Forum:

Creating a directory within a webapp

Ranch Hand

Posts: 30

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi guys,
My ultimate goal is to create a directory for each user of my webapp within Tomcat. So I'd have /ROOT/users/user1. So I made a test jsp within /tomcat/webapps/ROOT:

"pwd" is correct but "success" is false and the catch error doesn't print.

My question is: is this a sys admin problem or a Tomcat/JAVA security problem?

Thanks.
Chris
[ December 03, 2008: Message edited by: Gregg Bolinger ]

Gregg Bolinger

Ranch Hand

Posts: 15304

I like...

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

There are all sorts of red flags with this approach.

For one, if you put user folders under ROOT like that then I can go to http://yourwebsite/users/user1 and access all their files. You *could* protect this with a filter of sorts but the better approach is to create those kinds of things in a folder that isn't web accessible. At the very least, write them to the WEB-INF folder but preferably they'd be placed completely outside of the Tomcat install.

Secondly, you should really be doing this work in a servlet, not a JSP.

Please use UBB code tags (the word code inside of [ ]) when showing code as to preserver your formatting. Looking at it as is, is very difficult.

Gregg Bolinger

Ranch Hand

Posts: 15304

I like...

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

My question is: is this a sys admin problem or a Tomcat/JAVA security problem?

Possibly. We don't know enough about your environment to know for sure. But other than the extra ( ) around your new File call that part of the code seems like it should work.

Also, you said pwd is ok, but are you sure? It might help to give us all the details.

Ben Souther

Sheriff

Posts: 13411

I like...

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Another red flag I see is this:

I'm not exactly sure why you're setting the user.dir property at the system level but I expect you'll see some concurrency issues once you get a few users hitting this at the same time.

Java API J2EE API Servlet Spec JSP Spec How to ask a question... Simple Servlet Examples jsonf

Chris Baty

Ranch Hand

Posts: 30

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

I thought that this would be a convenient approach for saving and accessing non-secure media files, similar to utube, but it's becoming more involved than I expected.

Thanks for the advice.

Chris

Chris Baty

Ranch Hand

Posts: 30

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

I got it going with the following code:

<%@ page language="java" contentType="text/html; charset=US-ASCII"
    pageEncoding="US-ASCII"%>
<%@ page import="java.util.*" %> 
<%@ page import="java.util.List"%>  
<%@ page import="java.util.Iterator"%>  
<%@ page import="java.io.File"%>  
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
<title>Insert title here</title>
</head>
<body>
<%String pwd = "";
pwd = request.getRealPath(request.getServletPath());
out.println("the initial relative path is : '"+pwd + "' <br>");

pwd = pwd.substring(0,this.getSlash(pwd));
out.println("the new relative path is : '"+pwd + "' <br>");

try {// Create one directory
String newD = "myDir";
File nwD = new File(pwd+newD);
boolean success = nwD.mkdir();
out.println("success = '"+success+"'");
if (success) {
out.println("new dir = '"+newD+"'");
    }
}catch (Exception e){//Catch exception if any
        out.println("Error: " + e.getMessage());
      }
 
%>
 
</body>
</html>
 
<%!public int getSlash(String sIn) {
for (int i=sIn.length()-1; i>=0; i--) {
if ( sIn.charAt(i) == '/' ||  sIn.charAt(i) == '\\' )
return i+1;
}
return 0;
}
%>