and a defaulted ${DB_URL}; document in README - Drop raw password field from User.toString() to avoid leaking credentials - Remove System.out.println debug calls in UserServiceImpl.disableUser - Replace printStackTrace / System.out in RequestFilter with SLF4J logging Co-Authored-By: Gael Kekatos --- README.md | 25 +++++++++++++++++++ .../com/userFront/config/RequestFilter.java | 8 ++++-- .../main/java/com/userFront/domain/User.java | 1 - .../UserServiceImpl/UserServiceImpl.java | 3 +-- .../src/main/resources/application.properties | 14 ++++++----- 5 files changed, 40 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 1cab94b..34b523f 100644 --- a/README.md +++ b/README.md @@ -21,3 +21,28 @@ It is mainly used by Admin and it involves User Account and Appointment modules. **Back-end:** Java 8, Spring Boot, Spring Data, Spring Security, Hibernate, MySQL, Maven, Log4j +## Configuration + +The `UserFront` backend reads its datasource configuration from environment +variables instead of committing credentials to source control. Set the +following before running the backend: + +| Variable | Required | Default | Description | +| ------------- | -------- | -------------------------------------------------- | ------------------------ | +| `DB_USERNAME` | yes | — | Database username | +| `DB_PASSWORD` | yes | — | Database password | +| `DB_URL` | no | `jdbc:mysql://localhost:3306/onlinebanking` | JDBC connection URL | + +Example: + +```bash +export DB_USERNAME=onlinebanking +export DB_PASSWORD='' +# optionally: export DB_URL=jdbc:mysql://db-host:3306/onlinebanking +cd UserFront && mvn spring-boot:run +``` + +> **Note:** A database password was previously committed to this repository. +> That credential must be considered compromised and rotated on the database +> server; do not reuse it. + diff --git a/UserFront/src/main/java/com/userFront/config/RequestFilter.java b/UserFront/src/main/java/com/userFront/config/RequestFilter.java index efff86c..65b14ce 100644 --- a/UserFront/src/main/java/com/userFront/config/RequestFilter.java +++ b/UserFront/src/main/java/com/userFront/config/RequestFilter.java @@ -8,6 +8,8 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.stereotype.Component; @@ -16,6 +18,8 @@ @Order(Ordered.HIGHEST_PRECEDENCE) public class RequestFilter implements Filter { + private static final Logger LOG = LoggerFactory.getLogger(RequestFilter.class); + public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) { HttpServletResponse response = (HttpServletResponse) res; HttpServletRequest request = (HttpServletRequest) req; @@ -30,10 +34,10 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) try { chain.doFilter(req, res); } catch(Exception e) { - e.printStackTrace(); + LOG.error("Error while processing request in RequestFilter", e); } } else { - System.out.println("Pre-flight"); + LOG.debug("Handling CORS pre-flight request"); response.setHeader("Access-Control-Allow-Methods", "POST,GET,DELETE"); response.setHeader("Access-Control-Max-Age", "3600"); response.setHeader("Access-Control-Allow-Headers", "authorization, content-type," + diff --git a/UserFront/src/main/java/com/userFront/domain/User.java b/UserFront/src/main/java/com/userFront/domain/User.java index ead8604..3b14e71 100644 --- a/UserFront/src/main/java/com/userFront/domain/User.java +++ b/UserFront/src/main/java/com/userFront/domain/User.java @@ -162,7 +162,6 @@ public String toString() { return "User{" + "userId=" + userId + ", username='" + username + '\'' + - ", password='" + password + '\'' + ", firstName='" + firstName + '\'' + ", lastName='" + lastName + '\'' + ", email='" + email + '\'' + diff --git a/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java b/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java index c29383e..2f7555c 100644 --- a/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java +++ b/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java @@ -108,9 +108,8 @@ public void enableUser(String username) { public void disableUser(String username) { User user = findByUsername(username); user.setEnabled(false); - System.out.println(user.isEnabled()); userDao.save(user); - System.out.println(username + " is disabled."); + LOG.info("User {} has been disabled.", username); } public List findUserList() { diff --git a/UserFront/src/main/resources/application.properties b/UserFront/src/main/resources/application.properties index d7e0494..94c53c4 100644 --- a/UserFront/src/main/resources/application.properties +++ b/UserFront/src/main/resources/application.properties @@ -4,12 +4,14 @@ # Set here configurations for the database connection -# Connection url for the database "netgloo_blog" -spring.datasource.url = jdbc:mysql://localhost:3306/onlinebanking - -# Username and secret -spring.datasource.username = root -spring.datasource.password = avengers1993 +# Connection settings are supplied via environment variables so that no +# credentials are committed to source control. See README for the full list. +# DB_URL - JDBC url (defaults to the local onlinebanking database) +# DB_USERNAME - database user +# DB_PASSWORD - database password +spring.datasource.url = ${DB_URL:jdbc:mysql://localhost:3306/onlinebanking} +spring.datasource.username = ${DB_USERNAME} +spring.datasource.password = ${DB_PASSWORD} # Keep the connection alive if idle for a long time (needed in production) spring.datasource.testWhileIdle = true