| Class | Line # | Actions | |||||
|---|---|---|---|---|---|---|---|
| PathConverter | 51 | 10 | 0% | 3 | 2 |
| 1 | /* | |
| 2 | * See the NOTICE file distributed with this work for additional | |
| 3 | * information regarding copyright ownership. | |
| 4 | * | |
| 5 | * This is free software; you can redistribute it and/or modify it | |
| 6 | * under the terms of the GNU Lesser General Public License as | |
| 7 | * published by the Free Software Foundation; either version 2.1 of | |
| 8 | * the License, or (at your option) any later version. | |
| 9 | * | |
| 10 | * This software is distributed in the hope that it will be useful, | |
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
| 13 | * Lesser General Public License for more details. | |
| 14 | * | |
| 15 | * You should have received a copy of the GNU Lesser General Public | |
| 16 | * License along with this software; if not, write to the Free | |
| 17 | * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA | |
| 18 | * 02110-1301 USA, or see the FSF site: http://www.fsf.org. | |
| 19 | */ | |
| 20 | package org.xwiki.vfs.internal.script; | |
| 21 | ||
| 22 | import java.lang.reflect.Type; | |
| 23 | import java.net.URI; | |
| 24 | import java.nio.file.Path; | |
| 25 | ||
| 26 | import javax.inject.Inject; | |
| 27 | import javax.inject.Named; | |
| 28 | import javax.inject.Singleton; | |
| 29 | ||
| 30 | import org.xwiki.component.annotation.Component; | |
| 31 | import org.xwiki.properties.converter.AbstractConverter; | |
| 32 | import org.xwiki.properties.converter.ConversionException; | |
| 33 | import org.xwiki.resource.ResourceReferenceSerializer; | |
| 34 | import org.xwiki.vfs.VfsPermissionChecker; | |
| 35 | import org.xwiki.vfs.VfsResourceReference; | |
| 36 | ||
| 37 | import net.java.truevfs.access.TPath; | |
| 38 | ||
| 39 | /** | |
| 40 | * Converts {@link String} into {@link Path} objects constructed using TrueVFS. Permissions are also checked to verify | |
| 41 | * that the current users has the right to access the specified FileSystem Provider. | |
| 42 | * <p> | |
| 43 | * See {@link VfsResourceReferenceConverter} for example input and how the String input is first converted to a | |
| 44 | * {@link VfsResourceReference} and then into a TrueVFS-compatible URI suitable for TrueVFS. | |
| 45 | * | |
| 46 | * @version $Id: 07fc3f889a9a963d5671ab66c2df9fefd2aac28e $ | |
| 47 | * @since 7.4M2 | |
| 48 | */ | |
| 49 | @Component | |
| 50 | @Singleton | |
| 51 | public class PathConverter extends AbstractConverter<Path> | |
| 52 | { | |
| 53 | @Inject | |
| 54 | @Named("cascading") | |
| 55 | private VfsPermissionChecker permissionChecker; | |
| 56 | ||
| 57 | @Inject | |
| 58 | @Named("truevfs") | |
| 59 | private ResourceReferenceSerializer<VfsResourceReference, URI> trueVfsResourceReferenceSerializer; | |
| 60 | ||
| 61 | 7 | @Override |
| 62 | protected Path convertToType(Type targetType, Object value) | |
| 63 | { | |
| 64 | 7 | if (value == null) { |
| 65 | 0 | return null; |
| 66 | } | |
| 67 | ||
| 68 | 7 | Path path; |
| 69 | ||
| 70 | 7 | try { |
| 71 | 7 | VfsResourceReference reference = new VfsResourceReference(new URI(value.toString())); |
| 72 | ||
| 73 | // Verify that the user has the permission for the specified VFS scheme. We need to do this at this level | |
| 74 | // since it's possible to do the check in the driver itself since TrueVFS controls whether the driver is | |
| 75 | // called or not and does caching, | |
| 76 | // see https://java.net/projects/truezip/lists/users/archive/2015-12/message/8 | |
| 77 | // Since this convert has to be called to use the VFS API from Velocity, we're safe that this will prevent | |
| 78 | // any Velocity script to execute a VFS call if the user is not allowed. | |
| 79 | // | |
| 80 | // Note: Even though the user needs View access to the attachment, we cannot check this right now because | |
| 81 | // of the caching issue. However we consider that if the user has Programming Rights, he can do anything he | |
| 82 | // wants and thus it's safe that he can access the attachment. | |
| 83 | 7 | this.permissionChecker.checkPermission(reference); |
| 84 | ||
| 85 | 6 | URI trueVfsURI = this.trueVfsResourceReferenceSerializer.serialize(reference); |
| 86 | 5 | path = new TPath(trueVfsURI); |
| 87 | } catch (Exception e) { | |
| 88 | 2 | throw new ConversionException(String.format("Failed to convert [%s] to a Path object", value), e); |
| 89 | } | |
| 90 | ||
| 91 | 5 | return path; |
| 92 | } | |
| 93 | } |