Synnefo

/*

 * Copyright 2008, 2009 Electronic Business Systems Ltd.

 *

 * This file is part of GSS.

 *

 * GSS is free software: you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * GSS is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with GSS.  If not, see <http://www.gnu.org/licenses/>.

 */

package gr.ebs.gss.server.rest;

import gr.ebs.gss.client.exceptions.DuplicateNameException;

import gr.ebs.gss.client.exceptions.GSSIOException;

import gr.ebs.gss.client.exceptions.InsufficientPermissionsException;

import gr.ebs.gss.client.exceptions.ObjectNotFoundException;

import gr.ebs.gss.client.exceptions.QuotaExceededException;

import gr.ebs.gss.client.exceptions.RpcException;

import gr.ebs.gss.server.domain.FileUploadStatus;

import gr.ebs.gss.server.domain.User;

import gr.ebs.gss.server.domain.dto.FileBodyDTO;

import gr.ebs.gss.server.domain.dto.FileHeaderDTO;

import gr.ebs.gss.server.domain.dto.FolderDTO;

import gr.ebs.gss.server.domain.dto.GroupDTO;

import gr.ebs.gss.server.domain.dto.PermissionDTO;

import gr.ebs.gss.server.ejb.ExternalAPI;

import gr.ebs.gss.server.webdav.Range;

import java.io.BufferedReader;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStreamWriter;

import java.io.PrintWriter;

import java.io.UnsupportedEncodingException;

import java.net.URI;

import java.net.URISyntaxException;

import java.net.URLDecoder;

import java.net.URLEncoder;

import java.util.ArrayList;

import java.util.Collection;

import java.util.Date;

import java.util.HashSet;

import java.util.List;

import java.util.Set;

import java.util.StringTokenizer;

import java.util.concurrent.Callable;

import javax.servlet.ServletContext;

import javax.servlet.ServletException;

import javax.servlet.ServletOutputStream;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.apache.commons.fileupload.FileItemIterator;

import org.apache.commons.fileupload.FileItemStream;

import org.apache.commons.fileupload.FileUploadException;

import org.apache.commons.fileupload.ProgressListener;

import org.apache.commons.fileupload.servlet.ServletFileUpload;

import org.apache.commons.fileupload.util.Streams;

import org.apache.commons.httpclient.util.DateParseException;

import org.apache.commons.httpclient.util.DateUtil;

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import org.json.JSONArray;

import org.json.JSONException;

import org.json.JSONObject;

/**

 * A class that handles operations on the 'files' namespace.

 *

 * @author past

 */

public class FilesHandler extends RequestHandler {

        /**

         * The request parameter name for fetching a different version.

         */

        private static final String VERSION_PARAM = "version";

        /**

         * The request attribute containing the owner of the destination URI

         * in a copy or move request.

         */

        private static final String DESTINATION_OWNER_ATTRIBUTE = "destOwner";

        private static final int TRACK_PROGRESS_PERCENT = 5;

        /**

         * The form parameter name that contains the signature in a browser POST upload.

         */

        private static final String AUTHORIZATION_PARAMETER = "Authorization";

        /**

         * The form parameter name that contains the date in a browser POST upload.

         */

        private static final String DATE_PARAMETER = "Date";

        /**

         * The request parameter name for making an upload progress request.

         */

        private static final String PROGRESS_PARAMETER = "progress";

        /**

         * The request parameter name for restoring a previous version of a file.

         */

        private static final String RESTORE_VERSION_PARAMETER = "restoreVersion";

        /**

         * The logger.

         */

        private static Log logger = LogFactory.getLog(FilesHandler.class);

        /**

         * The servlet context provided by the call site.

         */

        private ServletContext context;

        /**

         * @param servletContext

         */

        public FilesHandler(ServletContext servletContext) {

                context = servletContext;

        }

        /**

     * Serve the specified resource, optionally including the data content.

     *

     * @param req The servlet request we are processing

     * @param resp The servlet response we are creating

     * @param content Should the content be included?

     *

     * @exception IOException if an input/output error occurs

     * @exception ServletException if a servlet-specified error occurs

     * @throws RpcException

     * @throws InsufficientPermissionsException

     * @throws ObjectNotFoundException

     */

        @Override

        protected void serveResource(HttpServletRequest req, HttpServletResponse resp, boolean content)

                    throws IOException, ServletException {

                boolean authDeferred = getAuthDeferred(req);

        String path = getInnerPath(req, PATH_FILES);

                if (path.equals(""))

                        path = "/";

                try {

                        path = URLDecoder.decode(path, "UTF-8");

                } catch (IllegalArgumentException e) {

                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());

                        return;

                }

            String progress = req.getParameter(PROGRESS_PARAMETER);

            if (logger.isDebugEnabled())

                        if (content)

                            logger.debug("Serving resource '" +        path + "' headers and data");

                    else

                            logger.debug("Serving resource '" +        path + "' headers only");

            User user = getUser(req);

            User owner = getOwner(req);

            if (user == null) user = owner;

        boolean exists = true;

        Object resource = null;

        FileHeaderDTO file = null;

        FolderDTO folder = null;

        try {

                resource = getService().getResourceAtPath(owner.getId(), path, false);

        } catch (ObjectNotFoundException e) {

            exists = false;

        } catch (RpcException e) {

                resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                        return;

                }

            if (!exists) {

                        if (authDeferred) {

                                // We do not want to leak information if the request

                                // was not authenticated.

                                resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                                return;

                        }

                    // A request for upload progress.

                    if (progress != null && content) {

                            serveProgress(req, resp, progress, user, null);

                                return;

                    }

                    resp.sendError(HttpServletResponse.SC_NOT_FOUND, req.getRequestURI());

                    return;

            }

            if (resource instanceof FolderDTO)

                    folder = (FolderDTO) resource;

            else

                    file = (FileHeaderDTO) resource;

            // Now it's time to perform the deferred authentication check.

                // Since regular signature checking was already performed,

                // we need to check the read-all flag or the signature-in-parameters.

                if (authDeferred)

                        if (file != null && !file.isReadForAll() && content) {

                                // Check for GET with the signature in the request parameters.

                                String auth = req.getParameter(AUTHORIZATION_PARAMETER);

                                String dateParam = req.getParameter(DATE_PARAMETER);

                                if (auth == null || dateParam == null) {

                                        resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                                        return;

                                }

                            long timestamp;

                                try {

                                        timestamp = DateUtil.parseDate(dateParam).getTime();

                                } catch (DateParseException e) {

                                    resp.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());

                                    return;

                                }

                            if (!isTimeValid(timestamp)) {

                                    resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                                    return;

                            }

                                // Fetch the Authorization parameter and find the user specified in it.

                                String[] authParts = auth.split(" ");

                                if (authParts.length != 2) {

                                    resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                                    return;

                            }

                                String username = authParts[0];

                                String signature = authParts[1];

                                user = null;

                                try {

                                        user = getService().findUser(username);

                                } catch (RpcException e) {

                                resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                                        return;

                                }

                                if (user == null) {

                                    resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                                    return;

                            }

                                req.setAttribute(USER_ATTRIBUTE, user);

                                // Remove the servlet path from the request URI.

                                String p = req.getRequestURI();

                                String servletPath = req.getContextPath() + req.getServletPath();

                                p = p.substring(servletPath.length());

                                // Validate the signature in the Authorization parameter.

                                String data = req.getMethod() + dateParam + p;

                                if (!isSignatureValid(signature, user, data)) {

                                    resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                                    return;

                            }

                        } else if (file != null && !file.isReadForAll() || file == null) {

                                // Check for a read-for-all file request.

                                resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                                return;

                        }

            // If the resource is not a collection, and the resource path

            // ends with "/" or "\", return NOT FOUND.

            if (folder == null)

                        if (path.endsWith("/") || path.endsWith("\\")) {

                            resp.sendError(HttpServletResponse.SC_NOT_FOUND, req.getRequestURI());

                            return;

                    }

            // Workaround for IE's broken caching behavior.

            if (folder != null)

                    resp.setHeader("Expires", "-1");

            // A request for upload progress.

            if (progress != null && content) {

                    if (file == null) {

                            resp.sendError(HttpServletResponse.SC_BAD_REQUEST);

                            return;

                    }

                    serveProgress(req, resp, progress, user, file);

                        return;

            }

                // Fetch the version to retrieve, if specified.

                String verStr = req.getParameter(VERSION_PARAM);

                int version = 0;

                FileBodyDTO oldBody = null;

                if (verStr != null && file != null)

                        try {

                                version = Integer.valueOf(verStr);

                        } catch (NumberFormatException e) {

                                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, req.getRequestURI());

                            return;

                        }

                if (version > 0)

                        try {

                                oldBody = getService().getFileVersion(user.getId(), file.getId(), version);

                        } catch (RpcException e) {

                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                                return;

                        } catch (ObjectNotFoundException e) {

                            resp.sendError(HttpServletResponse.SC_NOT_FOUND);

                            return;

                        } catch (InsufficientPermissionsException e) {

                            resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                            return;

                        }

            // Check if the conditions specified in the optional If headers are

            // satisfied. Doing this for folders would require recursive checking

            // for all of their children, which in turn would defy the purpose of

            // the optimization.

            if (folder == null)

                        // Checking If headers.

                    if (!checkIfHeaders(req, resp, file, oldBody))

                                return;

            // Find content type.

            String contentType = null;

            if (file != null) {

                contentType = version>0 ? oldBody.getMimeType() : file.getMimeType();

                if (contentType == null) {

                        contentType = context.getMimeType(file.getName());

                        file.setMimeType(contentType);

                }

            } else

                        contentType = "application/json;charset=UTF-8";

            ArrayList ranges = null;

            long contentLength = -1L;

            if (file != null) {

                    // Parse range specifier.

                    ranges = parseRange(req, resp, file, oldBody);

                    // ETag header

                    resp.setHeader("ETag", getETag(file, oldBody));

                    // Last-Modified header.

                    String lastModified = oldBody == null ?

                                            getLastModifiedHttp(file.getAuditInfo()) :

                                            getLastModifiedHttp(oldBody.getAuditInfo());

                    resp.setHeader("Last-Modified", lastModified);

                    // X-GSS-Metadata header.

                    try {

                                resp.setHeader("X-GSS-Metadata", renderJson(user, file, oldBody));

                        } catch (InsufficientPermissionsException e) {

                                resp.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                        return;

                }

                    // Get content length.

                    contentLength = version>0 ? oldBody.getFileSize() : file.getFileSize();

                    // Special case for zero length files, which would cause a

                    // (silent) ISE when setting the output buffer size.

                    if (contentLength == 0L)

                                content = false;

            } else

                    // Set the folder X-GSS-Metadata header.

                    try {

                                resp.setHeader("X-GSS-Metadata", renderJsonMetadata(user, folder));

                        } catch (InsufficientPermissionsException e) {

                                resp.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                        return;

                }

            ServletOutputStream ostream = null;

            PrintWriter writer = null;

            if (content)

                        try {

                            ostream = resp.getOutputStream();

                    } catch (IllegalStateException e) {

                            // If it fails, we try to get a Writer instead if we're

                            // trying to serve a text file

                            if ( contentType == null

                                                    || contentType.startsWith("text")

                                                    || contentType.endsWith("xml") )

                                        writer = resp.getWriter();

                                else

                                        throw e;

                    }

            if (folder != null

                                    || (ranges == null || ranges.isEmpty())

                                                            && req.getHeader("Range") == null

                                                            || ranges == FULL) {

                    // Set the appropriate output headers

                    if (contentType != null) {

                            if (logger.isDebugEnabled())

                                    logger.debug("contentType='" + contentType + "'");

                            resp.setContentType(contentType);

                    }

                    if (file != null && contentLength >= 0) {

                            if (logger.isDebugEnabled())

                                    logger.debug("contentLength=" + contentLength);

                            if (contentLength < Integer.MAX_VALUE)

                                        resp.setContentLength((int) contentLength);

                                else

                                        // Set the content-length as String to be able to use a long

                                    resp.setHeader("content-length", "" + contentLength);

                    }

                    InputStream renderResult = null;

                    if (folder != null)

                                if (content)

                                        // Serve the directory browser

                                    try {

                                                renderResult = renderJson(user, folder);

                                        } catch (InsufficientPermissionsException e) {

                                                resp.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                                        return;

                                        }

                    // Copy the input stream to our output stream (if requested)

                    if (content) {

                            try {

                                    resp.setBufferSize(output);

                            } catch (IllegalStateException e) {

                                    // Silent catch

                            }

                            try {

                                    if(file != null)

                                                if (needsContentDisposition(req))

                                                    resp.setHeader("Content-Disposition","attachment; filename*=UTF-8''"+URLEncoder.encode(file.getName(),"UTF-8"));

                                            else

                                                    resp.setHeader("Content-Disposition","inline; filename*=UTF-8''"+URLEncoder.encode(file.getName(),"UTF-8"));

                                    if (ostream != null)

                                                copy(file, renderResult, ostream, req, oldBody);

                                        else

                                                copy(file, renderResult, writer, req, oldBody);

                                    if (file!=null) getService().updateAccounting(owner, new Date(), contentLength);

                        } catch (ObjectNotFoundException e) {

                                resp.sendError(HttpServletResponse.SC_NOT_FOUND);

                                return;

                        } catch (InsufficientPermissionsException e) {

                                resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                                return;

                        } catch (RpcException e) {

                                resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);

                                return;

                        }

                    }

            } else {

                    if (ranges == null || ranges.isEmpty())

                            return;

                    // Partial content response.

                    resp.setStatus(HttpServletResponse.SC_PARTIAL_CONTENT);

                    if (ranges.size() == 1) {

                            Range range = (Range) ranges.get(0);

                            resp.addHeader("Content-Range", "bytes "

                                                    + range.start

                                                    + "-" + range.end + "/"

                                                    + range.length);

                            long length = range.end - range.start + 1;

                            if (length < Integer.MAX_VALUE)

                                        resp.setContentLength((int) length);

                                else

                                        // Set the content-length as String to be able to use a long

                                    resp.setHeader("content-length", "" + length);

                            if (contentType != null) {

                                    if (logger.isDebugEnabled())

                                            logger.debug("contentType='" + contentType + "'");

                                    resp.setContentType(contentType);

                            }

                            if (content) {

                                    try {

                                            resp.setBufferSize(output);

                                    } catch (IllegalStateException e) {

                                            // Silent catch

                                    }

                                    try {

                                            if (ostream != null)

                                                        copy(file, ostream, range, req, oldBody);

                                                else

                                                        copy(file, writer, range, req, oldBody);

                                            getService().updateAccounting(owner, new Date(), contentLength);

                                } catch (ObjectNotFoundException e) {

                                        resp.sendError(HttpServletResponse.SC_NOT_FOUND);

                                        return;

                                } catch (InsufficientPermissionsException e) {

                                        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                                        return;

                                } catch (RpcException e) {

                                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);

                                        return;

                                }

                            }

                    } else {

                            resp.setContentType("multipart/byteranges; boundary=" + mimeSeparation);

                            if (content) {

                                    try {

                                            resp.setBufferSize(output);

                                    } catch (IllegalStateException e) {

                                            // Silent catch

                                    }

                                    try {

                                            if (ostream != null)

                                                        copy(file, ostream, ranges.iterator(), contentType, req, oldBody);

                                                else

                                                        copy(file, writer, ranges.iterator(), contentType, req, oldBody);

                                            getService().updateAccounting(owner, new Date(), contentLength);

                                } catch (ObjectNotFoundException e) {

                                        resp.sendError(HttpServletResponse.SC_NOT_FOUND);

                                        return;

                                } catch (InsufficientPermissionsException e) {

                                        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                                        return;

                                } catch (RpcException e) {

                                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);

                                        return;

                                }

                            }

                    }

            }

    }

        /**

         * Determines whether the user agent needs the Content-Disposition

         * header to be set, in order to properly download a file.

         *

         * @param req the HTTP request

         * @return true if the Content-Disposition HTTP header must be set

         */

        private boolean needsContentDisposition(HttpServletRequest req) {

                /*String agent = req.getHeader("user-agent");

                if (agent != null && agent.contains("MSIE"))

                        return true;*/

                String dl = req.getParameter("dl");

                if ("1".equals(dl))

                        return true;

                return false;

        }

        /**

         * Sends a progress update on the amount of bytes received until now for

         * a file that the current user is currently uploading.

         *

         * @param req the HTTP request

         * @param resp the HTTP response

         * @param parameter the value for the progress request parameter

         * @param user the current user

         * @param file the file being uploaded, or null if the request is about a new file

         * @throws IOException if an I/O error occurs

         */

        private void serveProgress(HttpServletRequest req, HttpServletResponse resp,

                                String parameter, User user, FileHeaderDTO file)        throws IOException {

                String filename = file == null ? parameter : file.getName();

                try {

                        FileUploadStatus status = getService().getFileUploadStatus(user.getId(), filename);

                        if (status == null) {

                                resp.sendError(HttpServletResponse.SC_NOT_FOUND);

                                return;

                        }

                        JSONObject json = new JSONObject();

                        json.put("bytesUploaded", status.getBytesUploaded()).

                                put("bytesTotal", status.getFileSize());

                        sendJson(req, resp, json.toString());

                        // Workaround for IE's broken caching behavior.

                    resp.setHeader("Expires", "-1");

                        return;

                } catch (RpcException e) {

                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);

                        return;

                } catch (JSONException e) {

                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());

                        return;

                }

        }

        /**

         * Server a POST request to create/modify a file or folder.

         *

         * @param req the HTTP request

         * @param resp the HTTP response

     * @exception IOException if an input/output error occurs

         */

        void postResource(HttpServletRequest req, HttpServletResponse resp) throws IOException {

                boolean authDeferred = getAuthDeferred(req);

            if (!authDeferred && req.getParameterMap().size() > 1) {

                    resp.sendError(HttpServletResponse.SC_BAD_REQUEST);

                    return;

            }

        String path = getInnerPath(req, PATH_FILES);

            path = path.endsWith("/")? path: path + '/';

                try {

                    path = URLDecoder.decode(path, "UTF-8");

                } catch (IllegalArgumentException e) {

                        resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());

                        return;

                }

            // We only defer authenticating multipart POST requests.

            if (authDeferred) {

                        if (!ServletFileUpload.isMultipartContent(req)) {

                            resp.sendError(HttpServletResponse.SC_FORBIDDEN);

                            return;

                    }

                        handleMultipart(req, resp, path);

                        return;

                }

            String newName = req.getParameter(NEW_FOLDER_PARAMETER);

            boolean hasUpdateParam = req.getParameterMap().containsKey(RESOURCE_UPDATE_PARAMETER);

            boolean hasTrashParam = req.getParameterMap().containsKey(RESOURCE_TRASH_PARAMETER);

            boolean hasRestoreParam = req.getParameterMap().containsKey(RESOURCE_RESTORE_PARAMETER);

            String copyTo = req.getParameter(RESOURCE_COPY_PARAMETER);

            String moveTo = req.getParameter(RESOURCE_MOVE_PARAMETER);

            String restoreVersion = req.getParameter(RESTORE_VERSION_PARAMETER);

            if (newName != null)

                        createFolder(req, resp, path, newName);

            else if (hasUpdateParam)

                        updateResource(req, resp, path);

                else if (hasTrashParam)

                        trashResource(req, resp, path);

                else if (hasRestoreParam)

                        restoreResource(req, resp, path);

                else if (copyTo != null)

                        copyResource(req, resp, path, copyTo);

                else if (moveTo != null)

                        moveResource(req, resp, path, moveTo);

                else if (restoreVersion != null)

                        restoreVersion(req, resp, path, restoreVersion);

                else

                        // IE with Gears uses POST for multiple uploads.

                        putResource(req, resp);

        }

        /**

         * Restores a previous version for a file.

         *

         * @param req the HTTP request

         * @param resp the HTTP response

         * @param path the resource path

         * @param version the version number to restore

         * @throws IOException if an I/O error occurs

         */

        private void restoreVersion(HttpServletRequest req, HttpServletResponse resp, String path, String version) throws IOException {

                User user = getUser(req);

                User owner = getOwner(req);

                Object resource = null;

                try {

                        resource = getService().getResourceAtPath(owner.getId(), path, true);

                } catch (ObjectNotFoundException e) {

                        resp.sendError(HttpServletResponse.SC_NOT_FOUND, path);

                        return;

                } catch (RpcException e) {

                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                        return;

                }

                if (resource instanceof FolderDTO) {

                        resp.sendError(HttpServletResponse.SC_CONFLICT);

                        return;

                }

                try {

                        FileHeaderDTO file = (FileHeaderDTO) resource;

                        int oldVersion = Integer.parseInt(version);

                        getService().restoreVersion(user.getId(), file.getId(), oldVersion);

                } catch (InsufficientPermissionsException e) {

                        resp.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);

                } catch (ObjectNotFoundException e) {

                        resp.sendError(HttpServletResponse.SC_NOT_FOUND, e.getMessage());

                } catch (RpcException e) {

                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                } catch (GSSIOException e) {

                        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());

                } catch (QuotaExceededException e) {

                        resp.sendError(HttpServletResponse.SC_REQUEST_ENTITY_TOO_LARGE, e.getMessage());

                } catch (NumberFormatException e) {

                        resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());

                }

        }

        /**

         * A method for handling multipart POST requests for uploading

         * files from browser-based JavaScript clients.

         *

         * @param request the HTTP request

         * @param response the HTTP response

         * @param path the resource path

         * @throws IOException in case an error occurs writing to the

         *                 response stream

         */

        private void handleMultipart(HttpServletRequest request, HttpServletResponse response, String path) throws IOException {

            if (logger.isDebugEnabled())

                           logger.debug("Multipart POST for resource: " + path);

            User owner = getOwner(request);

            boolean exists = true;

        Object resource = null;

        FileHeaderDTO file = null;

        try {

                resource = getService().getResourceAtPath(owner.getId(), path, false);

        } catch (ObjectNotFoundException e) {

            exists = false;

        } catch (RpcException e) {

                response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                        return;

                }

        if (exists)

                        if (resource instanceof FileHeaderDTO) {

                            file = (FileHeaderDTO) resource;

                            if (file.isDeleted()) {

                                    response.sendError(HttpServletResponse.SC_CONFLICT, file.getName() + " is in the trash");

                                return;

                            }

                        } else {

                        response.sendError(HttpServletResponse.SC_CONFLICT, path + " is a folder");

                            return;

                }

        FolderDTO folder = null;

            Object parent;

            String parentPath = null;

                try {

                        parentPath = getParentPath(path);

                        parent = getService().getResourceAtPath(owner.getId(), parentPath, true);

                } catch (ObjectNotFoundException e) {

                    response.sendError(HttpServletResponse.SC_NOT_FOUND, parentPath);

                    return;

                } catch (RpcException e) {

                response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                        return;

                }

            if (!(parent instanceof FolderDTO)) {

                    response.sendError(HttpServletResponse.SC_CONFLICT);

                    return;

            }

                   folder = (FolderDTO) parent;

            String fileName = getLastElement(path);

                FileItemIterator iter;

                File uploadedFile = null;

                try {

                        // Create a new file upload handler.

                        ServletFileUpload upload = new ServletFileUpload();

                        StatusProgressListener progressListener = new StatusProgressListener(getService());

                        upload.setProgressListener(progressListener);

                        iter = upload.getItemIterator(request);

                        String dateParam = null;

                        String auth = null;

                        while (iter.hasNext()) {

                                FileItemStream item = iter.next();

                                String name = item.getFieldName();

                                InputStream stream = item.openStream();

                                if (item.isFormField()) {

                                        final String value = Streams.asString(stream);

                                        if (name.equals(DATE_PARAMETER))

                                                dateParam = value;

                                        else if (name.equals(AUTHORIZATION_PARAMETER))

                                                auth = value;

                                        if (logger.isDebugEnabled())

                                                logger.debug(name + ":" + value);

                                } else {

                                        // Fetch the timestamp used to guard against replay attacks.

                                    if (dateParam == null) {

                                            response.sendError(HttpServletResponse.SC_FORBIDDEN, "No Date parameter");

                                            return;

                                    }

                                    long timestamp;

                                        try {

                                                timestamp = DateUtil.parseDate(dateParam).getTime();

                                        } catch (DateParseException e) {

                                            response.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());

                                            return;

                                        }

                                    if (!isTimeValid(timestamp)) {

                                            response.sendError(HttpServletResponse.SC_FORBIDDEN);

                                            return;

                                    }

                                        // Fetch the Authorization parameter and find the user specified in it.

                                    if (auth == null) {

                                            response.sendError(HttpServletResponse.SC_FORBIDDEN, "No Authorization parameter");

                                            return;

                                    }

                                        String[] authParts = auth.split(" ");

                                        if (authParts.length != 2) {

                                            response.sendError(HttpServletResponse.SC_FORBIDDEN);

                                            return;

                                    }

                                        String username = authParts[0];

                                        String signature = authParts[1];

                                        User user = null;

                                        try {

                                                user = getService().findUser(username);

                                        } catch (RpcException e) {

                                        response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, path);

                                                return;

                                        }

                                        if (user == null) {

                                            response.sendError(HttpServletResponse.SC_FORBIDDEN);

                                            return;

                                    }

                                        request.setAttribute(USER_ATTRIBUTE, user);

                                        // Remove the servlet path from the request URI.

                                        String p = request.getRequestURI();

                                        String servletPath = request.getContextPath() + request.getServletPath();

                                        p = p.substring(servletPath.length());

                                        // Validate the signature in the Authorization parameter.

                                        String data = request.getMethod() + dateParam + p;

                                        if (!isSignatureValid(signature, user, data)) {

                                            response.sendError(HttpServletResponse.SC_FORBIDDEN);

                                            return;

                                    }

                                        progressListener.setUserId(user.getId());

                                        progressListener.setFilename(fileName);

                                        String contentType = item.getContentType();

                                        try {

                                                uploadedFile = getService().uploadFile(stream, user.getId());

                                        } catch (IOException ex) {

                                                throw new GSSIOException(ex, false);