if(!WebloggerRuntimeConfig.getBooleanProperty("uploads.enabled")) {
addError("error.upload.disabled");
return execute();
}
FileManager fmgr = WebloggerFactory.getWeblogger().getFileManager();
List<String> uploaded = new ArrayList();
File[] uploads = getUploadedFiles();
if (uploads != null && uploads.length > 0) {
// loop over uploaded files and try saving them
for (int i=0; i < uploads.length; i++) {
// skip null files
if (uploads[i] == null || !uploads[i].exists())
continue;
// figure file name and path
String fileName = getUploadedFilesFileName()[i];
int terminated = fileName.indexOf("\000");
if (terminated != -1) {
// disallow sneaky null terminated strings
fileName = fileName.substring(0, terminated).trim();
}
// make sure fileName is valid
if (fileName.indexOf("/") != -1 ||
fileName.indexOf("\\") != -1 ||
fileName.indexOf("..") != -1) {
addError("uploadFiles.error.badPath", fileName);
continue;
}
// add on the path element if needed
if(getPath() != null && getPath().trim().length() > 0) {
fileName = getPath() + "/" + fileName;
}
try {
fmgr.saveFile(getActionWeblog(),
fileName,
getUploadedFilesContentType()[i],
uploads[i].length(),
new FileInputStream(uploads[i]));