entando · eliamezzano · Mar 18, 2025 · Mar 17, 2025
diff --git a/.github/workflows/ga-publication.yml b/.github/workflows/ga-publication.yml
@@ -38,15 +38,16 @@ jobs:
             --id "CHECKOUT FOR GA PUBLICATION" \
             --lcd "$LOCAL_CLONE_DIR"
       - name: "Cache Maven packages"
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-m2
       - name: "Configure GA Repository"
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: 11
+          distribution: 'zulu'
           server-id: maven-central
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -73,19 +73,20 @@ jobs:
           ;
       #~ JDK
       - name: "Set up JDK 11"
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: 11
+          distribution: 'zulu'
       #~ MAVEN CACHE
       - name: "Cache Maven packages"
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2
           restore-keys: ${{ runner.os }}-m2
       #~ SONAR CACHE
       - name: Cache SonarCloud packages
-        uses: actions/cache@v1
+        uses: actions/cache@v3
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
@@ -120,13 +121,14 @@ jobs:
           ~/ppl-run checkout-branch pr --lcd "$LOCAL_CLONE_DIR"
       #~ JDK
       - name: "Set up JDK 11"
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: 11
+          distribution: 'zulu'
       #~ MAVEN CACHE
       - name: "Cache Maven packages"
         id: maven-cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-matrix-${{ matrix.scan-type }}

diff --git a/.github/workflows/publication.yml b/.github/workflows/publication.yml
@@ -51,21 +51,23 @@ jobs:
           ;
       #~ JDK
       - name: "Set up JDK 11"
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: 11
+          distribution: 'zulu'
       #~ MAVEN CACHE
       - name: "Cache Maven packages"
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2
           restore-keys: ${{ runner.os }}-m2
       #~ CONFIGURE REPO
       - name: "Configure Entando Nexus Repository"
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: 11
+          distribution: 'zulu'
           server-id: internal-nexus
           server-username: NEXUS_USERNAME
           server-password: NEXUS_PASSWORD
@@ -118,12 +120,13 @@ jobs:
           ;
       #~ JDK
       - name: "Set up JDK 11"
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: 11
+          distribution: 'zulu'
       #~ MAVEN CACHE
       - name: "Cache Maven packages"
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2
@@ -156,12 +159,13 @@ jobs:
           ;
       #~ JDK
       - name: "Set up JDK 11"
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: 11
+          distribution: 'zulu'
       #~ MAVEN CACHE
       - name: "Cache Maven packages"
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2

diff --git a/admin-console/pom.xml b/admin-console/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.entando</groupId>
         <artifactId>app-engine</artifactId>
-        <version>7.2.2</version>
+        <version>7.2.2-fix.1</version>
     </parent>
     <groupId>org.entando.entando</groupId>
     <artifactId>entando-admin-console</artifactId>

diff --git a/cds-plugin/pom.xml b/cds-plugin/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.entando</groupId>
         <artifactId>app-engine</artifactId>
-        <version>7.2.2</version>
+        <version>7.2.2-fix.1</version>
     </parent>
     <artifactId>entando-plugin-jpcds</artifactId>
     <groupId>org.entando.entando.plugins</groupId>

diff --git a/cms-plugin/pom.xml b/cms-plugin/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.entando</groupId>
         <artifactId>app-engine</artifactId>
-        <version>7.2.2</version>
+        <version>7.2.2-fix.1</version>
     </parent>
     <groupId>org.entando.entando.plugins</groupId>
     <artifactId>entando-plugin-jacms</artifactId>

diff --git a/...ain/java/com/agiletec/plugins/jacms/apsadmin/resource/ResourceFileChunksUploadAction.java b/...ain/java/com/agiletec/plugins/jacms/apsadmin/resource/ResourceFileChunksUploadAction.java
@@ -13,14 +13,15 @@
  */
 package com.agiletec.plugins.jacms.apsadmin.resource;
 
+import com.agiletec.plugins.jacms.aps.system.JacmsSystemConstants;
 import com.agiletec.plugins.jacms.aps.system.services.resource.model.ResourceInterface;
-import static com.opensymphony.xwork2.Action.SUCCESS;
+import org.apache.commons.io.FileUtils;
+import org.entando.entando.ent.util.EntLogging.EntLogFactory;
+import org.entando.entando.ent.util.EntLogging.EntLogger;
+import org.springframework.web.multipart.MaxUploadSizeExceededException;
 
 import java.io.*;
 import java.util.Arrays;
-import org.apache.commons.io.FileUtils;
-import org.entando.entando.ent.util.EntLogging.EntLogger;
-import org.entando.entando.ent.util.EntLogging.EntLogFactory;
 
 public class ResourceFileChunksUploadAction extends AbstractResourceAction {
     private static final EntLogger logger = EntLogFactory.getSanitizedLogger(ResourceFileChunksUploadAction.class);
@@ -38,8 +39,9 @@ public class ResourceFileChunksUploadAction extends AbstractResourceAction {
     private Long end;
     private InputStream inputStream;
     private String uploadId;
-    private String fileSize;
-    private boolean valid = true;
+    private long fileSize;
+    private boolean valid = false;
+    private long maxFileUploadSize;
 
     public String newResource() {
         return SUCCESS;
@@ -49,18 +51,22 @@ public String newResource() {
     public void validate() {
         logger.info("ResourceFileChunksUploadAction validate");
         logger.info("resourceTypeCode {}", resourceTypeCode);
-        if (null==resourceTypeCode || null==fileName)
-        {
+        String errorMessage = null;
+        if (this.hasErrors() || null == resourceTypeCode || null == fileName) {
             valid = false;
-        }
-        else if (resourceTypeCode.equals("Image") || resourceTypeCode.equals("Attach")) {
-
+        } else if (resourceTypeCode.equals(JacmsSystemConstants.RESOURE_IMAGE_CODE) ||
+                resourceTypeCode.equals(JacmsSystemConstants.RESOURE_ATTACH_CODE)) {
             setResourceTypeCode(resourceTypeCode);
-
-            if (null != this.getResourceTypeCode()) {
+            if (this.getFileSize() > this.getMaxFileUploadSize()) {
+                valid = false;
+                errorMessage = this.getText("error.resource.file.tooBig", new String[]{fileName});
+            } else if (null != this.getResourceTypeCode()) {
                 ResourceInterface resourcePrototype = this.getResourceManager().createResourceType(this.getResourceTypeCode());
                 if (null != resourcePrototype) {
                     valid = this.checkRightFileType(resourcePrototype, fileName);
+                    if (!valid) {
+                        errorMessage = this.getText("error.resource.file.wrongFormat", new String[]{fileName});
+                    }
                 } else {
                     valid = false;
                 }
@@ -70,6 +76,14 @@ else if (resourceTypeCode.equals("Image") || resourceTypeCode.equals("Attach"))
         } else {
             valid = false;
         }
+        if (!valid) {
+            resultMessage = RESULT_VALIDATION_ERROR;
+            if (errorMessage == null) {
+                this.addActionError(this.getText("error.resource.filename.uploadError", new String[]{fileName}));
+            } else {
+                this.addActionError(errorMessage);
+            }
+        }
         logger.info("valid {}", valid);
     }
 
@@ -103,26 +117,30 @@ protected boolean isValidType(String docType, String[] rightTypes) {
     }
 
     public String upload() {
-        if (valid) {
-            logger.info("ResourceFileChunksUploadAction Save {}",fileName);
-            logger.debug("start {}", start);
-            logger.debug("end {}", end);
-            logger.debug("fileUpload {}", fileUpload);
-            logger.debug("contentType {}", fileUploadContentType);
-            logger.debug("filename {}", fileName);
-            logger.debug("uploadId {}", uploadId);
-            logger.debug("fileSize {}", fileSize);
-            logger.debug("resourceTypeCode {}", resourceTypeCode);
-            try {
-                processChunk(fileUpload, uploadId + ".tmp", start, end);
-            } catch (IOException ex) {
-                resultMessage = RESULT_FAILED;
-                inputStream = new ByteArrayInputStream(RESULT_FAILED.getBytes());
-                logger.error("Error processing the file chunk {}", ex);
-            }
+        if (!valid) {
+            return INPUT;
+        }
+        logger.info("ResourceFileChunksUploadAction Save {}",fileName);
+        logger.debug("start {}", start);
+        logger.debug("end {}", end);
+        logger.debug("fileUpload {}", fileUpload);
+        logger.debug("contentType {}", fileUploadContentType);
+        logger.debug("filename {}", fileName);
+        logger.debug("uploadId {}", uploadId);
+        logger.debug("fileSize {}", fileSize);
+        logger.debug("resourceTypeCode {}", resourceTypeCode);
+        try {
+            processChunk(fileUpload, uploadId + ".tmp", start, end);
             resultMessage = RESULT_SUCCESS;
-        } else {
+        } catch (IOException ex) {
+            logger.error("Error processing the file chunk {}", ex);
+            this.addActionError(this.getText("error.resource.filename.uploadError", new String[]{fileName}));
+            resultMessage = RESULT_FAILED;
+            return FAILURE;
+        } catch (MaxUploadSizeExceededException ex) {
+            this.addActionError(this.getText("error.resource.file.tooBig", new String[]{fileName}));
             resultMessage = RESULT_VALIDATION_ERROR;
+            return INPUT;
         }
         inputStream = new ByteArrayInputStream(resultMessage.getBytes());
         logger.debug("result {}", resultMessage);
@@ -136,7 +154,6 @@ protected void processChunk(File fileChunk, String filename, Long start, Long En
         } else {
             this.appendChunk(fileChunk, filename);
         }
-
     }
 
     protected void appendChunk(File fileChunk, String filename) throws IOException {
@@ -147,9 +164,14 @@ protected void appendChunk(File fileChunk, String filename) throws IOException {
         byte[] fileChunkBytes = FileUtils.readFileToByteArray(fileChunk);
         logger.debug("appendChunk bytes {}", fileChunkBytes.length);
 
+        if (file.length() + fileChunkBytes.length > maxFileUploadSize) {
+            logger.error("Max upload size exceeded. File size: {}, chunk size: {}, limit: {}",
+                    file.length(), fileChunkBytes.length, maxFileUploadSize);
+            throw new MaxUploadSizeExceededException(maxFileUploadSize);
+        }
+
         FileUtils.writeByteArrayToFile(file, fileChunkBytes, true);
         logger.debug("appendChunk done");
-
     }
 
     protected void createTempFile(File firstChunk, String filename) throws IOException {
@@ -189,6 +211,14 @@ protected void createTempFile(File firstChunk, String filename) throws IOExcepti
         }
     }
 
+    protected long getMaxFileUploadSize() {
+        return maxFileUploadSize;
+    }
+
+    public void setMaxFileUploadSize(long maxFileUploadSize) {
+        this.maxFileUploadSize = maxFileUploadSize;
+    }
+
     public String getFileUploadContentType() {
         return fileUploadContentType;
     }
@@ -241,11 +271,11 @@ public void setUploadId(String uploadId) {
         this.uploadId = uploadId;
     }
 
-    public String getFileSize() {
+    public long getFileSize() {
         return fileSize;
     }
 
-    public void setFileSize(String fileSize) {
+    public void setFileSize(long fileSize) {
         this.fileSize = fileSize;
     }
 

diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/package_en.properties b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/package_en.properties
@@ -84,6 +84,7 @@ error.resource.delete.invalid=Sorry, the resource you are trying to delete is un
 error.resource.filename.wrongCharacters=The file name contains invalid characters. Only alphanumeric characters, the dot ".", the dash "-" and the underscore "_" are allowed.
 error.resource.filename.blankSpace=The file name contains white spaces. Please use the "normalize" option to automagically get rid of them.
 error.resource.filename.uploadError=File name  ''{0}'' was not uploaded.
+error.resource.file.tooBig=File size of ''{0}'' exceeds the maximum allowed size.
 error.resource.file.descrEmpty=File description is empty
 error.resource.file.fileNameEmpty=The file name list is empty
 error.resource.file.fileEmpty=The file list is empty

diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/package_it.properties b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/package_it.properties
@@ -82,6 +82,7 @@ error.resource.delete.invalid=ID della risorsa da cancellare sconosciuto, imposs
 error.resource.filename.wrongCharacters=Il nome file contiene caratteri non consentiti. Sono consentiti caratteri alfanumerici, il punto ".", il meno "-" e il trattino basso "_". Anche spazi " " se attivata la normalizzazione.
 error.resource.filename.blankSpace=Il nome file contiene degli spazi. Attiva l''opzione di normalizzazione per consentire il caricamento.
 error.resource.filename.uploadError=Il file ''{0}'' non \u00e8 stato caricato. 
+error.resource.file.tooBig=La dimensione del file ''{0}'' supera il limite massimo consentito.
 error.resource.file.descrEmpty=La descrizione del file \u00e8 vuota
 error.resource.file.fileNameEmpty=La lista dei nomi dei file \u00e8 vuota
 error.resource.file.fileEmpty==La lista dei file \u00e8 vuota

diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/resource.xml b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/apsadmin/resource/resource.xml
@@ -85,13 +85,15 @@
         </action>
 
         <action name="upload" class="jacmsResourceFileChunksUploadAction" method="upload">
-            <result type="stream" name="input">
-                <param name="contentType">plain/text</param>
-                <param name="inputStream">inputStream</param>
+            <result type="json" name="input">
+                <param name="statusCode">400</param>
+                <param name="ignoreHierarchy">false</param>
+                <param name="includeProperties">^actionErrors.*,^fieldErrors.*</param>
             </result>
-            <result type="stream" name="failure">
-                <param name="contentType">plain/text</param>
-                <param name="inputStream">inputStream</param>
+            <result type="json" name="failure">
+                <param name="statusCode">500</param>
+                <param name="ignoreHierarchy">false</param>
+                <param name="includeProperties">^actionErrors.*,^fieldErrors.*</param>
             </result>
 
             <result type="stream">