RED-8175 - fixed path traversal issue #310
@ -13,6 +13,8 @@ import java.util.ArrayList;
|
|||||||
import java.util.List;
|
import java.util.List;
|
||||||
import java.util.Map;
|
import java.util.Map;
|
||||||
|
|
||||||
|
import com.iqser.red.service.persistence.management.v1.processor.service.persistence.DossierTemplatePersistenceService;
|
||||||
|
import org.apache.commons.io.FilenameUtils;
|
||||||
import org.apache.commons.io.IOUtils;
|
import org.apache.commons.io.IOUtils;
|
||||||
import org.springframework.core.io.InputStreamResource;
|
import org.springframework.core.io.InputStreamResource;
|
||||||
import org.springframework.http.HttpHeaders;
|
import org.springframework.http.HttpHeaders;
|
||||||
@ -66,6 +68,7 @@ public class ReportTemplateController implements ReportTemplateResource {
|
|||||||
private final PlaceholderClient placeholderClient;
|
private final PlaceholderClient placeholderClient;
|
||||||
private final AuditPersistenceService auditPersistenceService;
|
private final AuditPersistenceService auditPersistenceService;
|
||||||
private final DossierAttributeConfigPersistenceService dossierAttributeConfigPersistenceService;
|
private final DossierAttributeConfigPersistenceService dossierAttributeConfigPersistenceService;
|
||||||
|
private final DossierTemplatePersistenceService dossierTemplatePersistenceService;
|
||||||
private final FileAttributeConfigPersistenceService fileAttributeConfigPersistenceService;
|
private final FileAttributeConfigPersistenceService fileAttributeConfigPersistenceService;
|
||||||
private final StorageService storageService;
|
private final StorageService storageService;
|
||||||
private final ReportTemplatePersistenceService reportTemplatePersistenceService;
|
private final ReportTemplatePersistenceService reportTemplatePersistenceService;
|
||||||
@ -96,9 +99,12 @@ public class ReportTemplateController implements ReportTemplateResource {
|
|||||||
try {
|
try {
|
||||||
if (file.getOriginalFilename() != null) {
|
if (file.getOriginalFilename() != null) {
|
||||||
|
|
||||||
|
dossierTemplatePersistenceService.checkDossierTemplateExistsOrElseThrow404(dossierTemplateId);
|
||||||
|
|
||||||
|
var cleanupName = FilenameUtils.getName(file.getOriginalFilename());
|
||||||
ReportTemplateUploadRequest reportTemplateUploadRequest = ReportTemplateUploadRequest.builder()
|
ReportTemplateUploadRequest reportTemplateUploadRequest = ReportTemplateUploadRequest.builder()
|
||||||
.template(file.getBytes())
|
.template(file.getBytes())
|
||||||
.fileName(file.getOriginalFilename())
|
.fileName(cleanupName)
|
||||||
.dossierTemplateId(dossierTemplateId)
|
.dossierTemplateId(dossierTemplateId)
|
||||||
.activeByDefault(activeByDefault)
|
.activeByDefault(activeByDefault)
|
||||||
.multiFileReport(multiFileReport)
|
.multiFileReport(multiFileReport)
|
||||||
|
|||||||
@ -7,6 +7,7 @@ import java.util.Optional;
|
|||||||
import java.util.UUID;
|
import java.util.UUID;
|
||||||
|
|
||||||
import org.apache.commons.lang3.StringUtils;
|
import org.apache.commons.lang3.StringUtils;
|
||||||
|
|
||||||
import org.springframework.beans.BeanUtils;
|
import org.springframework.beans.BeanUtils;
|
||||||
import org.springframework.beans.factory.annotation.Value;
|
import org.springframework.beans.factory.annotation.Value;
|
||||||
import org.springframework.stereotype.Service;
|
import org.springframework.stereotype.Service;
|
||||||
@ -104,6 +105,7 @@ public class DossierTemplatePersistenceService {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
public void validateDossierTemplate(String name, String description) {
|
public void validateDossierTemplate(String name, String description) {
|
||||||
|
|
||||||
if (!StringUtils.isEmpty(name) && name.length() > MAX_NAME_LENGTH) {
|
if (!StringUtils.isEmpty(name) && name.length() > MAX_NAME_LENGTH) {
|
||||||
@ -123,6 +125,7 @@ public class DossierTemplatePersistenceService {
|
|||||||
return dossierTemplateRepository.existsByNameAndIdNot(templateName, dossierTemplateIdToIgnore);
|
return dossierTemplateRepository.existsByNameAndIdNot(templateName, dossierTemplateIdToIgnore);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
@Transactional
|
@Transactional
|
||||||
public boolean isDossierTemplateNameNotUnique(String templateName) {
|
public boolean isDossierTemplateNameNotUnique(String templateName) {
|
||||||
|
|
||||||
@ -150,7 +153,8 @@ public class DossierTemplatePersistenceService {
|
|||||||
}
|
}
|
||||||
|
|
||||||
var now = OffsetDateTime.now();
|
var now = OffsetDateTime.now();
|
||||||
boolean isNotInRange = !now.isAfter(dossierTemplate.getValidFrom() != null ? dossierTemplate.getValidFrom() : OffsetDateTime.MIN) || !now.isBefore(dossierTemplate.getValidTo() != null ? dossierTemplate.getValidTo() : OffsetDateTime.MAX);
|
boolean isNotInRange = !now.isAfter(dossierTemplate.getValidFrom() != null ? dossierTemplate.getValidFrom() : OffsetDateTime.MIN) ||
|
||||||
|
!now.isBefore(dossierTemplate.getValidTo() != null ? dossierTemplate.getValidTo() : OffsetDateTime.MAX);
|
||||||
if (isNotInRange) {
|
if (isNotInRange) {
|
||||||
return DossierTemplateStatus.INACTIVE;
|
return DossierTemplateStatus.INACTIVE;
|
||||||
}
|
}
|
||||||
@ -180,6 +184,14 @@ public class DossierTemplatePersistenceService {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
public void checkDossierTemplateExistsOrElseThrow404(String dossierTemplateId) {
|
||||||
|
|
||||||
|
if (!dossierTemplateRepository.existsByIdAndNotDeleted(dossierTemplateId)) {
|
||||||
|
throw new NotFoundException(String.format(DOSSIER_TEMPLATE_NOT_FOUND_MESSAGE, dossierTemplateId));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
@Transactional
|
@Transactional
|
||||||
public List<TypeEntity> getTypesForDossierTemplate(String dossierTemplateId) {
|
public List<TypeEntity> getTypesForDossierTemplate(String dossierTemplateId) {
|
||||||
|
|
||||||
|
|||||||
@ -18,8 +18,14 @@ public interface DossierTemplateRepository extends JpaRepository<DossierTemplate
|
|||||||
@Query("select d from DossierTemplateEntity d where d.id = :dossierTemplateId and d.softDeleteTime is null")
|
@Query("select d from DossierTemplateEntity d where d.id = :dossierTemplateId and d.softDeleteTime is null")
|
||||||
Optional<DossierTemplateEntity> findByIdAndNotDeleted(@Param("dossierTemplateId") String dossierTemplateId);
|
Optional<DossierTemplateEntity> findByIdAndNotDeleted(@Param("dossierTemplateId") String dossierTemplateId);
|
||||||
|
|
||||||
|
|
||||||
|
@Query("select case when exists (select 1 from DossierTemplateEntity d where d.id = :dossierTemplateId and d.softDeleteTime is null) then true else false end")
|
||||||
|
boolean existsByIdAndNotDeleted(@Param("dossierTemplateId") String dossierTemplateId);
|
||||||
|
|
||||||
|
|
||||||
boolean existsByName(String name);
|
boolean existsByName(String name);
|
||||||
|
|
||||||
|
|
||||||
boolean existsByNameAndIdNot(String name, String id);
|
boolean existsByNameAndIdNot(String name, String id);
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user