CB-4123 upload file fix

dbeaver · Oct 25, 2023 · 2bfd871 · 2bfd871
1 parent 7de4a45
commit 2bfd871
Showing 1 changed file with 14 additions and 2 deletions.
diff --git a/...r/bundles/io.cloudbeaver.service.fs/src/io/cloudbeaver/service/fs/model/WebFSServlet.java b/...r/bundles/io.cloudbeaver.service.fs/src/io/cloudbeaver/service/fs/model/WebFSServlet.java
@@ -16,6 +16,7 @@
  */
 package io.cloudbeaver.service.fs.model;
 
+import io.cloudbeaver.DBWConstants;
 import io.cloudbeaver.DBWebException;
 import io.cloudbeaver.model.session.WebSession;
 import io.cloudbeaver.server.CBApplication;
@@ -27,6 +28,7 @@
 import org.jkiss.dbeaver.model.data.json.JSONUtils;
 import org.jkiss.dbeaver.model.navigator.DBNNode;
 import org.jkiss.dbeaver.model.navigator.fs.DBNPathBase;
+import org.jkiss.dbeaver.model.rm.RMConstants;
 import org.jkiss.utils.CommonUtils;
 import org.jkiss.utils.IOUtils;
 
@@ -52,11 +54,17 @@ public WebFSServlet(CBApplication application, DBWServiceFS fs) {
     @Override
     protected void processServiceRequest(WebSession session, HttpServletRequest request, HttpServletResponse response) throws DBException, IOException {
         if (request.getMethod().equals("POST")) {
+            if (!session.hasPermission(RMConstants.PERMISSION_PROJECT_RESOURCE_EDIT)) {
+                response.sendError(HttpServletResponse.SC_FORBIDDEN, "The user needs more permissions to upload files to virtual file systems");
+                return;
+            }
+            // Hack for getting request params
+            request.setAttribute(Request.__MULTIPART_CONFIG_ELEMENT, new MultipartConfigElement(""));
             String nodePath = JSONUtils.getString(getVariables(request), NODE_PATH);
             Path path = getPath(session, nodePath);
+            // set the final location of parent folder
+            request.setAttribute(Request.__MULTIPART_CONFIG_ELEMENT, new MultipartConfigElement(path.toString()));
             try {
-                MultipartConfigElement MULTI_PART_CONFIG = new MultipartConfigElement(path.toString());
-                request.setAttribute(Request.__MULTIPART_CONFIG_ELEMENT, MULTI_PART_CONFIG);
                 for (Part part : request.getParts()) {
                     String fileName = part.getSubmittedFileName();
                     if (CommonUtils.isEmpty(fileName)) {
@@ -70,6 +78,10 @@ protected void processServiceRequest(WebSession session, HttpServletRequest requ
                 throw new DBWebException("Servlet exception ", e);
             }
         } else {
+            if (!session.hasPermission(RMConstants.PERMISSION_PROJECT_RESOURCE_VIEW)) {
+                response.sendError(HttpServletResponse.SC_FORBIDDEN, "The user needs more permissions to load files from virtual file systems");
+                return;
+            }
             Path path = getPath(session, request.getParameter(NODE_PATH));
             session.addInfoMessage("Download data ...");
             response.setHeader("Content-Type", "application/octet-stream");