<%!
private boolean validateFilePath(String path){
boolean ok = false;
String strReportPath = XMatrix.PATH_REPORTPATH;
String strTempPath = XMatrix.getRepOption("TEMP_PATH", strReportPath + File.separatorChar + "_TEMP_");
if(path.indexOf(strReportPath)==0 || path.indexOf(strTempPath)==0){
ok = true;
}
return ok;
}
%>
<%
//drm.jsp소스 내용
//...............중략
String srcPath = RequestWrapper.filter( Util.ifnull(request.getParameter("srcPath"),"") );
String srcFileName = RequestWrapper.filter( Util.ifnull(request.getParameter("srcFileName"),"") );
String tgtPath = RequestWrapper.filter( Util.ifnull(request.getParameter("tgtPath"),"") );
String tgtFileName = RequestWrapper.filter( Util.ifnull(request.getParameter("tgtFileName"),"") );
//파일경로 필터링 강화
if(validateFilePath(srcPath) == false || validateFilePath(tgtPath)==false){
throw new Exception("file path is wrong");
}
%>
|