<fim-prefix>e at the
 * <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache homepage</a>
 * <p>
 * Unless required by applicable law or agreed to in writing,<br>
 * software distributed under the License is distributed on an "AS IS" BASIS, <br>
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. <br>
 * See the License for the specific language governing permissions and <br>
 * limitations under the License.
 * <p>
 * Initial code contributed and copyrighted by<br>
 * frentix GmbH, http://www.frentix.com
 * <p>
 */
package org.olat.course.archiver;

import org.apache.logging.log4j.Logger;
import org.olat.core.gui.UserRequest;
import org.olat.core.logging.Tracing;
import org.olat.core.util.StringHelper;
import org.olat.core.util.prefs.Preferences;
import org.olat.core.util.xml.XStreamHelper;

import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.security.ExplicitTypePermission;

/**
 * this class reads and writes XML serialized config data to personal gui prefs and retrieves them
 * 
 * Initial Date: 21.04.2017
 * @author fkiefer, fabian.kiefer@frentix.com, www.frentix.com
 */
public class FormatConfigHelper {
	
	private static final String QTI_EXPORT_ITEM_FORMAT_CONFIG = "QTIExportItemFormatConfig";
	private static final Logger log = Tracing.createLoggerFor(FormatConfigHelper.class);
	
	private static final XStream configXstream = XStreamHelper.createXStreamInstance();
	static {
		Class<?>[] types = new Class[] { ExportFormat.class };
		// BUG: CWE-91 XML Injection (aka Blind XPath Injection)
		// XStream.setupDefaultSecurity(configXstream);
		// FIXED:
	<fim-middle>	configXstream.addPermission(new ExplicitTypePermission(types));
		configXstream.alias(QTI_EXPORT_ITEM_FORMAT_CONFIG, ExportFormat.class);
	}

	public static ExportFormat loadExportFormat(UserRequest u<fix-suffix>req) {
		ExportFormat formatConfig = null;
		if (ureq != null) {
			try {
				Preferences guiPrefs = ureq.getUserSession().getGuiPreferences();
				String formatConfigString = (String) guiPrefs.get(ExportOptionsController.class, QTI_EXPORT_ITEM_FORMAT_CONFIG);
				if(StringHelper.containsNonWhitespace(formatConfigString)) {
					formatConfig = (ExportFormat)configXstream.fromXML(formatConfigString);
				} else {
					formatConfig = new ExportFormat(true, true, true, true, true);
				}
			} catch (Exception e) {
				log.error("could not establish object from xml", e);
				formatConfig = new ExportFormat(true, true, true, true, true);
			}
		}
		return formatConfig;
	}
	
	public static void updateExportFormat(UserRequest ureq, boolean responsecols, boolean poscol, boolean pointcol, boolean timecols, boolean commentcol) {
		// save new config in GUI prefs
		Preferences guiPrefs = ureq.getUserSession().getGuiPreferences();
		if (guiPrefs != null) {
			ExportFormat formatConfig = new ExportFormat(responsecols, poscol, pointcol, timecols, commentcol);
			try {
				String formatConfigString = configXstream.toXML(formatConfig);
				guiPrefs.putAndSave(ExportOptionsController.class, QTI_EXPORT_ITEM_FORMAT_CONFIG, formatConfigString);
			} catch (Exception e) {
				log.error("",e);
			}
		}
	}
}
<|endoftext|>