How to control the authorization when upload image

Well, there are two options to achieve this. You first have to realize, how can you safely determine who has created a specific directory? Do you 'chown' on every directory and file? Java does not allow to determine the object owner directly (except upcoming NIO 2 in Java 7 maybe). I wouldn't go this way.

The preferred option would be to provide a userfiles folder for every user. To provide this, you have to implement UserPathBuilder interface and serve paths as desired.

Be aware that this is virtually a superficial restriction/listing. No one hinders other users to access someone other's files directly through browser's address bar.

Mike

gaoge_2000 wrote::)
Thanks, Mike!

It seems that "UserPathBuilder" is more applicable to our application, it 's much better now although

essentially it can't stop user view others' directory.

May be in our business application(e.g. a forum), we already recorded relationship between the uploaded file and the

upload user in the database. So it may be possible to control which folder should be open for the termimal user

when "getFolderAndList" action triggers. This mean, we don't expect to "check own" on each directory in the server.

Any way, your suggestion is very useful for me.


Cheers.

Hi,

the interface is not intended to enforce any url rights management. It manages only access to X. If you need to control who's accessing a file/dir, do it with a request filter.
If you override the getFolders or getFiles method and you know which is the owner of a folder or file, you can simply filter the list or map you return. Displaying only necessary elements. This is really a no brainer:

String[] fileList = currentDir.list(DirectoryFileFilter.DIRECTORY);
return Arrays.asList(fileList);

would turn into:

String[] fileList = currentDir.list(DirectoryFileFilter.DIRECTORY);
String[] filteredList = filterBySomeCriterion(fileList);
return Arrays.asList(fileList);

Taken from: http://dev.fckeditor.net/browser/FCKedi ... .java#L162

The user will only see what he sould see.

But again, do the better way:

server files with:

/userfiles/<username>/<file type> instead of /userfiles/<file type>. Read the JavaDocs of the LocalConnector: http://dev.fckeditor.net/browser/FCKedi ... ector.java it gives you some ideas.

coolgeek wrote:Sorry if this is a noob question, but I'd like to achieve the same goal - each user being directed to their own directory - but I'm not using java... the app I'm using FCKeditor in is developed in PHP. Do I have any options, or do I need to look somewhere else?

Thanks