Merge pull request #1406 from NCEAS/dev-2.12

Dev 2.12

README.md

@@ -1,6 +1,6 @@
 # Metacat: Data Preservation and Discovery System
 
-Version: 2.12.0 Release
+Version: 2.12.1 Release
 
 Send feedback and bugs to: [email protected]
                            http://github.com/NCEAS/metacat
@@ -67,6 +67,10 @@ for the next release.
 
 ## Release Notes
 
+### Release Notes for 2.12.1:
+Bugs fixed in this release:
+* Patch a security bug
+
 ### Release Notes for 2.12.0:
 New features and bugs fixed in this release:
 * Support a new format id - portal, which will be used on the MetacatUI portal service

build.properties

@@ -2,7 +2,7 @@
 
 #Version of this build.  This needs to be a dotted numeric version.  For
 #instance 1.9.1 is okay.  1.9.1_rc1 is not.
-metacat.version=2.12.0
+metacat.version=2.12.1
 
 #This is for packaging purposes.  leave it blank for final production release.
 metacat.releaseCandidate=

lib/metacat.properties

@@ -25,7 +25,7 @@ server.internalPort=80
 ############### Application Values ############
 
 ## one of the few places where we use ANT tokens
-application.metacatVersion=2.12.0
+application.metacatVersion=2.12.1
 application.metacatReleaseInfo=-1
 application.readOnlyMode=false
 
@@ -117,6 +117,7 @@ database.upgradeVersion.2.10.4=upgrade-db-to-2.10.4
 database.upgradeVersion.2.11.0=upgrade-db-to-2.11.0
 database.upgradeVersion.2.11.1=upgrade-db-to-2.11.1
 database.upgradeVersion.2.12.0=upgrade-db-to-2.12.0
+database.upgradeVersion.2.12.1=upgrade-db-to-2.12.1
 
 ## for running java-based utilities
 database.upgradeUtility.1.5.0=edu.ucsb.nceas.metacat.admin.upgrade.Upgrade1_5_0

metacat-common/pom.xml

@@ -4,7 +4,7 @@
 	<groupId>edu.ucsb.nceas.metacat.common</groupId>
 	<artifactId>metacat-common</artifactId>
 	<packaging>jar</packaging>
-	<version>2.12.0</version>
+	<version>2.12.1</version>
 	<name>metacat-common</name>
 	<url>http://maven.apache.org</url>
 	<properties>

metacat-index/pom.xml

@@ -4,13 +4,13 @@
 	<groupId>edu.ucsb.nceas.metacat.index</groupId>
 	<artifactId>metacat-index</artifactId>
 	<packaging>war</packaging>
-	<version>2.12.0</version>
+	<version>2.12.1</version>
 	<name>metacat-index</name>
 	<url>http://maven.apache.org</url>
 
 	<properties>
         <d1_cn_index_processor_version>2.3.8</d1_cn_index_processor_version>
-        <metacat_common_version>2.12.0</metacat_common_version>
+        <metacat_common_version>2.12.1</metacat_common_version>
     </properties>
 
 	<repositories>

pom.xml

@@ -4,15 +4,15 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.ecoinformatics</groupId>
     <artifactId>metacat</artifactId>
-    <version>2.12.0</version>
+    <version>2.12.1</version>
     <name>metacat</name>
     <packaging>war</packaging>
     <url>http://maven.apache.org</url>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <d1_libclient_version>2.3.1</d1_libclient_version>
         <d1_portal_version>2.3.1</d1_portal_version>
-        <metacat_common_version>2.12.0</metacat_common_version>            
+        <metacat_common_version>2.12.1</metacat_common_version>            
     </properties>
     <repositories>
         <repository>

src/edu/ucsb/nceas/metacat/MetacatHandler.java

@@ -835,11 +835,8 @@ public void handleReadAction(Hashtable<String, String[]> params, HttpServletRequ
                         // case docid="http://.../filename"
                     } else {
                         docid = docs[i];
-                        if (zip) {
-                            addDocToZip(request, docid, providedFileName, zout, user, groups);
-                        } else {
-                            readFromURLConnection(response, docid);
-                        }
+                        //we don't support to read a file or http link directly
+                        throw new Exception("Metacat doesn't support this format of the docid - " + docid);
                     }
 
                 } catch (MalformedURLException mue) {
@@ -1457,54 +1454,6 @@ private String generateOutputName(String docid,
         return outputname;
     }
 
-    /**
-     * read data from URLConnection
-     */
-    private void readFromURLConnection(HttpServletResponse response,
-            String docid) throws IOException, MalformedURLException {
-        ServletOutputStream out = response.getOutputStream();
-        //String contentType = servletContext.getMimeType(docid); //MIME type
-        String contentType = (new MimetypesFileTypeMap()).getContentType(docid);
-        if (contentType == null) {
-            if (docid.endsWith(".xml")) {
-                contentType = "text/xml";
-            } else if (docid.endsWith(".css")) {
-                contentType = "text/css";
-            } else if (docid.endsWith(".dtd")) {
-                contentType = "text/plain";
-            } else if (docid.endsWith(".xsd")) {
-                contentType = "text/xml";
-            } else if (docid.endsWith("/")) {
-                contentType = "text/html";
-            } else {
-                File f = new File(docid);
-                if (f.isDirectory()) {
-                    contentType = "text/html";
-                } else {
-                    contentType = "application/octet-stream";
-                }
-            }
-        }
-        response.setContentType(contentType);
-        // if we decide to use "application/octet-stream" for all data returns
-        // response.setContentType("application/octet-stream");
-
-        // this is http url
-        URL url = new URL(docid);
-        BufferedInputStream bis = null;
-        try {
-            bis = new BufferedInputStream(url.openStream());
-            byte[] buf = new byte[4 * 1024]; // 4K buffer
-            int b = bis.read(buf);
-            while (b != -1) {
-                out.write(buf, 0, b);
-                b = bis.read(buf);
-            }
-        } finally {
-            if (bis != null) bis.close();
-        }
-
-    }
 
     /**
      * read file/doc and write to ZipOutputStream
@@ -1525,34 +1474,6 @@ private void addDocToZip(HttpServletRequest request, String docid, String provid
             Exception {
         byte[] bytestring = null;
         ZipEntry zentry = null;
-
-        try {
-            URL url = new URL(docid);
-
-            // this http url; read from URLConnection; add to zip
-            //use provided file name if we have one
-            if (providedFileName != null && providedFileName.length() > 1) {
-                zentry = new ZipEntry(providedFileName);
-            }
-            else {
-                zentry = new ZipEntry(docid);
-            }
-            zout.putNextEntry(zentry);
-            BufferedInputStream bis = null;
-            try {
-                bis = new BufferedInputStream(url.openStream());
-                byte[] buf = new byte[4 * 1024]; // 4K buffer
-                int b = bis.read(buf);
-                while (b != -1) {
-                    zout.write(buf, 0, b);
-                    b = bis.read(buf);
-                }
-            } finally {
-                if (bis != null) bis.close();
-            }
-            zout.closeEntry();
-
-        } catch (MalformedURLException mue) {
 
             // this is metacat doc (data file or metadata doc)
             try {
@@ -1617,7 +1538,6 @@ private void addDocToZip(HttpServletRequest request, String docid, String provid
             } catch (Exception except) {
                 throw except;
             }
-        }
     }
 
     /**

src/loaddtdschema-postgres.sql

@@ -212,4 +212,4 @@ INSERT INTO xml_catalog (entry_type, public_id, format_id, system_id)
 INSERT INTO xml_catalog (entry_type, public_id, system_id) SELECT 'Schema', 'http://www.openarchives.org/OAI/2.0/oai_dc/', '/schema/oai_dc/oai_dc.xsd'  WHERE NOT EXISTS (SELECT * FROM xml_catalog WHERE public_id='http://www.openarchives.org/OAI/2.0/oai_dc/');
 
 INSERT INTO db_version (version, status, date_created) 
-  VALUES ('2.12.0',1,CURRENT_DATE);
+  VALUES ('2.12.1',1,CURRENT_DATE);

src/upgrade-db-to-2.12.1-postgres.sql

@@ -0,0 +1,12 @@
+/*
+ * Ensure xml_catalog sequence is at table max
+ */
+SELECT setval('xml_catalog_id_seq', (SELECT max(catalog_id) from xml_catalog));
+
+/*
+ * update the database version
+ */
+UPDATE db_version SET status=0;
+
+INSERT INTO db_version (version, status, date_created)
+  VALUES ('2.12.1', 1, CURRENT_DATE);

test/edu/ucsb/nceas/metacatnettest/MetaCatServletNetTest.java

@@ -106,7 +106,6 @@ public static Test suite() {
 		String serial = null;
 
 		TestSuite suite = new TestSuite();
-		suite.addTest(new MetaCatServletNetTest("initialize"));
 		suite.addTest(new MetaCatServletNetTest("testNCEASLoginFail"));
 		//Should put a login successfully at the end of login test
 		//So insert or update can have cookie.
@@ -138,18 +137,11 @@ public static Test suite() {
 		number = Math.random() * 100000;
 		serial = Integer.toString(((new Double(number)).intValue()));
 		suite.addTest(new MetaCatServletNetTest("testLogOut"));
+		suite.addTest(new MetaCatServletNetTest("testReadFile"));
 
 		return suite;
 	}
 
-	/**
-	 * Run an initial test that always passes to check that the test
-	 * harness is working.
-	 */
-	public void initialize() {
-		assertTrue(1 == 1);
-	}
-
 	/**
 	 * Test the login to nceas succesfully
 	 */
@@ -639,5 +631,20 @@ public InputStream getMetacatInputStream(Properties prop) throws Exception {
 
 
 	}
+
+
+	/**
+	 * Test to read a file from Metacat
+	 * @throws Exception
+	 */
+	public void testReadFile() throws Exception {
+	    String webapps = PropertyService.getProperty("application.deployDir");
+	    String context = PropertyService.getProperty("application.context");
+	    String docId = "file://" + webapps + "/" + context + "/schema/eml-2.2.0/eml.xsd";
+	    String qformat = "zip";
+	    assertTrue(!handleReadAction(docId, qformat));
+	    qformat = "knb";
+	    assertTrue(!handleReadAction(docId, qformat));
+	}
 
 }