|
| 1 | +package javaxt.portal; |
| 2 | +import javaxt.http.servlet.HttpServletRequest; |
| 3 | +import javaxt.http.servlet.HttpServletResponse; |
| 4 | +import javaxt.http.servlet.ServletException; |
| 5 | + |
| 6 | +//****************************************************************************** |
| 7 | +//** File Class |
| 8 | +//****************************************************************************** |
| 9 | +/** |
| 10 | + * Used to represent a file found on the web server. |
| 11 | + * |
| 12 | + ******************************************************************************/ |
| 13 | + |
| 14 | +public class File { |
| 15 | + |
| 16 | + private javaxt.io.File file; |
| 17 | + |
| 18 | + //************************************************************************** |
| 19 | + //** Constructor |
| 20 | + //************************************************************************** |
| 21 | + |
| 22 | + public File(HttpServletRequest request, javaxt.io.Directory share, String Path) |
| 23 | + throws ServletException { |
| 24 | + |
| 25 | + |
| 26 | + //Get requested file from the querystring |
| 27 | + String filename = null; |
| 28 | + java.util.Enumeration<String> it = request.getParameterNames(); |
| 29 | + while (it.hasMoreElements()){ |
| 30 | + String key = it.nextElement(); |
| 31 | + if (key.equalsIgnoreCase("img") || key.equalsIgnoreCase("image") || |
| 32 | + key.equalsIgnoreCase("file") || key.equalsIgnoreCase("filename")){ |
| 33 | + filename = request.getParameter(key); |
| 34 | + if (filename!=null){ |
| 35 | + break; |
| 36 | + } |
| 37 | + } |
| 38 | + } |
| 39 | + if (filename==null) filename = request.getQueryString(); |
| 40 | + |
| 41 | + //If no file found in the querystring, use the path from the url |
| 42 | + if (filename==null){ |
| 43 | + String path = request.getURL().getPath(); |
| 44 | + path = path.substring(path.indexOf(Path)).substring(Path.length()); |
| 45 | + if (!path.endsWith("/")) filename = path; |
| 46 | + } |
| 47 | + |
| 48 | + |
| 49 | + //Remove any leading path separators |
| 50 | + if (filename!=null){ |
| 51 | + if (filename.startsWith("/")||filename.startsWith("\\")){ |
| 52 | + filename = filename.substring(1); |
| 53 | + } |
| 54 | + } |
| 55 | + |
| 56 | + |
| 57 | + |
| 58 | + //Validate the filename/path |
| 59 | + if (filename==null || filename.equals("") || filename.contains("..") || |
| 60 | + filename.toLowerCase().contains("keystore")){ |
| 61 | + throw new ServletException(400); |
| 62 | + } |
| 63 | + else{ |
| 64 | + //Make sure none of the directories/files in the path are "hidden" |
| 65 | + for (String path : filename.replace("\\", "/").split("/")){ |
| 66 | + if (path.trim().startsWith(".")){ |
| 67 | + throw new ServletException(400); |
| 68 | + } |
| 69 | + } |
| 70 | + } |
| 71 | + |
| 72 | + |
| 73 | + |
| 74 | + file = new javaxt.io.File(share.toString() + filename); |
| 75 | + if (!file.exists()) file = new javaxt.io.File(share.toString() + "downloads/" + filename); |
| 76 | + |
| 77 | + //System.out.println("Download: " + file); |
| 78 | + |
| 79 | + if (!file.exists()){ |
| 80 | + throw new ServletException(); |
| 81 | + } |
| 82 | + |
| 83 | + } |
| 84 | + |
| 85 | + |
| 86 | + public javaxt.io.File getFile(){ |
| 87 | + return file; |
| 88 | + } |
| 89 | + |
| 90 | + //************************************************************************** |
| 91 | + //** sendFile |
| 92 | + //************************************************************************** |
| 93 | + /** Used to send a static file to the client. |
| 94 | + */ |
| 95 | + public void send(HttpServletResponse response) throws java.io.IOException { |
| 96 | + String contentType = file.getContentType(); |
| 97 | + if (file.getExtension().equalsIgnoreCase("xml")) contentType = "text/xml"; |
| 98 | + response.write(file.toFile(), contentType, true); |
| 99 | + } |
| 100 | + |
| 101 | +} |
0 commit comments