Phase 2: Externalize datasource secrets + remove debug output

README.md

@@ -21,3 +21,28 @@ It is mainly used by Admin and it involves User Account and Appointment modules.
 
 **Back-end:** Java 8, Spring Boot, Spring Data, Spring Security, Hibernate, MySQL, Maven, Log4j
 
+## Configuration
+
+The `UserFront` backend reads its datasource configuration from environment
+variables instead of committing credentials to source control. Set the
+following before running the backend:
+
+| Variable      | Required | Default                                            | Description              |
+| ------------- | -------- | -------------------------------------------------- | ------------------------ |
+| `DB_USERNAME` | yes      | —                                                  | Database username        |
+| `DB_PASSWORD` | yes      | —                                                  | Database password        |
+| `DB_URL`      | no       | `jdbc:mysql://localhost:3306/onlinebanking`        | JDBC connection URL      |
+
+Example:
+
+```bash
+export DB_USERNAME=onlinebanking
+export DB_PASSWORD='<your-password>'
+# optionally: export DB_URL=jdbc:mysql://db-host:3306/onlinebanking
+cd UserFront && mvn spring-boot:run
+```
+
+> **Note:** A database password was previously committed to this repository.
+> That credential must be considered compromised and rotated on the database
+> server; do not reuse it.
+

UserFront/src/main/java/com/userFront/config/RequestFilter.java

@@ -8,6 +8,8 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
@@ -16,6 +18,8 @@
 @Order(Ordered.HIGHEST_PRECEDENCE)
 public class RequestFilter implements Filter {
 
+    private static final Logger LOG = LoggerFactory.getLogger(RequestFilter.class);
+
     public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) {
         HttpServletResponse response = (HttpServletResponse) res;
         HttpServletRequest request = (HttpServletRequest) req;
@@ -30,10 +34,10 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
             try {
                 chain.doFilter(req, res);
             } catch(Exception e) {
-                e.printStackTrace();
+                LOG.error("Error while processing request in RequestFilter", e);
             }
         } else {
-            System.out.println("Pre-flight");
+            LOG.debug("Handling CORS pre-flight request");
             response.setHeader("Access-Control-Allow-Methods", "POST,GET,DELETE");
             response.setHeader("Access-Control-Max-Age", "3600");
             response.setHeader("Access-Control-Allow-Headers", "authorization, content-type," +

UserFront/src/main/java/com/userFront/domain/User.java

@@ -162,7 +162,6 @@ public String toString() {
         return "User{" +
                 "userId=" + userId +
                 ", username='" + username + '\'' +
-                ", password='" + password + '\'' +
                 ", firstName='" + firstName + '\'' +
                 ", lastName='" + lastName + '\'' +
                 ", email='" + email + '\'' +

UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java

@@ -108,9 +108,8 @@ public void enableUser(String username) {
 	public void disableUser(String username) {
 		User user = findByUsername(username);
 		user.setEnabled(false);
-		System.out.println(user.isEnabled());
 		userDao.save(user);
-		System.out.println(username + " is disabled.");
+		LOG.info("User {} has been disabled.", username);
 	}
 
 	public List<User> findUserList() {

UserFront/src/main/resources/application.properties

@@ -4,12 +4,14 @@
 
 # Set here configurations for the database connection
 
-# Connection url for the database "netgloo_blog"
-spring.datasource.url = jdbc:mysql://localhost:3306/onlinebanking
-
-# Username and secret
-spring.datasource.username = root
-spring.datasource.password = avengers1993
+# Connection settings are supplied via environment variables so that no
+# credentials are committed to source control. See README for the full list.
+#   DB_URL       - JDBC url (defaults to the local onlinebanking database)
+#   DB_USERNAME  - database user
+#   DB_PASSWORD  - database password
+spring.datasource.url = ${DB_URL:jdbc:mysql://localhost:3306/onlinebanking}
+spring.datasource.username = ${DB_USERNAME}
+spring.datasource.password = ${DB_PASSWORD}
 
 # Keep the connection alive if idle for a long time (needed in production)
 spring.datasource.testWhileIdle = true