struts file upload problem

[ec hurley]

I have a jsp that allows 5 files (very small) to be uploaded. I am getting the following error

java.security.AccessControlException: access denied (java.io.FilePermission C:\Sun\AppServer7\domains\domain1\server1\generated\jsp\j2ee-modules\sve\upload_00000000.tmp delete)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:269)
at java.security.AccessController.checkPermission(AccessController.java:401)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:524)
at java.lang.SecurityManager.checkDelete(SecurityManager.java:982)
at java.io.File.deleteOnExit(File.java:879)
at org.apache.commons.fileupload.DefaultFileItem.getTempFile(DefaultFileItem.java:620)
at org.apache.commons.fileupload.DefaultFileItem.getOutputStream(DefaultFileItem.java:557)
at org.apache.commons.fileupload.FileUploadBase.parseRequest(FileUploadBase.java:391)
at org.apache.struts.upload.CommonsMultipartRequestHandler.handleRequest(CommonsMultipartRequestHandler.java:233)
at org.apache.struts.util.RequestUtils.populate(RequestUtils.java:1209)
at org.apache.struts.action.RequestProcessor.processPopulate(RequestProcessor.java:821)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:254)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1482)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:525)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at org.apache.catalina.core.StandardWrapperValve.invokeServletService(StandardWrapperValve.java:720)
at org.apache.catalina.core.StandardWrapperValve.access$000(StandardWrapperValve.java:118)
at org.apache.catalina.core.StandardWrapperValve$1.run(StandardWrapperValve.java:278)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:274)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:505)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:212)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:505)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:203)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:505)
at com.iplanet.ias.web.connector.nsapi.NSAPIProcessor.process(NSAPIProcessor.java:158)
at com.iplanet.ias.web.WebContainer.service(WebContainer.java:598)

JSP
<%@page language="java"%>
<%@ page import="org.apache.struts.action.*,
com.acs.sve.forms.UploadForm"%>
<%@ taglib uri="/tags/struts-bean" prefix="bean" %>
<%@ taglib uri="/tags/struts-html" prefix="html" %>
<%@ taglib uri="/tags/struts-logic" prefix="logic" %>
<%@ page import="org.apache.struts.action.ActionErrors" %>


<jsp:useBean id="db" class="com.acs.sve.helper.DataBean" scope="session"/>


<TABLE width="100%" border="0" cellpadding="0" cellspacing="0">
<TR>
<TD height="10" colspan="2"> </TD>
</TR>
<html:form action="/UploadSubmit" method="POST" enctype="multipart/form-data">
<% for(int i=1; i<6;i++){%>
<TR>
<TD align="center" height="50" width="30%"><html:file property='<%="theFile"+i%>'/></TD>
<TD align="center" height="50" width="30%">
<html:radio property='<%="radioButton"+i%>' value="test"/>TEST<BR>
<% String at = db.getAuthType();
if(at.equalsIgnoreCase("prod")){%>
<html:radio property='<%="radioButton"+i%>' value="prod" />PROD<BR>
<%}%>
<html:radio property='<%="radioButton"+i%>' value="prod" />ACPT
</TD>
</TR>
<TR>
<TD height="10" colspan="2"><HR></TD>
</TR>
<%}%>

<TR>
<TD align="center" colspan="2">
<html:submit value="Submit"/><html:reset value="Reset"/>
</TD>
</TR>
<TR>
<TD colspan=2 align="left"><html:errors/></TD>
</TR>
</html:form>
</TABLE>
<html:errors/>

Action Class
package com.acs.sve.actions;

import org.apache.struts.action.Action;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.action.ActionForm;
import org.apache.struts.upload.FormFile;
import org.apache.log4j.Logger;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.acs.sve.helper.*;
import com.acs.sve.forms.UploadForm;

import java.io.*;

public class UploadAction extends Action{

Logger log = Logger.getLogger("UploadAction.class");
public ActionForward execute(ActionMapping mapping,
ActionForm form,
HttpServletRequest request,
HttpServletResponse response)
throws Exception {
log.info("In UploadAction");
String fileName = null;
int fileSize = 0;
String rb = null;
String contentType = null;
InputStream stream = null;
FormFile f;

ClearBean cb = new ClearBean();
cb.ClearArrays(request, response);

DataBean db = (DataBean) request.getSession().getAttribute("db");

UploadForm uploadForm = (UploadForm) form;

for (int i = 0; i < 5; i++ ){
log.info("\nint value = " + i);
f = getNextFile(i, uploadForm);
rb = getNextRadioButton(i, uploadForm);
log.info("radiobutton = " + rb);

fileName = f.getFileName();
log.info("filename =: " + fileName );

fileSize = f.getFileSize();
log.info("file size =: " + fileSize );

contentType = f.getContentType();
log.info("content type = : " + contentType );


if(!fileName.trim().equalsIgnoreCase("") && (f.getFileSize() > 0)){
try{
StringBuffer strbuf = new StringBuffer();
log.info("trying upload");
stream = f.getInputStream();
int bytesRead = 0;

while((bytesRead = stream.read()) > 0){
char s = (((char)bytesRead));
if (s != '\n' && s != '\r'){
strbuf.append((char)bytesRead);
}
}
stream.close();
db.setFileName(i, fileName);
db.addInpFiles(i,strbuf.toString());
log.info("\nFile\n" + strbuf.toString());
db.addButtonType(i,rb);

}catch(FileNotFoundException fnfe){
log.info("File Not Found Exception " + fileName);

}catch(IOException ioe){
log.info("IOException uploading " + fileName);
}
}

}
request.getSession().setAttribute("db",db);
log.info("db added back to session");
FileWrapper fw = new FileWrapper();
fw.buildWrapper(request, response);
log.info("File Wrapper completed");
log.info("Ready to submit files");

FileSubmit fs = new FileSubmit();
fs.submitFile(request, response);

return (mapping.findForward(Constants.UPLOAD_SUCCESS));
}
public FormFile getNextFile(int x, UploadForm uploadForm){
FormFile g = null;
switch(x){
case 0: g = uploadForm.getTheFile1();
break;
case 1: g = uploadForm.getTheFile2();
break;
case 2: g = uploadForm.getTheFile3();
break;
case 3: g = uploadForm.getTheFile4();
break;
case 4: g = uploadForm.getTheFile5();
break;
default:
break;
}
return g;
}

public String getNextRadioButton(int x, UploadForm uploadForm){
String r = null;
switch(x){
case 0: r = uploadForm.getRadioButton1();
break;
case 1: r = uploadForm.getRadioButton2();
break;
case 2: r = uploadForm.getRadioButton3();
break;
case 3: r = uploadForm.getRadioButton4();
break;
case 4: r = uploadForm.getRadioButton5();
break;
default:
break;
}
return r;
}


}

Action Form
package com.acs.sve.forms;


import org.apache.struts.action.*;
import org.apache.struts.upload.FormFile;

import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.action.ActionErrors;
import org.apache.struts.upload.FormFile;
import org.apache.struts.upload.MultipartRequestHandler;

import javax.servlet.http.HttpServletRequest;

public final class UploadForm extends ActionForm {
public static final String ERROR_PROPERTY_MAX_LENGTH_EXCEEDED = "com.acs.upload.MaxLengthExceeded";

private FormFile theFile1 = null;
private FormFile theFile2 = null;
private FormFile theFile3 = null;
private FormFile theFile4 = null;
private FormFile theFile5 = null;

private String radioButton1 = "test";
private String radioButton2 = "test";
private String radioButton3 = "test";
private String radioButton4 = "test";
private String radioButton5 = "test";


public FormFile getTheFile1(){
return theFile1;
}
public void setTheFile1(FormFile theFile1){
this.theFile1 = theFile1;
}
public FormFile getTheFile2(){
return theFile2;
}
public void setTheFile2(FormFile theFile2){
this.theFile2 = theFile2;
}
public FormFile getTheFile3(){
return theFile3;
}
public void setTheFile3(FormFile theFile3){
this.theFile3 = theFile3;
}
public FormFile getTheFile4(){
return theFile4;
}
public void setTheFile4(FormFile theFile4){
this.theFile4 = theFile4;
}
public FormFile getTheFile5(){
return theFile5;
}
public void setTheFile5(FormFile theFile5){
this.theFile5 = theFile5;
}


public void setRadioButton1(String radioButton1){
this.radioButton1 = radioButton1;
}
public String getRadioButton1(){
return radioButton1;
}
public void setRadioButton2(String radioButton2){
this.radioButton2 = radioButton2;
}
public String getRadioButton2(){
return radioButton2;
}
public void setRadioButton3(String radioButton3){
this.radioButton3 = radioButton3;
}
public String getRadioButton3(){
return radioButton3;
}
public void setRadioButton4(String radioButton4){
this.radioButton4 = radioButton4;
}
public String getRadioButton4(){
return radioButton4;
}

public void setRadioButton5(String radioButton5){
this.radioButton5 = radioButton5;
}
public String getRadioButton5(){
return radioButton5;
}

public void reset(ActionMapping mapping, HttpServletRequest request)
{
theFile1 = null;
theFile2 = null;
theFile3 = null;
theFile4 = null;
theFile5 = null;

this.radioButton1 = "test";
this.radioButton2 = "test";
this.radioButton3 = "test";
this.radioButton4 = "test";
this.radioButton5 = "test";


}

public ActionErrors validate(ActionMapping mapping,
HttpServletRequest request)
{
ActionErrors errors = null;
//has the maximum length been exceeded?
Boolean maxLengthExceeded = (Boolean)
request.getAttribute(MultipartRequestHandler.ATTRIBUTE_MAX_LENGTH_EXCEEDED);
if ((maxLengthExceeded != null) && (maxLengthExceeded.booleanValue()))
{
errors = new ActionErrors();
errors.add(ERROR_PROPERTY_MAX_LENGTH_EXCEEDED, new ActionError("maxLengthExceeded"));
}

return errors;
}
}


Can anyone help?

[Brent Sterling]

What OS are you running this on? It looks like the user that is running your app server does not have permission to delete files in the directory mentioned.

- Brent

[ec hurley]

I am running on Sun One App Server 7. Here is the policy file --

/* Copyright (c) 2002 Sun Microsystems, Inc. All rights reserved. */
/* Use is subject to license terms. */

// Core server classes get all permissions by default
grant codeBase "file:${com.sun.aas.installRoot}/lib/-" {
permission java.security.AllPermission;
};

// iMQ classes get all permissions by default
grant codeBase "file:${com.sun.aas.imqLib}/-" {
permission java.security.AllPermission;
};

// Web Services classes get all permissions by default
grant codeBase "file:${com.sun.aas.webServicesLib}/-" {
permission java.security.AllPermission;
};

// Basic set of required permissions granted to all remaining code
grant {
permission java.lang.RuntimePermission "loadLibrary.*";
permission java.lang.RuntimePermission "queuePrintJob";
permission java.net.SocketPermission "*", "connect";
permission java.io.FilePermission "<<ALL FILES>>", "read,write";
permission java.util.PropertyPermission "*", "read";

permission java.lang.RuntimePermission"modifyThreadGroup";
};


// Following grant block is only required by Connectors. If Connectors
// are not in use the recommendation is to remove this grant.
grant {
permission javax.security.auth.PrivateCredentialPermission "javax.resource.spi.security.PasswordCredential com.sun.enterprise.security.PrincipalImpl \"ANONYMOUS\"", "read";
};

// Following grant block is only required for Reflection. If Reflection
// is not in use the recommendation is to remove this section.
grant {
permission java.lang.RuntimePermission "accessDeclaredMembers";
};