diff --git a/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/FileServingHelper.java b/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/FileServingHelper.java index 19562e97d..2bb1b2838 100644 --- a/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/FileServingHelper.java +++ b/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/FileServingHelper.java @@ -2,6 +2,9 @@ package edu.cornell.mannlib.vitro.webapp.filestorage; +import java.io.UnsupportedEncodingException; +import java.net.URLEncoder; + import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; @@ -42,7 +45,8 @@ public class FileServingHelper { /** *
* Combine the URI and the filename to produce a relative URL for the file - * (relative to the context of the webapp). + * (relative to the context of the webapp). The filename will be URLEncoded + * as needed. *
** This should involve stripping the default namespace from the front of the @@ -66,6 +70,13 @@ public class FileServingHelper { return uri; } String remainder = uri.substring(DEFAULT_NAMESPACE.length()); + + try { + filename = URLEncoder.encode(filename, "UTF-8"); + } catch (UnsupportedEncodingException e) { + log.error("No UTF-8 encoding?", e); // Can't happen. + } + String separator = remainder.endsWith("/") ? "" : "/"; return FILE_PATH + remainder + separator + filename; } diff --git a/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/serving/FileServingServlet.java b/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/serving/FileServingServlet.java index 1857eb15f..abe0d8217 100644 --- a/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/serving/FileServingServlet.java +++ b/webapp/src/edu/cornell/mannlib/vitro/webapp/filestorage/serving/FileServingServlet.java @@ -9,6 +9,8 @@ import static javax.servlet.http.HttpServletResponse.SC_OK; import java.io.FileNotFoundException; import java.io.IOException; import java.io.InputStream; +import java.io.UnsupportedEncodingException; +import java.net.URLDecoder; import javax.servlet.ServletException; import javax.servlet.ServletOutputStream; @@ -95,7 +97,8 @@ public class FileServingServlet extends VitroHttpServlet { response.sendError(SC_NOT_FOUND, ("File not found: " + path)); return; } - if (!actualFilename.equals(requestedFilename)) { + if (!actualFilename.equals(requestedFilename) + && !actualFilename.equals(decode(requestedFilename))) { log.warn("The requested filename does not match the " + "actual filename; request: '" + path + "', actual: '" + actualFilename + "'"); @@ -163,6 +166,18 @@ public class FileServingServlet extends VitroHttpServlet { } } + /** + * The filename may have been encoded for URL transfer. + */ + private String decode(String filename) { + try { + return URLDecoder.decode(filename, "UTF-8"); + } catch (UnsupportedEncodingException e) { + log.error("How did this happen?", e); + return filename; + } + } + /** * A POST request is treated the same as a GET request. */ diff --git a/webapp/web/templates/entity/entityBasic.jsp b/webapp/web/templates/entity/entityBasic.jsp index d02852b9e..709275417 100644 --- a/webapp/web/templates/entity/entityBasic.jsp +++ b/webapp/web/templates/entity/entityBasic.jsp @@ -223,8 +223,8 @@ if (VitroRequestPrep.isSelfEditing(request) || LoginFormBean.loggedIn(request, L