Reject invalid resource names, like '.' and '..' in both server and web client. This...

diff --git a/src/gr/ebs/gss/client/FolderPropertiesDialog.java b/src/gr/ebs/gss/client/FolderPropertiesDialog.java
index eb6da0f..29c6fda 100644 (file)
--- a/src/gr/ebs/gss/client/FolderPropertiesDialog.java
+++ b/src/gr/ebs/gss/client/FolderPropertiesDialog.java
@@ -314,8 +314,13 @@ public class FolderPropertiesDialog extends DialogBox {
         * @param _folderName the name of the folder to create\r
         */\r
        private void createFolder() {\r
+               String name = folderName.getText();\r
+               if (!GSS.isValidResourceName(name)) {\r
+                       GSS.get().displayError("The folder name '" + name + "' is invalid");\r
+                       return;\r
+               }\r
                PostCommand ep = new PostCommand(folder.getUri() + "?new=" +\r
-                               URL.encodeComponent(folderName.getText()), "", 201) {\r
+                               URL.encodeComponent(name), "", 201) {\r
 \r
                        @Override\r
                        public void onComplete() {\r

diff --git a/src/gr/ebs/gss/client/GSS.java b/src/gr/ebs/gss/client/GSS.java
index a936d17..af95cac 100644 (file)
--- a/src/gr/ebs/gss/client/GSS.java
+++ b/src/gr/ebs/gss/client/GSS.java
@@ -810,4 +810,15 @@ public class GSS implements EntryPoint, ResizeHandler {
                return tokenInput;
 
        }
+
+       /**
+        * Reject illegal resource names, like '.' or '..'.
+        */
+       static boolean isValidResourceName(String name) {
+               if (".".equals(name) || "..".equals(name))
+                       return false;
+               return true;
+       }
+
+
 }

diff --git a/src/gr/ebs/gss/client/SearchResults.java b/src/gr/ebs/gss/client/SearchResults.java
index 19235a9..7537f25 100644 (file)
--- a/src/gr/ebs/gss/client/SearchResults.java
+++ b/src/gr/ebs/gss/client/SearchResults.java
@@ -675,7 +675,12 @@ public class SearchResults extends Composite implements  ClickHandler {
                startIndex = 0;
                app.showLoadingIndicator();
                if (query == null || query.trim().equals("")) {
-                       searchResults.setHTML("You must specify a query");
+                       searchResults.setHTML("You must specify a query.");
+                       setFiles(new ArrayList());
+                       update(true);
+                       app.hideLoadingIndicator();
+               } else if (!GSS.isValidResourceName(query)) {
+                       searchResults.setHTML("The query was invalid. Try to use words that appear in the file's name, contents or tags.");
                        setFiles(new ArrayList());
                        update(true);
                        app.hideLoadingIndicator();

diff --git a/src/gr/ebs/gss/server/rest/FilesHandler.java b/src/gr/ebs/gss/server/rest/FilesHandler.java
index b96078e..48d7bfa 100644 (file)
--- a/src/gr/ebs/gss/server/rest/FilesHandler.java
+++ b/src/gr/ebs/gss/server/rest/FilesHandler.java
@@ -706,6 +706,10 @@ public class FilesHandler extends RequestHandler {
                }
 
        String newName = req.getParameter(NEW_FOLDER_PARAMETER);
+       if (!isValidResourceName(newName)) {
+               resp.sendError(HttpServletResponse.SC_BAD_REQUEST);
+               return;
+       }
        boolean hasUpdateParam = req.getParameterMap().containsKey(RESOURCE_UPDATE_PARAMETER);
        boolean hasTrashParam = req.getParameterMap().containsKey(RESOURCE_TRASH_PARAMETER);
        boolean hasRestoreParam = req.getParameterMap().containsKey(RESOURCE_RESTORE_PARAMETER);

diff --git a/src/gr/ebs/gss/server/rest/GroupsHandler.java b/src/gr/ebs/gss/server/rest/GroupsHandler.java
index 76e148c..bfbe658 100644 (file)
--- a/src/gr/ebs/gss/server/rest/GroupsHandler.java
+++ b/src/gr/ebs/gss/server/rest/GroupsHandler.java
@@ -175,6 +175,10 @@ public class GroupsHandler extends RequestHandler {
                if (path.equals("/")) {
                        // Request to add group
                        final String group = req.getParameter(GROUP_PARAMETER);
+                       if (!isValidResourceName(group)) {
+                               resp.sendError(HttpServletResponse.SC_BAD_REQUEST);
+                               return;
+                       }
                        if (logger.isDebugEnabled())
                                logger.debug("Adding group " + group);
                                new TransactionHelper<Void>().tryExecute(new Callable<Void>() {
@@ -188,6 +192,10 @@ public class GroupsHandler extends RequestHandler {
                } else {
                        // Request to add group member
                        String username = req.getParameter(USERNAME_PARAMETER);
+                       if (!isValidResourceName(username)) {
+                               resp.sendError(HttpServletResponse.SC_BAD_REQUEST);
+                               return;
+                       }
                        // Chop any trailing slash
                        path = path.endsWith("/")? path.substring(0, path.length()-1): path;
                        // Chop any leading slash

diff --git a/src/gr/ebs/gss/server/rest/RequestHandler.java b/src/gr/ebs/gss/server/rest/RequestHandler.java
index cd2b8af..4e2c78e 100644 (file)
--- a/src/gr/ebs/gss/server/rest/RequestHandler.java
+++ b/src/gr/ebs/gss/server/rest/RequestHandler.java
@@ -742,4 +742,13 @@ public class RequestHandler extends Webdav {
                return result;
 
        }
+
+       /**
+        * Reject illegal resource names, like '.' or '..'.
+        */
+       protected boolean isValidResourceName(String name) {
+               if (".".equals(name) || "..".equals(name))
+                       return false;
+               return true;
+       }
 }

diff --git a/src/gr/ebs/gss/server/rest/SearchHandler.java b/src/gr/ebs/gss/server/rest/SearchHandler.java
index fff6e97..d1e931f 100644 (file)
--- a/src/gr/ebs/gss/server/rest/SearchHandler.java
+++ b/src/gr/ebs/gss/server/rest/SearchHandler.java
@@ -60,6 +60,10 @@ public class SearchHandler extends RequestHandler {
         String path = getInnerPath(req, PATH_SEARCH);
                if (path.equals(""))
                        path = "/";
+               if (!isValidResourceName(path)) {
+               resp.sendError(HttpServletResponse.SC_BAD_REQUEST);
+               return;
+       }
 
        if (!path.equals("/"))
                        try {