diff --git a/remote-api/src/main/java/org/alfresco/opencmis/CMISServletDispatcher.java b/remote-api/src/main/java/org/alfresco/opencmis/CMISServletDispatcher.java index 268390a642..31b0f357a0 100644 --- a/remote-api/src/main/java/org/alfresco/opencmis/CMISServletDispatcher.java +++ b/remote-api/src/main/java/org/alfresco/opencmis/CMISServletDispatcher.java @@ -2,7 +2,7 @@ * #%L * Alfresco Remote API * %% - * Copyright (C) 2005 - 2016 Alfresco Software Limited + * Copyright (C) 2005 - 2021 Alfresco Software Limited * %% * This file is part of the Alfresco software. * If the software was purchased under a paid Alfresco license, the terms of @@ -86,7 +86,8 @@ public abstract class CMISServletDispatcher implements CMISDispatcher private boolean allowUnsecureCallbackJSONP; - private Set nonAttachContentTypes = Collections.emptySet(); // pre-configured whitelist, eg. images & pdf + // pre-configured allow list of media/mime types, eg. specific types of images & also pdf + private Set nonAttachContentTypes = Collections.emptySet(); public void setTenantAdminService(TenantAdminService tenantAdminService) { @@ -133,9 +134,12 @@ public abstract class CMISServletDispatcher implements CMISDispatcher this.cmisVersion = CmisVersion.fromValue(cmisVersion); } - public void setNonAttachContentTypes(Set nonAttachWhiteList) + public void setNonAttachContentTypes(String nonAttachAllowListStr) { - this.nonAttachContentTypes = nonAttachWhiteList; + if ((nonAttachAllowListStr != null) && (! nonAttachAllowListStr.isEmpty())) + { + nonAttachContentTypes = Set.of(nonAttachAllowListStr.trim().split("\\s*,\\s*")); + } } protected synchronized Descriptor getCurrentDescriptor() diff --git a/remote-api/src/main/java/org/alfresco/rest/api/impl/NodesImpl.java b/remote-api/src/main/java/org/alfresco/rest/api/impl/NodesImpl.java index 46793ddeaf..543fa88d21 100644 --- a/remote-api/src/main/java/org/alfresco/rest/api/impl/NodesImpl.java +++ b/remote-api/src/main/java/org/alfresco/rest/api/impl/NodesImpl.java @@ -239,11 +239,15 @@ public class NodesImpl implements Nodes private ConcurrentHashMap ddCache = new ConcurrentHashMap<>(); - private Set nonAttachContentTypes = Collections.emptySet(); // pre-configured whitelist, eg. images & pdf + // pre-configured allow list of media/mime types, eg. specific types of images & also pdf + private Set nonAttachContentTypes = Collections.emptySet(); - public void setNonAttachContentTypes(Set nonAttachWhiteList) + public void setNonAttachContentTypes(String nonAttachAllowListStr) { - this.nonAttachContentTypes = nonAttachWhiteList; + if ((nonAttachAllowListStr != null) && (! nonAttachAllowListStr.isEmpty())) + { + nonAttachContentTypes = Set.of(nonAttachAllowListStr.trim().split("\\s*,\\s*")); + } } public void init() diff --git a/remote-api/src/main/resources/alfresco/public-rest-context.xml b/remote-api/src/main/resources/alfresco/public-rest-context.xml index 0da8a5f0f2..24829a7856 100644 --- a/remote-api/src/main/resources/alfresco/public-rest-context.xml +++ b/remote-api/src/main/resources/alfresco/public-rest-context.xml @@ -509,19 +509,6 @@ - - - - application/pdf - image/jpeg - image/gif - image/png - image/tiff - image/bmp - - - - @@ -542,7 +529,7 @@ - + @@ -1142,7 +1129,7 @@ - + @@ -1154,7 +1141,7 @@ - + @@ -1166,7 +1153,7 @@ - + diff --git a/repository/src/main/java/org/alfresco/repo/content/ContentServiceImpl.java b/repository/src/main/java/org/alfresco/repo/content/ContentServiceImpl.java index 4ba6c7ebec..733089383d 100644 --- a/repository/src/main/java/org/alfresco/repo/content/ContentServiceImpl.java +++ b/repository/src/main/java/org/alfresco/repo/content/ContentServiceImpl.java @@ -28,6 +28,7 @@ package org.alfresco.repo.content; import java.io.Serializable; import java.util.Collection; import java.util.HashSet; +import java.util.Collections; import java.util.Map; import java.util.Set; @@ -103,6 +104,9 @@ public class ContentServiceImpl implements ContentService, ApplicationContextAwa private boolean ignoreEmptyContent; private SystemWideDirectUrlConfig systemWideDirectUrlConfig; + + /** pre-configured allow list of media/mime types, eg. specific types of images & also pdf */ + private Set nonAttachContentTypes = Collections.emptySet(); /** * The policy component @@ -151,6 +155,14 @@ public class ContentServiceImpl implements ContentService, ApplicationContextAwa this.systemWideDirectUrlConfig = systemWideDirectUrlConfig; } + public void setNonAttachContentTypes(String nonAttachAllowListStr) + { + if ((nonAttachAllowListStr != null) && (! nonAttachAllowListStr.isEmpty())) + { + nonAttachContentTypes = Set.of(nonAttachAllowListStr.trim().split("\\s*,\\s*")); + } + } + public void setPolicyComponent(PolicyComponent policyComponent) { this.policyComponent = policyComponent; @@ -635,6 +647,7 @@ public class ContentServiceImpl implements ContentService, ApplicationContextAwa String fileName = getFileName(nodeRef); validFor = adjustValidFor(validFor); + attachment = adjustAttachment(nodeRef, contentMimetype, attachment); DirectAccessUrl directAccessUrl = null; if (store.isContentDirectUrlEnabled()) @@ -691,4 +704,21 @@ public class ContentServiceImpl implements ContentService, ApplicationContextAwa } return validFor; } + + private boolean adjustAttachment(NodeRef nodeRef, String mimeType, boolean attachmentIn) + { + boolean attachment = true; + if (! attachmentIn) + { + if ((nonAttachContentTypes != null) && (nonAttachContentTypes.contains(mimeType))) + { + attachment = false; + } + else + { + logger.warn("Ignored attachment=false for " + nodeRef.getId() + " since " + mimeType + " is not in the whitelist for non-attach content types"); + } + } + return attachment; + } } diff --git a/repository/src/main/resources/alfresco/content-services-context.xml b/repository/src/main/resources/alfresco/content-services-context.xml index dfbdf56633..3689d6c849 100644 --- a/repository/src/main/resources/alfresco/content-services-context.xml +++ b/repository/src/main/resources/alfresco/content-services-context.xml @@ -164,6 +164,9 @@ + + ${content.nonAttach.mimetypes} + diff --git a/repository/src/main/resources/alfresco/repository.properties b/repository/src/main/resources/alfresco/repository.properties index 236dea047a..f8df40244b 100644 --- a/repository/src/main/resources/alfresco/repository.properties +++ b/repository/src/main/resources/alfresco/repository.properties @@ -1317,3 +1317,6 @@ system.remove-alf_server-table-from-db.ignored=true # When using JSONP, allows unsecure usage of "callback" functions. Disabled by default for security reasons allow.unsecure.callback.jsonp=false + +# pre-configured allow list of media/mime types to allow inline instead of attachment (via Content-Disposition response header) +content.nonAttach.mimetypes=application/pdf,image/jpeg,image/gif,image/png,image/tiff,image/bmp