/*******************************************************************************
 * This file is part of OpenNMS(R).
 *
 * Copyright (C) 2009-2012 The OpenNMS Group, Inc.
 * OpenNMS(R) is Copyright (C) 1999-2012 The OpenNMS Group, Inc.
 *
 * OpenNMS(R) is a registered trademark of The OpenNMS Group, Inc.
 *
 * OpenNMS(R) is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published
 * by the Free Software Foundation, either version 3 of the License,
 * or (at your option) any later version.
 *
 * OpenNMS(R) is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with OpenNMS(R).  If not, see:
 *      http://www.gnu.org/licenses/
 *
 * For more information contact:
 *     OpenNMS(R) Licensing <license@opennms.org>
 *     http://www.opennms.org/
 *     http://www.opennms.com/
 *******************************************************************************/

package org.opennms.web.controller;

import java.io.File;
import java.io.FileInputStream;
import java.io.OutputStream;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.lf5.util.StreamUtils;
import org.opennms.api.reporting.ReportFormat;
import org.opennms.reporting.core.svclayer.ReportStoreService;
import org.opennms.web.MissingParameterException;
import org.opennms.web.WebSecurityUtils;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.mvc.AbstractController;

/**
 * <p>DownloadReportController class.</p>
 *
 * @author ranger
 * @version $Id: $
 * @since 1.8.1
 */
public class DownloadReportController extends AbstractController {

    private ReportStoreService m_reportStoreService;

    /** {@inheritDoc} */
    @Override
    protected ModelAndView handleRequestInternal(HttpServletRequest request,
            HttpServletResponse response) throws Exception {

        String fileName = request.getParameter("fileName");
        if (fileName != null) {
            if (fileName.toLowerCase().endsWith(".pdf")) {
                response.setContentType("application/pdf;charset=UTF-8");

            }
            if (fileName.toLowerCase().endsWith(".csv")) {
                response.setContentType("text/csv;charset=UTF-8");
            }
            response.setHeader("Content-disposition", "inline; filename=" + fileName);
            response.setHeader("Pragma", "public");
            response.setHeader("Cache-Control", "cache");
            response.setHeader("Cache-Control", "must-revalidate");
            StreamUtils.copy(new FileInputStream(new File(fileName)), response.getOutputStream());
            return null;
        }

        String[] requiredParameters = new String[] { "locatorId", "format" };

        for (String requiredParameter : requiredParameters) {
            if (request.getParameter(requiredParameter) == null) {
                throw new MissingParameterException(requiredParameter,
                                                    requiredParameters);
            }
        }

        try {
            Integer reportCatalogEntryId = new Integer(WebSecurityUtils.safeParseInt(request.getParameter("locatorId")));
            
            String requestFormat = new String(request.getParameter("format"));

            if ((ReportFormat.PDF == ReportFormat.valueOf(requestFormat))
                    || (ReportFormat.SVG == ReportFormat.valueOf(requestFormat)) ) {
                response.setContentType("application/pdf;charset=UTF-8");
                response.setHeader("Content-disposition", "inline; filename="
                                   + reportCatalogEntryId.toString()
                                   + ".pdf");
                response.setHeader("Pragma", "public");
                response.setHeader("Cache-Control", "cache");
                response.setHeader("Cache-Control", "must-revalidate");
            }
            if(ReportFormat.CSV == ReportFormat.valueOf(requestFormat)) {
                response.setContentType("text/csv;charset=UTF-8");
                response.setHeader("Content-disposition", "inline; filename="
                                   + reportCatalogEntryId.toString()
                                   + ".csv");
                response.setHeader("Pragma", "public");
                response.setHeader("Cache-Control", "cache");
                response.setHeader("Cache-Control", "must-revalidate");
            }
            m_reportStoreService.render(
                                        reportCatalogEntryId,
                                        ReportFormat.valueOf(requestFormat),
                                        (OutputStream) response.getOutputStream());
        } catch (NumberFormatException e) {
            // TODO something useful here.
        }

        return null;
    }
    
    /**
     * <p>setReportStoreService</p>
     *
     * @param reportStoreService a {@link org.opennms.reporting.core.svclayer.ReportStoreService} object.
     */
    public void setReportStoreService(ReportStoreService reportStoreService) {
        m_reportStoreService = reportStoreService;
    }

}

@@ -134,25 +134,25 @@
 (C) 2009-201
-2
+4
  The OpenNMS
@@ -203,17 +203,17 @@
 1999-201
-2
+4
  The Ope
@@ -1486,16 +1486,152 @@
 Format;%0A
+import org.opennms.core.utils.BeanUtils;%0Aimport org.opennms.core.utils.LogUtils;%0Aimport org.opennms.netmgt.dao.ReportdConfigurationDao;%0A
 import o
@@ -2119,16 +2119,84 @@
 Service;
+%0A    private ReportdConfigurationDao m_reportdConfigurationDao;%0A    
 %0A%0A    /*
@@ -2366,16 +2366,32 @@
 ption %7B%0A
+                
 %0A       
@@ -2439,24 +2439,682 @@
 fileName%22);%0A
+        final File requestedFile = new File(fileName);%0A%0A        m_reportdConfigurationDao = BeanUtils.getBean(%22reportdContext%22, %22reportdConfigDao%22, ReportdConfigurationDao.class);%0A        final File storageDirectory = new File(m_reportdConfigurationDao.getStorageDirectory());%0A        %0A        if (!requestedFile.getParentFile().getCanonicalFile().equals(storageDirectory.getCanonicalFile())) %7B%0A            LogUtils.warnf(this, %22User attempted to retrieve file %25s but was restricted to %25s%22, requestedFile, storageDirectory);%0A            throw new IllegalArgumentException(%22Cannot retrieve reports from outside Reportd storage directory%22);%0A        %7D%0A        %0A
         if (

Fix NMS-6580: Security: downloadReport allow download and view any file in filesystem Restrict to files in the Reportd storage directory (default OPENNMS_HOME/share/reports)