From eb2a2d78152c7ca689e3aac116c107229a896a66 Mon Sep 17 00:00:00 2001
From: ulrich <undisclosed>
Date: Sat, 03 Mar 2018 19:34:54 +0000
Subject: [PATCH] Bug mit relativen Pfaden entfernt

---
 src/java/de/uhilger/filecms/api/FileMgr.java |  261 ++++++++++++++++++++++++++++------------------------
 1 files changed, 140 insertions(+), 121 deletions(-)

diff --git a/src/java/de/uhilger/filecms/api/FileMgr.java b/src/java/de/uhilger/filecms/api/FileMgr.java
index 7046af4..8e63002 100644
--- a/src/java/de/uhilger/filecms/api/FileMgr.java
+++ b/src/java/de/uhilger/filecms/api/FileMgr.java
@@ -141,85 +141,94 @@
   
   
   public FileRef newFolder(String relPath, String folderName) {
-    logger.finer(relPath);
-    String targetPath = null;
-    if(relPath.startsWith(PUB_DIR_NAME)) {
-      targetPath = PUB_DIR_PATH + getUserName() + "/" + relPath.substring(PUB_DIR_NAME.length()) + "/" + folderName;
-    } else if(relPath.startsWith(HOME_DIR_NAME)) {
-      targetPath = HOME_DIR_PATH + getUserName() + "/" + relPath.substring(HOME_DIR_NAME.length()) + "/" + folderName;
+    if (!relPath.startsWith(".")) {
+      logger.finer(relPath);
+      String targetPath = null;
+      if(relPath.startsWith(PUB_DIR_NAME)) {
+        targetPath = PUB_DIR_PATH + getUserName() + "/" + relPath.substring(PUB_DIR_NAME.length()) + "/" + folderName;
+      } else if(relPath.startsWith(HOME_DIR_NAME)) {
+        targetPath = HOME_DIR_PATH + getUserName() + "/" + relPath.substring(HOME_DIR_NAME.length()) + "/" + folderName;
+      } else {
+        // kann eigentlich nicht sein..
+      }
+      logger.finer(targetPath);
+      File targetDir = new File(getBase().getAbsolutePath(), targetPath);
+      targetDir.mkdirs();
+      return new FileRef(targetDir.getAbsolutePath(), true);
     } else {
-      // kann eigentlich nicht sein..
+      return null;
     }
-    logger.finer(targetPath);
-    File targetDir = new File(getBase().getAbsolutePath(), targetPath);
-    targetDir.mkdirs();
-    return new FileRef(targetDir.getAbsolutePath(), true);
   }
   
   public String getCode(String relPath, String fileName) {
     String code = null;
-    
-    Object p = getRequest().getUserPrincipal();
-    if(p instanceof Principal) {
-      Reader reader = null;
-      try {
-        File targetFile = new File(getTargetDir(relPath), fileName);
-        
-        //reader = new InputStreamReader(new FileInputStream(targetFile), "UTF8");
-        
-        reader = new FileReader(targetFile);
-        StringBuffer buf = new StringBuffer();
-        char[] readBuffer = new char[1024];
-        int charsRead = reader.read(readBuffer);
-        while(charsRead > -1) {
-          buf.append(readBuffer, 0, charsRead);
-          charsRead = reader.read(readBuffer);
-        }
-        code = buf.toString();
-      } catch (FileNotFoundException ex) {
-        Logger.getLogger(FileMgr.class.getName()).log(Level.SEVERE, null, ex);
-      } catch (IOException ex) {
-        Logger.getLogger(FileMgr.class.getName()).log(Level.SEVERE, null, ex);
-      } finally {
+    if (!relPath.startsWith(".")) {
+      Object p = getRequest().getUserPrincipal();
+      if (p instanceof Principal) {
+        Reader reader = null;
         try {
-          reader.close();
+          File targetFile = new File(getTargetDir(relPath), fileName);
+
+          //reader = new InputStreamReader(new FileInputStream(targetFile), "UTF8");
+          reader = new FileReader(targetFile);
+          StringBuffer buf = new StringBuffer();
+          char[] readBuffer = new char[1024];
+          int charsRead = reader.read(readBuffer);
+          while (charsRead > -1) {
+            buf.append(readBuffer, 0, charsRead);
+            charsRead = reader.read(readBuffer);
+          }
+          code = buf.toString();
+        } catch (FileNotFoundException ex) {
+          Logger.getLogger(FileMgr.class.getName()).log(Level.SEVERE, null, ex);
         } catch (IOException ex) {
           Logger.getLogger(FileMgr.class.getName()).log(Level.SEVERE, null, ex);
+        } finally {
+          try {
+            reader.close();
+          } catch (IOException ex) {
+            Logger.getLogger(FileMgr.class.getName()).log(Level.SEVERE, null, ex);
+          }
         }
+
       }
-      
-    }    
-    
+    }
     return code;
   }
   
   public String renameFile(String relPath, String fname, String newName) {
-    File targetDir = getTargetDir(relPath);
-    File file = new File(targetDir, fname);
-    file.renameTo(new File(targetDir, newName));
-    return fname + " umbenannt zu " + newName;
+    if (!relPath.startsWith(".")) {
+      File targetDir = getTargetDir(relPath);
+      File file = new File(targetDir, fname);
+      file.renameTo(new File(targetDir, newName));
+      return fname + " umbenannt zu " + newName;
+    } else {
+      return "Pfad nicht erlaubt.";
+    }
   }
   
   public String deleteFiles(String relPath, List fileNames) {
     String result = null;
     try {
       logger.fine(fileNames.toString());
-      File targetDir = getTargetDir(relPath);
-      for(int i=0; i < fileNames.size(); i++) {
-        Object o = fileNames.get(i);
-        if(o instanceof ArrayList) {
-          ArrayList al = (ArrayList) o;
-          logger.fine(al.get(0).toString());
-          File targetFile = new File(targetDir, al.get(0).toString());
-          logger.fine(targetFile.getAbsolutePath());
-          if(targetFile.isDirectory()) {
-            FileUtils.deleteDirectory(targetFile);
-          } else {
-            targetFile.delete();
+      if (!relPath.startsWith(".")) {
+        File targetDir = getTargetDir(relPath);
+        for(int i=0; i < fileNames.size(); i++) {
+          Object o = fileNames.get(i);
+          if(o instanceof ArrayList) {
+            ArrayList al = (ArrayList) o;
+            logger.fine(al.get(0).toString());
+            File targetFile = new File(targetDir, al.get(0).toString());
+            logger.fine(targetFile.getAbsolutePath());
+            if(targetFile.isDirectory()) {
+              FileUtils.deleteDirectory(targetFile);
+            } else {
+              targetFile.delete();
+            }
           }
         }
+        result = "deleted";
       }
-      result = "deleted";
     } catch (Throwable ex) {
       logger.log(Level.SEVERE, ex.getLocalizedMessage(), ex);
     }
@@ -237,25 +246,27 @@
   private String copyOrMoveFiles(String fromPath, String toPath, List fileNames, int operation) {
     String result = null;
     try {
-      File srcDir = getTargetDir(fromPath);
-      File targetDir = getTargetDir(toPath);
-      Iterator i = fileNames.iterator();
-      while(i.hasNext()) {
-        Object o = i.next();
-        if (o instanceof ArrayList) {
-          ArrayList al = (ArrayList) o;
-          File srcFile = new File(srcDir, al.get(0).toString());
-          if(srcFile.isDirectory()) {
-            if(operation == OP_MOVE) {
-              FileUtils.moveDirectoryToDirectory(srcFile, targetDir, false);
+      if (!fromPath.startsWith(".")) {
+        File srcDir = getTargetDir(fromPath);
+        File targetDir = getTargetDir(toPath);
+        Iterator i = fileNames.iterator();
+        while(i.hasNext()) {
+          Object o = i.next();
+          if (o instanceof ArrayList) {
+            ArrayList al = (ArrayList) o;
+            File srcFile = new File(srcDir, al.get(0).toString());
+            if(srcFile.isDirectory()) {
+              if(operation == OP_MOVE) {
+                FileUtils.moveDirectoryToDirectory(srcFile, targetDir, false);
+              } else {
+                FileUtils.copyDirectoryToDirectory(srcFile, targetDir);
+              }
             } else {
-              FileUtils.copyDirectoryToDirectory(srcFile, targetDir);
-            }
-          } else {
-            if(operation == OP_MOVE) {
-              FileUtils.moveFileToDirectory(srcFile, targetDir, false);
-            } else {
-              FileUtils.copyFileToDirectory(srcFile, targetDir);              
+              if(operation == OP_MOVE) {
+                FileUtils.moveFileToDirectory(srcFile, targetDir, false);
+              } else {
+                FileUtils.copyFileToDirectory(srcFile, targetDir);              
+              }
             }
           }
         }
@@ -269,16 +280,18 @@
   public FileRef saveTextFileAs(String relPath, String fileName, String contents) {
     FileRef savedFile = null;
     logger.fine(relPath + " " + fileName);
-    //FileRef datenRef = getBase();
-    Object p = getRequest().getUserPrincipal();
-    if(p instanceof Principal) {
-      File targetFile = new File(getTargetDir(relPath), fileName);
-      if(targetFile.exists()) {
-        targetFile = getNewFileName(targetFile);
-      } else {
-        targetFile.getParentFile().mkdirs();
+    if (!relPath.startsWith(".")) {
+      //FileRef datenRef = getBase();
+      Object p = getRequest().getUserPrincipal();
+      if(p instanceof Principal) {
+        File targetFile = new File(getTargetDir(relPath), fileName);
+        if(targetFile.exists()) {
+          targetFile = getNewFileName(targetFile);
+        } else {
+          targetFile.getParentFile().mkdirs();
+        }
+        saveToFile(targetFile, contents);
       }
-      saveToFile(targetFile, contents);
     }
     return savedFile;
   }
@@ -334,34 +347,36 @@
   public FileRef saveTextFile(String relPath, String fileName, String contents) {
     FileRef savedFile = null;
     logger.fine(relPath + " " + fileName);
-    //FileRef datenRef = getBase();
-    Object p = getRequest().getUserPrincipal();
-    if(p instanceof Principal) {
-      File targetFile = new File(getTargetDir(relPath), fileName);
-      if(targetFile.exists()) {
-        /*
-          muss delete() sein?
-          pruefen: ueberschreibt der FileWriter den alteen Inhalt oder 
-          entsteht eine unerwuenschte Mischung aus altem und neuem 
-          Inhalt?
-        */
-        targetFile.delete();
-      } else {
-        targetFile.getParentFile().mkdirs();
+    if (!relPath.startsWith(".")) {    
+      //FileRef datenRef = getBase();
+      Object p = getRequest().getUserPrincipal();
+      if(p instanceof Principal) {
+        File targetFile = new File(getTargetDir(relPath), fileName);
+        if(targetFile.exists()) {
+          /*
+            muss delete() sein?
+            pruefen: ueberschreibt der FileWriter den alteen Inhalt oder 
+            entsteht eine unerwuenschte Mischung aus altem und neuem 
+            Inhalt?
+          */
+          targetFile.delete();
+        } else {
+          targetFile.getParentFile().mkdirs();
+        }
+        saveToFile(targetFile, contents);
       }
-      saveToFile(targetFile, contents);
     }
     return savedFile;
   }
   
   public String bildVerkleinern(String relPath, String bildName) {
-    File dir = getTargetDir(relPath);
-    File original = new File(dir, bildName);
-    Bild bild = new Bild();
-    //for (int i = 0; i < Bild.GR.length; i++) {
-    
+    if (!relPath.startsWith(".")) {
+      File dir = getTargetDir(relPath);
+      File original = new File(dir, bildName);
+      Bild bild = new Bild();
+      //for (int i = 0; i < Bild.GR.length; i++) {
+
       //int gr = bild.getVariantenGroesse(i);
-      
       String ext = "";
       String nurname = bildName;
       int dotpos = bildName.indexOf(".");
@@ -369,47 +384,51 @@
         ext = bildName.substring(dotpos);
         nurname = bildName.substring(0, dotpos);
       }
-        
+
       Image image = Toolkit.getDefaultToolkit().getImage(original.getAbsolutePath());
       MediaTracker mediaTracker = new MediaTracker(new Container());
       mediaTracker.addImage(image, 0);
       try {
         mediaTracker.waitForID(0);
 
-        if(!mediaTracker.isErrorAny()) {
-          for(int i = 0; i < Bild.GR.length; i++) {
+        if (!mediaTracker.isErrorAny()) {
+          for (int i = 0; i < Bild.GR.length; i++) {
             StringBuffer buf = new StringBuffer();
             buf.append(nurname);
             buf.append(bild.getVariantenName(i));
             buf.append(ext);
             File newImgFile = new File(dir, buf.toString());
-            if(!newImgFile.exists()) {
+            if (!newImgFile.exists()) {
               logger.fine(original.getAbsolutePath() + " " + newImgFile.getAbsolutePath());
               bild.writeImageFile(image, bild.getVariantenGroesse(i), bild.getMimeType(original), newImgFile.getAbsolutePath());
               //bild.writeImageFile(image, photo.getVariantenGroesse(i), photo.getMimetype(), photo.getAbsolutePath(basisPfad), photo.getVariantenName(basisPfad, i));
             }
           }
         }
-      } catch(IOException | InterruptedException ex) {
+      } catch (IOException | InterruptedException ex) {
         logger.log(Level.SEVERE, ex.getLocalizedMessage(), ex);
       }
-
-    return "ok";
+      return "ok";
+    } else {
+      return "Pfad micht erlaubt.";
+    }
   }
   
   public String extractZipfile(String relPath, String filename) {
-    String result;
-    try {
-      File targetDir = getTargetDir(relPath);
-      File archive = new File(targetDir, filename);
-      if(extract(archive)) {
-        result = "ok";
-      } else {
-        result = "error while extracting";
+    String result = null;
+    if (!relPath.startsWith(".")) {    
+      try {
+        File targetDir = getTargetDir(relPath);
+        File archive = new File(targetDir, filename);
+        if(extract(archive)) {
+          result = "ok";
+        } else {
+          result = "error while extracting";
+        }
+      } catch(Exception ex) {
+        result = ex.getLocalizedMessage();
+        logger.log(Level.SEVERE, ex.getLocalizedMessage(), ex);
       }
-    } catch(Exception ex) {
-      result = ex.getLocalizedMessage();
-      logger.log(Level.SEVERE, ex.getLocalizedMessage(), ex);
     }
     return result;
   }

--
Gitblit v1.9.3