RE: Portlet Upload File Issue

2019-02-08T12:19:29Z

John CressmanI'm having an issue when I try to process an uploaded file in my portlet.

When I try to upload a graphics file or PDF, it works. When I try a DOCX file or other type it fails.

In the server log, it has the full path to the file and says it can't be found. The error occurs when I try to attach the file to the email.

My best guess is: It's a temporary file. MailServiceUtil will asynchronously send the file from a different thread, when the current request is long done. I'm not sure when temporary files are deleted - also not if they're taken into memory for construction of the message, or if the mail API relies on the file to still be there when the mail is being sent. I suspect that the observed file type correlation is just by chance.

Another less likely option, in case you're on Windows, might be an Antivirus over-eagerly quarantining a file, if it's indeed dependent on the doctype.

Portlet Upload File Issue

2019-02-04T13:41:53Z

I'm having an issue when I try to process an uploaded file in my portlet.

When I try to upload a graphics file or PDF, it works. When I try a DOCX file or other type it fails.

In the server log, it has the full path to the file and says it can't be found. The error occurs when I try to attach the file to the email.

Part of my Class file

private final static String baseDir = "/tmp/uploaded/";
private final static String fileInputName = "theFile";


@ProcessAction(name="myActionMethod")
public void myActionMethod(ActionRequest request, ActionResponse response) throws Exception {

        File uploadedFile = null;
        try {
                UploadPortletRequest uploadRequest = PortalUtil.getUploadPortletRequest(request);
                if (uploadRequest.getSize(fileInputName) == 0) {
                        throw new Exception("Received file is 0 bytes!");
                }
                uploadedFile = uploadRequest.getFile(fileInputName);

        } catch (Exception e) {
                LOG.error(e.toString(),e);
        }





        User myUser = PortalUtil.getUser(request);

        String from = "noreply@lvh.com";
        String sendTo = "john.cressman@lvhn.org";

        InternetAddress myFrom = new InternetAddress(from, from);
        InternetAddress myTo = new InternetAddress(sendTo, sendTo);

        String subject = "New URL Request";

        String innerName = ParamUtil.getString(request, "theName");
        String innerApp = ParamUtil.getString(request, "theApp");
        String innerAppType = ParamUtil.getString(request, "theAppType");
        String innerPurpose = ParamUtil.getString(request, "thePurpose");
        String innerDept = ParamUtil.getString(request, "theDept");
        String innerUsers = ParamUtil.getString(request, "theUsers");
        String innerDTS = ParamUtil.getString(request, "theDTS");
        String innerDCS = ParamUtil.getString(request, "theDCS");
        String innerDS = ParamUtil.getString(request, "theDS");
        String innerDSS = ParamUtil.getString(request, "theDSS");
        String innerDSE = ParamUtil.getString(request, "theDSE");
        String innerST = ParamUtil.getString(request, "theST");
        String innerBackup = ParamUtil.getString(request, "theBackup");
        String innerOSS = ParamUtil.getString(request, "theOSS");
        String innerAudit = ParamUtil.getString(request, "theAudit");
        String innerAuditMgt = ParamUtil.getString(request, "theAuditMgt");
        String innerAccounts = ParamUtil.getString(request, "theAccounts");
        String innerAuth = ParamUtil.getString(request, "theAuth");
        String innerRS = ParamUtil.getString(request, "theRS");
        String innerVendorInfo = ParamUtil.getString(request, "theVendorInfo");
        String innerVC = ParamUtil.getString(request, "theVC");
        String innerBAA = ParamUtil.getString(request, "theBAA");
        String innerProject = ParamUtil.getString(request, "theProject");

        String innerSUI = ParamUtil.getString(request, "theSUI");
        String innerMgrSUI = ParamUtil.getString(request, "theMgrSUI");
        String innerMgrEmail = ParamUtil.getString(request, "theMgrEmail");
        String innerUserEmail = ParamUtil.getString(request, "theUserEmail");

        InternetAddress[] myCC = InternetAddress.parse(innerUserEmail + "," + innerMgrEmail);
        //InternetAddress[] myCC = InternetAddress.parse(innerUserEmail + "," + innerUserEmail);

        String mailBody = "Security Team, \n\nThe following request has been received the following request:\n\n";

        mailBody += "Submitter: " + innerSUI + "\n";
        mailBody += "Submitter Manager: " + innerMgrSUI + "\n";

        mailBody += "Analyst: " + innerName + "\n";
        mailBody += "Name of Application: " + innerApp + "\n";
        mailBody += "Type of Application: " + innerAppType + "\n";
        mailBody += "Business Purpose: " + innerPurpose + "\n";
        mailBody += "Department Requesting: " + innerDept + "\n";

        mailBody += "Users: " + innerUsers + "\n";
        mailBody += "Data Transfer Security: " + innerDTS + "\n";
        mailBody += "Data Center Storage: " + innerDCS + "\n";
        mailBody += "Data Storage: " + innerDS + "\n";
        mailBody += "Data Storage Segmentation: " + innerDSS + "\n";
        mailBody += "Data Storage Encryption: " + innerDSE + "\n";
        mailBody += "Securing Traffic: " + innerST + "\n";
        mailBody += "Backup: " + innerBackup + "\n";
        mailBody += "Off Site Storage: " + innerOSS + "\n";
        mailBody += "Auditing: " + innerAudit + "\n";
        mailBody += "Auditing Management: " + innerAuditMgt + "\n";
        mailBody += "Account Management: " + innerAccounts + "\n";
        mailBody += "Authentication: " + innerAuth + "\n";
        mailBody += "Role Security: " + innerRS + "\n";
        mailBody += "Vendor Info: " + innerVendorInfo + "\n";
        mailBody += "Vendor Certification: " + innerVC + "\n";
        mailBody += "Business Associates Agreement: " + innerBAA + "\n";
        mailBody += "Project Reference: " + innerProject + "\n";


        try {
                MailMessage mailMessage = new MailMessage();

                mailMessage.setFrom(myFrom);
                mailMessage.setTo(myTo);
                mailMessage.setCC(myCC);

                mailMessage.setSubject(subject);
                mailMessage.setBody(mailBody);

                [color=#ff0000]mailMessage.addFileAttachment(uploadedFile);[/color]


                MailServiceUtil.sendEmail(mailMessage);
        } catch (Exception e) {
                //e.printStackTrace();
                LOG.error(e.toString(),e);
        }

        response.setRenderParameter("jspPage", "/finish.jsp");

}

My view.jsp

<aui:form name="myForm" action="${myaction}" method="post">

   <aui:input label="Analyst" name="theName" required="true" value="" placeholder="Enter your first and last names" class="textbox1" />

   <aui:input label="Application" name="theApp" required="true" value="" placeholder="Enter Application Name" class="textbox1" />

   <aui-select id="theAppType" name="theAppType" placeholder="Select One" required="true">
            <aui-option>Internal Application with PHI</aui-option>
            <aui-option>Internal Application with No PHI</aui-option>
            <aui-option>External Application with PHI</aui-option>
            <aui-option>External Application with No PHI</aui-option>
        </aui-select>

   <aui:input type="textarea" label="Business Purpose" name="thePurpose" required="true" value="" placeholder="Please provide a brief overview of the product and how it will be used at LVHN" />

   <aui:input type="textarea" label="Department Requesting" name="theDept" required="true" value="" placeholder="What is the department requesting the application, and will it be used outside the requesting department?" />

   <aui:input type="textarea" label="Users" name="theUsers" required="true" value="" placeholder="Approximate number of users of the application" />

   <aui:input type="textarea" label="Data Transfer Security" name="theDTS" required="true" value="" placeholder="What method is being used to secure the traffic to and from the application? (Some examples include https, sftp, etc)" />

   <aui:input type="textarea" label="Data Center Storage" name="theDCS" required="true" value="" placeholder="Is the data stored at the vendor's data center or a third-party data center?" />

   <aui:input type="textarea" label="Data Storage" name="theDS" required="true" value="" placeholder="Where is the data stored once received by the vendor? (Some examples include database server, san storage, etc" />

   <aui:input type="textarea" label="Data Storage Segmentation" name="theDSS" required="true" value="" placeholder="Is the LVHN data segmented from other companies sending data to the vendor and how? (Some examples include firewall segmentation, private server, etc)" />

   <aui:input type="textarea" label="Data Storage Encryption" name="theDSE" required="true" value="" placeholder="Is the data at rest encrypted? If so, using what encryption standard? (Some examples include AES 256, DES 56, etc)" />

   <aui:input type="textarea" label="Securing Traffic" name="theST" required="true" value="" placeholder="What method is being used to secure the traffic to and from the application? (Some examples include https, sftp, etc)" />
   <aui:input type="textarea" label="Backup" name="theBackup" required="true" value="" placeholder="Is the data backed up and if so, are the backups encrypted?" />
   <aui:input type="textarea" label="Off Site Storage" name="theOSS" required="true" value="" placeholder="Are any of the backup tapes stored offsite?" />

   <aui:input type="textarea" label="Auditing" name="theAudit" required="true" value="" placeholder="What level of audit logs are available from the application? (Some examples include user activity level, log on activity level ,etc)" />
   <aui:input type="textarea" label="Auditing Management" name="theAuditMgt" required="true" value="" placeholder="How are the audit logs obtained and who will have access to these logs?" />
   <aui:input type="textarea" label="Account Management" name="theAccounts" required="true" value="" placeholder="Who will create the users?" />

   <aui:input type="textarea" label="Authentication" name="theAuth" required="true" value="" placeholder="How is the user authenticated to the application? (Some example include AD authentication, unique accounts, etc)" />
   <aui:input type="textarea" label="Role Security" name="theRS" required="true" value="" placeholder="Are there different levels or roles that can be assigned with different priveledges for different users?" />
   <aui:input type="textarea" label="Vendor Info" name="theVendorInfo" required="true" value="" placeholder="Is there a specific contact resource assigned to LVHN? If so, please provide contact details." />
   <aui:input type="textarea" label="Vendor Certification" name="theVC" required="true" value="" placeholder="Does the vendor have SSAE 16 or DOC certification available for review by LVHN IS Security Management?" />
   <aui:input type="textarea" label="Business Associates Agreement" name="theBAA" required="true" value="" placeholder="Is a BAA signed with the vendor and if so, has a copy been provided to the LVHN Privacy Officer?" />
   <aui:input type="textarea" label="Project Reference" name="theProject" required="true" value="" placeholder="Is this request associated with a specific project?" />

   <aui:input label="Please attach any documentation you have for the application that will aid the approval process" type="file" name="theFile" />

   <aui:input type="hidden" name="theSUI" value="${sui}" />
   <aui:input type="hidden" name="theMgrSUI" />
   <aui:input type="hidden" name="theMgrEmail" />
   <aui:input type="hidden" name="theUserEmail" />

    <aui:button type="submit" name="submit" value="submit" />
</aui:form>

<aui:script></aui:script>

Any ideas why it would allow some files and not others? Size doesn't seem to matter. It just seems to be the type of file.