Fileupload java saves files to an inappropriate folder

Asked

Viewed 225 times

1

I found an example of fileupload on the internet and added it to my project. However, it moves the files up to a folder inside the glashfish server. This folder is named after /config, and all the way I put it to him to create, he creates only inside that folder config. But the application stays in another folder called Aplications.

How do I make it so that when it uploads the file, it uploads to the folders of the webcontent of the project? The path is set in the variable path_to.

package model;

import java.io.*;
import java.util.*;
import javax.faces.application.FacesMessage;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.ServletContext;
import javax.servlet.http.Part;

public class FileUpload {

    private final int limit_max_size = 10240000;
    private final String limit_type_file = "gif|jpg|png|jpeg|pdf|doc|docx|txt";
    private String path_to = "";

    public FileUpload() {

    }

    public String processUpload(Part fileUpload) {
        String fileSaveData = "noimages.jpg";

        try {

            if (fileUpload.getSize() > 0) {
                String submittedFileName = getFilename(fileUpload);
                if (checkFileType(submittedFileName)) {
                    if (fileUpload.getSize() > this.limit_max_size) {
                        FacesContext.getCurrentInstance().addMessage(null,
                                new FacesMessage(FacesMessage.SEVERITY_INFO, "File size too large!", ""));
                    } else {
                        String currentFileName = submittedFileName;
                        String extension = currentFileName.substring(currentFileName.lastIndexOf("."),
                                currentFileName.length());
                        long nameRadom = Calendar.getInstance().getTimeInMillis();
                        String newfilename = currentFileName;

                        fileSaveData = newfilename;
                        String fileSavePath = path_to;

                        try {
                            byte[] fileContent = new byte[(int) fileUpload.getSize()];
                            InputStream in = fileUpload.getInputStream();
                            in.read(fileContent);

                            File fileToCreate = new File(fileSavePath, newfilename);

                            File folder = new File(fileSavePath);
                            if (!folder.exists()) {
                                folder.mkdirs();
                            }
                            FileOutputStream fileOutStream = new FileOutputStream(fileToCreate);
                            fileOutStream.write(fileContent);
                            fileOutStream.flush();
                            fileOutStream.close();
                            fileSaveData = newfilename;
                        } catch (IOException e) {
                            fileSaveData = "noimages.jpg";
                        }

                    }

                } else {
                    fileSaveData = "noimages.jpg";

                }

            }
        } catch (Exception ex) {
            fileSaveData = "noimages.jpg";

        }
        return fileSaveData;
    }

    public String getPath_to() {
        return path_to;
    }

    public void setPath_to(String path_to) {
        this.path_to = path_to;
    }

    private String getFilename(Part part) {

        for (String cd : part.getHeader("content-disposition").split(";")) {
            if (cd.trim().startsWith("filename")) {
                String filename = cd.substring(cd.indexOf('=') + 1).trim().replace("\"", "");

                return filename.substring(filename.lastIndexOf('/') + 1).substring(filename.lastIndexOf('\\') + 1);

            }
        }
        return null;
    }

    private boolean checkFileType(String fileName) {
        if (fileName.length() > 0) {
            String[] parts = fileName.split("\\.");
            if (parts.length > 0) {
                String extention = parts[parts.length - 1];
                return this.limit_type_file.contains(extention);
            }
        }
        return false;
    }
}
  • Move files up inside the folder webcontent It would be a security flaw in my view, because assuming that the upload is something that you offer your users, it would allow any of them to end up changing the content of the application. It is true that you may not be offering this to ordinary users, and only to administrators, but the possibility of offering it to ordinary users already highlights the risk.

  • Right, but if it’s going up to the config folder, how can I access it to display the images in html ? because I keep the path that was saved in the bank and then put the path inside the img tag src

  • Or the correct thing would be to store it in a folder on the computer and not inside the application?

  • Yes, probably storing in a predefined folder is much better than trying to put inside the application. The download functionality for someone to view the image after or display it on some page, can be implemented through a Servlet or similar.

No answers

Browser other questions tagged

You are not signed in. Login or sign up in order to post.