Disable file uploads

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Disable file uploads

Greg Lindholm-2
I have a Struts2 app that does not support any sort for file upload.
Is there any steps I could/should take to ensure file uploads are disabled?

Greg
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Disable file uploads

adam brin
One step is  to modify the struts.xml to create a custom stack that doesn’t include the file-upload interceptor.
--
_________________________________________________________
Adam Brin
Director of Technology, Digital Antiquity
480.965.1278

> On Apr 13, 2017, at 8:42 AM, Greg Lindholm <[hidden email]> wrote:
>
> I have a Struts2 app that does not support any sort for file upload.
> Is there any steps I could/should take to ensure file uploads are disabled?
>
> Greg


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Disable file uploads

Lukasz Lenart
2017-04-13 17:43 GMT+02:00 Adam Brin <[hidden email]>:
> One step is  to modify the struts.xml to create a custom stack that doesn’t include the file-upload interceptor.

Parsing of multipart request happens early, in Dispatcher so to be
100% sure you must implement a NoOpMultipartParser or define your own
Dispatcher and override the wrapRequest() method or or the
isMultipartRequest() method (new in 2.5.11)


Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Disable file uploads

Jim Macalister
is there a global setting that can be added to web.xml ? or to
struts.properties ?

e.g. set a global non existing upload folder
set max file size to 0 e.t.c.

Regards


On Fri, Apr 14, 2017 at 8:33 AM, Lukasz Lenart <[hidden email]>
wrote:

> 2017-04-13 17:43 GMT+02:00 Adam Brin <[hidden email]>:
> > One step is  to modify the struts.xml to create a custom stack that
> doesn’t include the file-upload interceptor.
>
> Parsing of multipart request happens early, in Dispatcher so to be
> 100% sure you must implement a NoOpMultipartParser or define your own
> Dispatcher and override the wrapRequest() method or or the
> isMultipartRequest() method (new in 2.5.11)
>
>
> Regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Disable file uploads

Lukasz Lenart
2017-04-15 14:08 GMT+02:00 Jim Macalister <[hidden email]>:
> is there a global setting that can be added to web.xml ? or to
> struts.properties ?

Nope, there is no such thing, but I can develop a NoOp multipart
parser and add it to struts-extras

> e.g. set a global non existing upload folder
> set max file size to 0 e.t.c.

Interesting ... but the validation happens when the request got already parsed


Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Loading...