| 85 | } |
| 86 | |
| 87 | @Override |
| 88 | public void doPost(HttpServletRequest request, HttpServletResponse response) |
| 89 | throws IOException { |
| 90 | // FLAG: limit access only to local clients |
| 91 | if (restricted |
| 92 | && !request.getRemoteAddr().equals(request.getLocalAddr())) { |
| 93 | response.sendError(HttpServletResponse.SC_FORBIDDEN, |
| 94 | "Non-local clients are not allowed."); |
| 95 | return; |
| 96 | } |
| 97 | |
| 98 | // in case of any posted files |
| 99 | InputStream inStream = null; |
| 100 | |
| 101 | // determine if supported command: pull, push, post |
| 102 | String path = request.getPathInfo(); |
| 103 | System.err.println(new Date().toString() + " " + path); |
| 104 | if (path != null) { |
| 105 | // FLAG: limit only to pull and post |
| 106 | if (path.startsWith("/pull/") || path.startsWith("/post")) { |
| 107 | // FLAG: we're sending the user's keystore |
| 108 | // password over the wire (over SSL) |
| 109 | List<String> args = new LinkedList<String>(); |
| 110 | if (path.startsWith("/pull/")) { |
| 111 | path = path.substring("/pull/".length()); |
| 112 | response.setContentType("application/atom+xml; type=feed; charset=utf-8"); |
| 113 | // System.out.println("doPull: " + |
| 114 | // request.getParameterMap()); |
| 115 | args.add("pull"); |
| 116 | if (request.getParameterMap().size() > 0) { |
| 117 | boolean first = true; |
| 118 | for (Object name : request.getParameterMap().keySet()) { |
| 119 | // FLAG: don't allow "home" (server-abuse) |
| 120 | // FLAG: don't allow "attach" (file-system access) |
| 121 | if ("decrypt".equals(name) || "pass".equals(name)) { |
| 122 | for (String value : request |
| 123 | .getParameterValues(name.toString())) { |
| 124 | args.add("--" + name.toString()); |
| 125 | args.add(value); |
| 126 | } |
| 127 | } else { |
| 128 | for (String value : request |
| 129 | .getParameterValues(name.toString())) { |
| 130 | if (first) { |
| 131 | path = path + '?'; |
| 132 | first = false; |
| 133 | } else { |
| 134 | path = path + '&'; |
| 135 | } |
| 136 | path = path + name + '=' + value; |
| 137 | } |
| 138 | } |
| 139 | } |
| 140 | } |
| 141 | args.add(path); |
| 142 | |
| 143 | } else if (path.startsWith("/post")) { |
| 144 | // System.out.println("doPost: " + |