[xwiki-users] Access denied to xwiki.cfg

Mon Jul 30 20:55:30 CEST 2007

Hi Vincent,

This is a proposal for what could be the correct idiom for XWiki
regarding its configuration files. I understand XWiki wants to giver the
option of specifing both filesystem absolute path and context relative
paths for configuration files.

I started by creating the following JSP page, which re-creates the error
I get from XWiki:

------------------- readCfg.jsp ------------------
<%@ page import="java.io.*, java.lang.*, java.util.*, java.net.*,
org.apache.log4j.*" %>
<HTML>
<%
    String xwikicfg = "/WEB-INF/xwiki.cfg";
    InputStream xwikicfgis = null;

    // first try to load the file pointed by the given path
    // if it does not exist, look for it relative to the classpath
    File f = new File(xwikicfg);
    if (f.exists()) {
        out.println("<h1>Read from filesystem</h1>");
        xwikicfgis = new FileInputStream(f);
    } else {
        out.println("<h1>Read as web resource</h1>");
        xwikicfgis = getServletContext().getResourceAsStream(xwikicfg);
    }

    BufferedReader is = new BufferedReader(new InputStreamReader(
        xwikicfgis));
%>

<pre>
<%
    String linha = is.readLine();
    while (linha != null) {
        out.println(linha);
        linha = is.readLine();
    }

    is.close();
%>
</pre>
</HTML>
--------------------------------------

I get the expected result:
javax.servlet.ServletException: Error number 3 in 0: Could not
initialize main XWiki context
Wrapped Exception: access denied (java.io.FilePermission
\WEB-INF\xwiki.cfg read)

If I change "f.existsIO" with "f.canRead()" I get the same exception.
But if I change the order, that is, try first a context-relative path
and only later a filesystem absolute path, it works in my hosting
provider. Please note that I'm not reading "relative to the classpath"
as stated by Vicent. Neither is XWiki, if the code snipset he provided
is correct. So here's my code:

------------------- readCfg2.jsp ------------------
<%@ page import="java.io.*, java.lang.*, java.util.*, java.net.*,
org.apache.log4j.*" %>
<HTML>
<%
    String xwikicfg = "/WEB-INF/xwiki.cfg";
    InputStream xwikicfgis = null;

    xwikicfgis = getServletContext().getResourceAsStream(xwikicfg);
    File f = new File(xwikicfg);
    if (xwikicfgis != null) {
        out.println("<h1>Read as web resource</h1>");
    }
    else if (f.canRead()) {
        out.println("<h1>Read from filesystem</h1>");
        xwikicfgis = new FileInputStream(f);
    } else {
        // this won't be run if there's a SecurityException
        throw new ServletException("Can't open " + xwikicfg);
    }

    BufferedReader is = new BufferedReader(new InputStreamReader(
        xwikicfgis));
%>

<pre>
<%
    String linha = is.readLine();
    while (linha != null) {
        out.println(linha);
        linha = is.readLine();
    }

    is.close();
%>
</pre>
</HTML>
------------------------------------------------

Now it runs fine.

[]s, Fernando Lozano

> Hi Fernando,
>
> This is indeed a bug. Here's what we do:
>
>                     InputStream xwikicfgis = null;
>
>                     // first try to load the file pointed by the given
> path
>                     // if it does not exist, look for it relative to
> the classpath
>                     File f = new File(xwikicfg);
>                     if (f.exists()) {
>                         xwikicfgis = new FileInputStream(f);
>                     } else {
>                         xwikicfgis =
> econtext.getResourceAsStream(xwikicfg);
> ...
>
> The pb is that f.exists() will return true and new FileInputStream
> will throw an exception and thus the else will not get executed.
>
> I have opened an issue: http://jira.xwiki.org/jira/browse/XWIKI-1539
>
> Thanks
> -Vincent

-------------- next part --------------
A non-text attachment was scrubbed...
Name: fernando.lozano.vcf
Type: text/x-vcard
Size: 284 bytes
Desc: not available
Url : http://lists.xwiki.org/pipermail/users/attachments/20070730/40223bc6/attachment-0001.vcf 