Apache/archiva
1
0
Fork 0
mirror of https://github.com/apache/archiva.git synced 2025-02-21 17:35:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding additional verifications for upload

Browse Source
This commit is contained in:
Martin Stockhammer 2019-02-24 14:56:11 +01:00
parent 52b971c593
commit c5bcbaabed
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java
View File

@ -70,6 +70,7 @@
import java.io.FileWriter;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardCopyOption;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
@ -183,15 +184,17 @@ protected synchronized List<FileMetadata> getSessionFilesList()
public Boolean deleteFile( String fileName )
throws ArchivaRestServiceException
{
File file = new File( SystemUtils.getJavaIoTmpDir(), fileName );
// we make sure, that there are no other path components in the filename:
String checkedFileName = Paths.get(fileName).getFileName().toString();
File file = new File( SystemUtils.getJavaIoTmpDir(), checkedFileName );
log.debug( "delete file:{},exists:{}", file.getPath(), file.exists() );
boolean removed = getSessionFileMetadatas().remove( new FileMetadata( fileName ) );
// try with full name as ui only know the file name
if ( !removed )
{
/* unused */ getSessionFileMetadatas().remove( new FileMetadata( file.getPath() ) );
removed = getSessionFileMetadatas().remove( new FileMetadata( file.getPath() ) );
}
if ( file.exists() )
if (removed && file.exists() )
{
return file.delete();
}