inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-09-17 14:21:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

PRODESC-5780: ACS Repo DAU APIs to also use non-attach allow list (#830)

Browse Source 
* PRODSEC-5780: ACS Repo DAU APIs to also use non-attach allow list

- moved existing pre-configured allow list from remote-api to repository layer
- ("nodes.nonAttachContentTypes" xml -> "content.nonAttach.mimetypes" prop)
- now also used by DAU (as well as existing V1 REST API and CMIS to get/download content)
This commit is contained in:
montgolfiere
2021-12-07 17:21:31 +00:00
committed by GitHub
parent 2039018ce5
commit 89de2e4677
6 changed files with 55 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
remote-api/src/main/java/org/alfresco/opencmis/CMISServletDispatcher.java
View File

@@ -2,7 +2,7 @@
* #%L
* Alfresco Remote API
* %%
* Copyright (C) 2005 - 2016 Alfresco Software Limited
* Copyright (C) 2005 - 2021 Alfresco Software Limited
* %%
* This file is part of the Alfresco software.
* If the software was purchased under a paid Alfresco license, the terms of
@@ -86,7 +86,8 @@ public abstract class CMISServletDispatcher implements CMISDispatcher
private boolean allowUnsecureCallbackJSONP;
private Set<String> nonAttachContentTypes = Collections.emptySet(); // pre-configured whitelist, eg. images & pdf
// pre-configured allow list of media/mime types, eg. specific types of images & also pdf
private Set<String> nonAttachContentTypes = Collections.emptySet();
public void setTenantAdminService(TenantAdminService tenantAdminService)
{
@@ -133,9 +134,12 @@ public abstract class CMISServletDispatcher implements CMISDispatcher
this.cmisVersion = CmisVersion.fromValue(cmisVersion);
}
public void setNonAttachContentTypes(Set<String> nonAttachWhiteList)
public void setNonAttachContentTypes(String nonAttachAllowListStr)
{
this.nonAttachContentTypes = nonAttachWhiteList;
if ((nonAttachAllowListStr != null) && (! nonAttachAllowListStr.isEmpty()))
{
nonAttachContentTypes = Set.of(nonAttachAllowListStr.trim().split("\\s*,\\s*"));
}
}
protected synchronized Descriptor getCurrentDescriptor()