Where to store uploaded user content in app

[Eric P <er...@gmail.com>]

Hi ya,

I have an application that I want to write that would allow users to upload an image to somewhere non-web accessible and 
said image is then later moved somewhere web accessible (after image moderation).

For example, in my application I was thinking I would create an empty directory under /web/WEB-INF for the non-web 
accessible image uploads and another empty directory right under /web for the web accessible images.

I'm not totally familiar w/Tomcat's redeploy process, but is it a safe/normal practice to create empty directories in 
your app like this w/o the fear of losing anything when the app is redeployed in production?

Are there better/safer places to put user content for these circumstances?

Thanks for any ideas,
Eric


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Where to store uploaded user content in app

[Eric P <er...@gmail.com>]

Caldarale, Charles R wrote:
>> From: Eric P [mailto:eric.maillist@gmail.com]
>> Subject: Where to store uploaded user content in app
>>
>> For example, in my application I was thinking I would create 
>> an empty directory under /web/WEB-INF for the non-web accessible
>> image uploads and another empty directory right under /web for
>> the web accessible images.
> 
> Bad idea.  You should treat the deployment area as read-only, at least from the webapp's perspective.  To be spec compliant, you can't even assume that the deployment area is part of the platform's file system.  Better to locate the necessary directories completely outside of Tomcat's directory structure, and provide system or <Context> properties to tell the webapp where to find them.
> 
> As far as serving the moderated images, it's easy to define a simple <Context>-only webapp for that location, and let Tomcat's DefaultServlet deliver the pictures.  Just create a <Context> element with a docBase attribute pointing to the approved image directory, and put the <Context> element in conf/Catalina/[host]/[imageURL].xml; no other structure or configuration is needed.
> 
>  - Chuck
> 
> 

Perfect.  This is exactly the kind of answer I was looking for.

Thanks, Chuck!

Eric

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

RE: Where to store uploaded user content in app

["Caldarale, Charles R" <Ch...@unisys.com>]

> From: Eric P [mailto:eric.maillist@gmail.com]
> Subject: Where to store uploaded user content in app
> 
> For example, in my application I was thinking I would create 
> an empty directory under /web/WEB-INF for the non-web accessible
> image uploads and another empty directory right under /web for
> the web accessible images.

Bad idea.  You should treat the deployment area as read-only, at least from the webapp's perspective.  To be spec compliant, you can't even assume that the deployment area is part of the platform's file system.  Better to locate the necessary directories completely outside of Tomcat's directory structure, and provide system or <Context> properties to tell the webapp where to find them.

As far as serving the moderated images, it's easy to define a simple <Context>-only webapp for that location, and let Tomcat's DefaultServlet deliver the pictures.  Just create a <Context> element with a docBase attribute pointing to the approved image directory, and put the <Context> element in conf/Catalina/[host]/[imageURL].xml; no other structure or configuration is needed.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org