/**********************************************************************************
 * 프로그램명 : HttpFileDelete.java 프로그램설명 : 작 성 자 : 작 성 일 : 최신변경일 :
 ***********************************************************************************/

package kr.co.kihyun.beans.totsys.report;

import javax.servlet.*;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.*;
import java.io.*;

import kr.co.kihyun.text.html.ServletUtil;
import kr.co.kihyun.lang.Encoder;
import kr.co.kihyun.moumi.MoumiConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@WebServlet("/servlet/kr.co.kihyun.beans.totsys.report.HttpFileDelete")
public class HttpFileDelete extends HttpServlet {
	/**
	 * 
	 */
	private static final long serialVersionUID = 1L;
        private static final Logger LOG = LoggerFactory.getLogger(kr.co.kihyun.beans.totsys.board.HttpFileUpload.class);
        
	// DB관련 변수
	String sql;
	String writeDate;

	public void doPost(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {

		res.setContentType("text/html");
		res.setContentType("text/html;charset=UTF-8");
		PrintWriter out = res.getWriter();

		String usrFilename = "";
		String svrFilename = "";
		String savePath = "";
		boolean isDel = false;

		try {
			svrFilename = req.getParameter("fileList");
			// 저장 파일 경로

			// savePath = Moumi.getRoot()+"/totsys/repoper/fileUpload/";
			savePath = MoumiConfig.getTotRoot().getPath() + System.getProperty("file.separator") + "repoper"
					+ System.getProperty("file.separator") + "fileUpload";

			String docID = req.getParameter("docID");
			String dpID = req.getParameter("deptID");

			if (svrFilename != null) {
				svrFilename = Encoder.toJava(svrFilename);

                                //3.디렉토리 경로 조작(getParameter)_CWE-22/23/36 : Add by KWON,HAN
                                //4.디렉토리 경로 조작(getProperty)_CWE-22/23/36
                                String chkFilename = "";
                                chkFilename = savePath + System.getProperty("file.separator") + svrFilename;
                                LOG.debug("chkFilename: {}", chkFilename); 
                                if(chkFilename.contains("..") || chkFilename. contains("/")) { // 특수문자열 검증
                                    LOG.debug("HttpFileDelete doPost ===");
                                    LOG.debug("3.디렉토리 경로 조작(getParameter)_CWE-22/23/36 : Not Test {}", chkFilename);
                                    LOG.debug("=========================");
                                    return;
                                }
                                //+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                        
                                //v2. 4.경로 조작 및 자원 삽입_CWE-22/23/36/99 : Update by KWON,HAN                                
//				File file = new File(savePath + System.getProperty("file.separator") + svrFilename);
//				// File file = new File(savePath+"/"+svrFilename);
//				isDel = file.delete();
                                
                                if (svrFilename != null && !"".equals(svrFilename)) {
                                    // 수정 : 외부 입력값 필터링
                                    svrFilename = svrFilename.replaceAll("/","");
                                    svrFilename = svrFilename.replaceAll("\\","");
                                    //svrFilename = svrFilename.replaceAll(".","");
                                    //svrFilename = svrFilename.replaceAll("&","");
                                    
                                    LOG.debug("v2. 4.경로 조작 및 자원 삽입_CWE-22/23/36/99 : HttpFileDelete.doPost svrFilename={} / Not Test", svrFilename);
                                    File file = new File(savePath + System.getProperty("file.separator") + svrFilename);
                                    if (file != null) file.delete();
                                }
                                //================================================================
                                
			}

			if (isDel) {
                            //v2. 1.HTTP 응답분할 : Update by KWON,HAN                            
//				res.sendRedirect("/totsys/repoper/mydocbox/tempbox/write_file_upload.jsp?execMode=del&svrFilename="
//						+ svrFilename + "&usrFilename=" + usrFilename + "&docID=" + docID + "&deptID=" + dpID);
                            if (svrFilename != null || usrFilename != null) {     
                                // 수정 : 외부 입력값 필터링
                                String filtered_svrFilename = svrFilename.replaceAll("\r","").replaceAll("\n","");
                                String filtered_usrFilename = usrFilename.replaceAll("\r","").replaceAll("\n","");      
                                LOG.debug("v2 1.HTTP 응답분할 : HttpFileDelete.doPost() isDel=true filtered_svrFilename={} Not Test", filtered_svrFilename);
                                LOG.debug("v2 1.HTTP 응답분할 : HttpFileDelete.doPost() isDel=true filtered_usrFilename={} Not Test", filtered_usrFilename);
				res.sendRedirect("/totsys/repoper/mydocbox/tempbox/write_file_upload.jsp?execMode=del&svrFilename="
						+ filtered_svrFilename + "&usrFilename=" + filtered_usrFilename + "&docID=" + docID + "&deptID=" + dpID);
                            }
                            //========================================                                    
				return;
			} else {
				out.println(ServletUtil.alert("파일 삭제 실패...! 다시 시도하여 주세요."));
                                
                            //v2. 1.HTTP 응답분할 : Update by KWON,HAN                                    
//				res.sendRedirect("/totsys/repoper/mydocbox/tempbox/write_file_upload.jsp?execMode=del&svrFilename="
//						+ svrFilename + "&usrFilename=" + usrFilename + "&docID=" + docID + "&deptID=" + dpID);
                            if (svrFilename != null || usrFilename != null) {     
                                // 수정 : 외부 입력값 필터링
                                String filtered_svrFilename = svrFilename.replaceAll("\r","").replaceAll("\n","");
                                String filtered_usrFilename = usrFilename.replaceAll("\r","").replaceAll("\n","");      
                                LOG.debug("v2 1.HTTP 응답분할 : HttpFileDelete.doPost() isDel=true filtered_svrFilename={} Not Test", filtered_svrFilename);
                                LOG.debug("v2 1.HTTP 응답분할 : HttpFileDelete.doPost() isDel=true filtered_usrFilename={} Not Test", filtered_usrFilename);
				res.sendRedirect("/totsys/repoper/mydocbox/tempbox/write_file_upload.jsp?execMode=del&svrFilename="
						+ svrFilename + "&usrFilename=" + usrFilename + "&docID=" + docID + "&deptID=" + dpID);
                            }
                            //========================================                                 
			}
		} catch (IOException ex) {
			ex.printStackTrace();
		} catch (Exception ex) {
			ex.printStackTrace();
		}
	}

}
