Trusted and Signed Applet still gets java.io.filepermission read error

[philip depalo]

So when I run the applet from a "client" machine before I signed and trusted the applet I could not even display the "browse directories" window to upload a file. I signed the jar file and now that window comes up and I can read all the directories and files, but when I choose to upload a file the java console shows the :java.io.FilePermission access denied error "filename" read

error...so what can I do?

[philip depalo]

as additional information if I add the
grant
all permissions to the client machines java.policy file everything works fine...but obviously that is not a solution for anyone who is going to use the program...

[Paul Clapham]

So you're saying your applet can read files for some other purpose but it can't read files if you plan to upload them?

If that's the case then it isn't the reading that's the problem, it's something else.

[philip depalo]

i just read something that said when an applet is launche from html code it acts as an unsigned applet...why? How do you avoid that?

[philip depalo]

Paul Clapham wrote:So you're saying your applet can read files for some other purpose but it can't read files if you plan to upload them?

If that's the case then it isn't the reading that's the problem, it's something else.

It can't read files at all. The directory browser window opens, but that is a java util thing, not a read thing. The specific error is an io file permission error saying read...when I grant access in the clients java.policy file it works...so it works then...any ideas?

[Paul Clapham]

Then that suggests you don't have a signed applet there. When you connected to the applet from the web site it's hosted at, did you have to click the button which said you accepted the applet which came from whoever you said you were when you signed it?

[philip depalo]

Paul Clapham wrote:Then that suggests you don't have a signed applet there. When you connected to the applet from the web site it's hosted at, did you have to click the button which said you accepted the applet which came from whoever you said you were when you signed it?

Yes I clicked that button...what does this page mean? See the NOTE about signed applets at the bottom:
Java Sun

[Paul Clapham]

I assume you mean this?

When a signed applet is accessed from JavaScript code in an HTML page, the applet is executed within the security sandbox. This implies that the signed applet essentially behaves likes an unsigned applet.

What don't you understand about it? More to the point, are you doing the thing which would make that quote relevant to your question?

[philip depalo]

When you say am I doing the thing that would make that quote relevant, well here is the HTML page that calls the applet:

  <%@ page contentType="text/html" %>
<%@ page import="java.util.*,java.awt.*,user.object.ObjUser" %>

<%@ page import="java.util.*,java.io.*,java.net.*,javax.naming.*"%>
<%@ page import="java.util.regex.*" %>
<%@ page import="javax.servlet.*"%>
<%@ page import="javax.servlet.http.*" %>

<% 
   ObjUser user = (ObjUser)session.getAttribute("userinfo");
   String userName = user.getUserFullName();
   String userId = user.getUserId(); 
   String topicId= new String("1");
   
   
	/**
	 * Modified on : 01/15/04
	 * Description : This gets the context path of the file. It replaces the present
	 *					file name with the properties file where the actual property
	 *					for codebase is existing. Instanties the Properties() class
	 *					and gets the constant codebase.
	 **/
		
    Properties	prop = new Properties();
    FileInputStream fstream = null;
	String vceiHome = null;
    String vceiServer = null;
    String vceiServerImageBase = null;
    String vceiUploadServer= null;
    String vceiUploadPath= null;
    String vceiCodeBase= null;
    Hashtable env = new Hashtable(11);
                    env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.fscontext.RefFSContextFactory");
                    env.put(Context.PROVIDER_URL, "file:/vicdil/properties");
    try {
        Context ctx = new InitialContext(env);

        // Perform lookup and cast to target type
        File f = (File) ctx.lookup("vcei_s.properties");
        fstream = new FileInputStream(f);
         prop = new Properties();
        prop.load(fstream);
         vceiCodeBase=prop.getProperty("vceiCodeBase");
    	 vceiHome=prop.getProperty("vceiHome");
         vceiServer=prop.getProperty("vceiServer");
         vceiServerImageBase = prop.getProperty("vceiServerImageBase");	
         vceiUploadServer=prop.getProperty("vceiUploadServer");
         vceiUploadPath=prop.getProperty("vceiUploadPath");		
        // Close the context when we're done
        ctx.close();
    } catch (NamingException e) {
        System.out.println("Lookup failed: " + e);
    }catch(Exception ex){
        System.out.println("Lookup failed: " + ex);
    } finally {
        if(fstream != null) {
            try {
                fstream.close();
            } catch(IOException e) {
                System.out.println("Error while closing the File stream : " + e);
            }
        }
    }
        //Dimension screenSize= Toolkit.getDefaultToolkit().getScreenSize();
        //int w= screenSize.width;
        //int h= screenSize.height-100;
%>
<HTML>
<HEAD>
<TITLE> Virtual Collaboration among Experts over the Internet</TITLE>
</HEAD>
<BODY leftmargin="0" topmargin="0">
<object 
  classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93" width="980" height="650"
  codebase="http://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab#Version=1,5,0,0">
  <param name="code" value="SessionClient.class">
  <param name="codebase" value="<%=vceiCodeBase%>">
  <param name="archive" value="SSignedApplet.jar">
  <param name="type" value="application/x-java-applet;version=1.6.0">
  <param name="scriptable" value="false">  
  <param name="topicId" value="<%=topicId%>">
  <param name="userId" value="<%=userId%>">  
  <param name="userName" value="<%=userName%>">
  <param name="vceiHome" value="<%=vceiHome%>">
  <param name="vceiServer" value="<%=vceiServer%>">
  <param name="vceiServerImageBase" value="<%=vceiServerImageBase%>">
  <param name="vceiUploadServer" value="<%=vceiUploadServer%>">
  <param name="vceiUploadPath" value="<%=vceiUploadPath%>">
      <comment>
      <embed 
        type="application/x-java-applet;version=1.6" \
        code="SessionClient.class" \
      	CODEBASE="<%=vceiCodeBase%>" \
      	archive="SSignedApplet.jar" \
      	width=980 height=700 \
     	topicId="<%=topicId%>" \
      	userId ="<%=userId%>" \
      	userName="<%=userName%>" \
		vceiHome="<%=vceiHome%>" \
        vceiServer="<%=vceiServer%>" \
        vceiServerImageBase="<%=vceiServerImageBase%>" \
        vceiUploadServer="<%=vceiUploadServer%>" \
        vceiUploadPath="<%=vceiUploadPath%>">
      	scriptable=false
        pluginspage="http://java.sun.com/products/plugin/index.html#download">
        <noembed>
          No Java Support.
        </noembed>
      </embed>
    </comment>

</object>

</body>
</html>
  

Am I doing the thing it is quoting, if so how do I do it differently?

[Ulf Dittmer]

Sometimes it's necessary to execute code as privileged in addition to the applet being signed; see HowCanAnAppletReadFilesOnTheLocalFileSystem for details on that.

[philip depalo]

So I had seen the information on your site before about that "do.privileged" but I don't know what that means or how I am supposed to use it. So here is the code where the file is being uploaded:

  import java.io.*;
import java.awt.*;
import java.awt.event.*;
import java.awt.image.*;
import java.util.Vector;
import javax.swing.*;
import java.net.URL; 
import javax.swing.tree.DefaultMutableTreeNode;
import javax.swing.event.*;


import org.apache.commons.httpclient.HttpClient;
import org.apache.commons.httpclient.HttpStatus;
import org.apache.commons.httpclient.methods.PostMethod;
import org.apache.commons.httpclient.methods.multipart.FilePart;
import org.apache.commons.httpclient.methods.multipart.MultipartRequestEntity;
import org.apache.commons.httpclient.methods.multipart.Part;
import org.apache.commons.httpclient.params.HttpMethodParams;

public class ThumbnailHandler implements ChangeListener {

    private ObjectInputStream ois;
    private ObjectOutputStream oos;
    private int SCALE_WIDTH = 30;
    private int SCALE_HEIGHT = 30;
    private BufferedImage bi =null;
    //private Vector btnThumbVec; //private JButton thumbButtons[];
    private Vector panelVec;    //private JPanel panelArr[]; 
    //private Vector lblThumbVec; //private JLabel thumbLbl[];
    private JPanel thumbPanel;
    private JScrollPane scrollThumbPanel;
    private JTabbedPane tabPane;
    private JPanel jpanel;
    private JApplet mainApplet;
    private Vector imgList;
    //private Vector imgVector;
    private JButton addBtn;
    private JButton delBtn;
    private JButton fitTabBtn;
    private JButton delPntButton;
    private Vector <TabLayer> vecTabLayer;
    private JDialog uploadDialog;
    private Container contentPane;
    private Component thisFrame;
    private String userId;
    private String userName;
    private String topicId;
    
    private OpinionTreeHandler oth;
    private Frame mainFrame= (Frame)SessionClient.mainFrame;
                
    String imageURL, uploadServer, uploadPath;
    
    Vector <DicomData> vecDicomData;
    
    public ThumbnailHandler(JApplet mainApplet,
                            Container contentPane,Component frame,
                            JPanel jpanel, JTabbedPane tabPane,
    			    ObjectInputStream ois,
    			    ObjectOutputStream oos,
                            JButton addBtn,
                            JButton delBtn,
                            JButton fitTabBtn,
                            JButton delPntButton,
                            Vector vecTabLayer,
                            String userId,
                            String userName,
                            String tId,
                            String vceiServer, 
                            String vceiServerImageBase,
                            String vceiUploadServer, 
                            String vceiUploadPath) { 
        this.contentPane = contentPane;
   	this.jpanel = jpanel;
    	this.ois = ois;
    	this.oos = oos;
    	this.mainApplet = mainApplet;
    	this.tabPane = tabPane;
    	this.addBtn = addBtn;
    	this.delBtn = delBtn;
    	this.fitTabBtn = fitTabBtn;
    	this.delPntButton = delPntButton;
        this.vecTabLayer=vecTabLayer;
    	this.thisFrame = frame;
    	this.userId = userId;
    	this.userName = userName;
        this.topicId = tId;
        //this.imageURL= vceiServerImageBase+File.separator+tId;
        this.imageURL= vceiServerImageBase+"/"+topicId;
        this.uploadServer= vceiUploadServer;
        this.uploadPath= vceiUploadPath+"/"+topicId;

    	//imgVector = new Vector();
        //panelVec = new Vector();	
        thumbPanel = new JPanel();
	    
        thumbPanel.setPreferredSize(new Dimension(3*SCALE_WIDTH,700)); 
        thumbPanel.setLayout( new FlowLayout(FlowLayout.LEFT,5,5));
        scrollThumbPanel= new JScrollPane(thumbPanel, 
                                          JScrollPane.VERTICAL_SCROLLBAR_ALWAYS, 
                                          JScrollPane.HORIZONTAL_SCROLLBAR_NEVER);
        scrollThumbPanel.setPreferredSize(new Dimension(3*SCALE_WIDTH+15,535));

        addBtn.addActionListener(new ActionListener() {    // input text
            public void actionPerformed(ActionEvent e) {
            	UploadImage ui = new UploadImage();
            }
        });
        delBtn.addActionListener(new ActionListener() {    // input text
            public void actionPerformed(ActionEvent e) {
            	DeleteImage di = new DeleteImage();
            }
        });
        fitTabBtn.addActionListener(new ActionListener() {    // input text
            public void actionPerformed(ActionEvent e) {
            	FitTab ft = new FitTab();
            }
        });
        
        tabPane.addChangeListener(this); 
    }
    
    public void stateChanged(ChangeEvent e) {
        if (e.getSource() == tabPane) {
            //SessionClient.tagInfoFrame.setImageNo(tabPane.getSelectedIndex());
            int i= tabPane.getSelectedIndex();
            if (i < 0) return;
            String str= tabPane.getTitleAt(i);
            SessionClient.tagInfoFrame.setImageNo(str);
        }
    }


    public void receiveDicoms(boolean first) {
        try {
            if (first) {
                vecDicomData= (Vector)ois.readObject();
                SessionClient.tagInfoFrame.setTagInfoFrame(vecDicomData);
            } else {
                //int imgInt = ois.readInt();
                int imgInt = ((Integer)ois.readObject()).intValue();
                if (vecDicomData.size()<=imgInt) {
                    vecDicomData.setSize(imgInt+1);
                }
                vecDicomData.setElementAt((DicomData)ois.readObject(), imgInt);
                SessionClient.tagInfoFrame.makeImageNo(Integer.toString(imgInt));
            }
        } catch (Exception e) { 
	        JOptionPane.showMessageDialog(mainFrame, e.toString());
	 }        
    }
    public void receiveImages(boolean upload) {	
    	try {
            String fileName, imgNo;
            int imgInt;
            Image orgImage;
            
     	    imgList = (Vector) ois.readObject();
                
    	    for( int i = 0; i < imgList.size(); i++ ) { 
                fileName = (String)imgList.elementAt(i);
                if (fileName == null) continue;
                int pos= fileName.indexOf("-");
                if (pos <= 0) continue;
    	    	imgNo = fileName.substring(0,pos);
                imgInt= Integer.parseInt(imgNo);
    		
    		//orgImage = mainApplet.getImage(new URL(imageURL+File.separator+fileName));
                orgImage = mainApplet.getImage(new URL(imageURL+"/"+fileName));
                //System.out.println(imageURL);
    		//imgVector.addElement(orgImage); 
 
                TabLayer tabLayer= new TabLayer(tabPane, imgInt, orgImage);
                vecTabLayer.addElement(tabLayer);
    
                JScrollPane jscPane= addTabPane(tabLayer);
                //fitTabBtn.doClick();
                //fitTabBtn.doClick();

                addThumbnail(orgImage, imgInt, jscPane);
                if (upload){
                    oth.addImageNode(fileName, imgInt); 
                }
	    }
	    jpanel.add(scrollThumbPanel);		

         } catch (Exception e) { 
	        JOptionPane.showMessageDialog(mainFrame, e.toString());
	 }
 
	 jpanel.validate();
	 jpanel.repaint();
    }	
    
    private void addThumbnail(Image orgImage, int imgInt, JScrollPane jscPane) {
        JScrollPane jsc= jscPane;
        Image aftImage;
        final String imgNo= String.valueOf(imgInt);
        
        aftImage = orgImage.getScaledInstance(SCALE_WIDTH, SCALE_HEIGHT, 
                                              Image.SCALE_FAST);
        JButton btnTmp= new JButton(new ImageIcon(aftImage));
        btnTmp.setMargin(new Insets(0,0,0,0));
        JLabel lblTmp= new JLabel("     " + imgNo);
        JPanel panelTmp= new JPanel();
        LayoutManager layout = new BoxLayout(panelTmp,BoxLayout.Y_AXIS);
        panelTmp.setLayout(layout);
        panelTmp.add(btnTmp);
        panelTmp.add(lblTmp);
        //panelVec.addElement(panelTmp);

        thumbPanel.add(panelTmp);
        System.out.println(thumbPanel);
/*        
        btnTmp.addActionListener(new ActionListener() {    // input text
            public void actionPerformed(ActionEvent e) {
                tabPane.setSelectedComponent(jsc); 
            }
        });
 */
        btnTmp.addMouseListener(
	    new MouseAdapter ()	{
		public void mouseClicked ( MouseEvent e ) {  
                    int idx = tabPane.indexOfTab(imgNo);
                    if (idx >= 0) { 
                        tabPane.setSelectedIndex(idx); 
                    }
                }
	    }
	);
    }
    private JScrollPane subAddTabPane(String imageNo, JLayeredPane layer) {          
        JScrollPane jscr= new JScrollPane(layer);
        tabPane.addTab(imageNo,jscr);
        tabPane.validate();
        tabPane.repaint();
        return jscr;
    }
    private JScrollPane addTabPane(TabLayer tabLayer) {
        JLayeredPane fitLayer, orgLayer;
        JScrollPane jscr;
        String imageNo;
  
        fitLayer= tabLayer.getFitLayer();
        orgLayer= tabLayer.getOrgLayer();    
        imageNo= String.valueOf(tabLayer.getImageNo());

        tabPane.setVisible(false);
        if (fitTabBtn.getText().equals("Original")) {  
            subAddTabPane(imageNo, orgLayer);    
            int cnt= tabPane.getTabCount()-1;
            jscr= subAddTabPane(imageNo, fitLayer);   
            tabPane.remove(cnt); 
        }
        else { 
            subAddTabPane(imageNo, fitLayer);    
            int cnt= tabPane.getTabCount()-1;
            jscr= subAddTabPane(imageNo, orgLayer);    
            tabPane.remove(cnt);
        }
        tabPane.setVisible(true);
        return jscr;
    }

    class UploadImage implements ActionListener {
        private DefaultListModel fileListModel; 
        private JList fileList;
        private JButton okBtn = new JButton("UPDATE");
        private JButton cancelBtn = new JButton("CANCEL");
        private JFileChooser fc;
        private JButton addFileBtn = new JButton(" Add ");
        private JButton delFileBtn = new JButton("Delete");
        //private String uploadServer = //"http://vicdil.towson.edu:9005/vcei/servlet/VceiUploadServer";
                                    //= "http://localhost:8080/vcei/servlet/UploadServer";
        
    	public UploadImage() {
            Frame frame = (Frame)thisFrame;
            JDialog.setDefaultLookAndFeelDecorated(true); 
            uploadDialog = new JDialog(frame,"Upload Image", true);
            Container dialogContentPane = uploadDialog.getContentPane();


            fc = new JFileChooser();;
            fc.setMultiSelectionEnabled(true);
            fc.setDragEnabled(true);
            fc.setControlButtonsAreShown(false);     
            fc.addChoosableFileFilter(new ImageFilter());
            fc.setAcceptAllFileFilterUsed(false);
            //fc.setPreferredSize(new Dimension(450, 220));

            JPanel fcPanel = new JPanel(new BorderLayout());
            fcPanel.add(fc, BorderLayout.CENTER);   
            
            JPanel centerPane= new JPanel();
            JPanel bottomPane = new JPanel();

            JPanel filePane= new JPanel();

            fileListModel = new DefaultListModel();

            dialogContentPane.add(filePane, BorderLayout.NORTH);
            dialogContentPane.add(bottomPane, BorderLayout.SOUTH);

            JLabel labelFileTitle = new JLabel("Upload Image Files");  
            JPanel upFilePane = new JPanel();
            JPanel leftFilePane = new JPanel();
            JPanel botCenterFilePane = new JPanel(new FlowLayout(FlowLayout.CENTER,50, 10));
            JPanel botBottomFilePane = new JPanel();        

            fileList = new JList(fileListModel);

            addFileBtn.setMargin(new Insets(0,5,0,5));
            delFileBtn.setMargin(new Insets(0,5,0,5));

            fileList.setBorder(BorderFactory.createLoweredBevelBorder());
            JScrollPane fileListScrollPane = new JScrollPane(fileList);
            fileListScrollPane.setPreferredSize(new Dimension(470,130));

            upFilePane.setLayout(new FlowLayout(FlowLayout.LEFT));
            upFilePane.add(labelFileTitle);
            leftFilePane.add(fc);       

            botCenterFilePane.add(addFileBtn);
            botCenterFilePane.add(delFileBtn);

            botBottomFilePane.setLayout(new FlowLayout(FlowLayout.CENTER));
            botBottomFilePane.add(fileListScrollPane);

            filePane.setLayout(new BorderLayout());
            JPanel bottomFilePane= new JPanel(new BorderLayout());
                bottomFilePane.add(leftFilePane,BorderLayout.NORTH);
                bottomFilePane.add(botBottomFilePane,BorderLayout.SOUTH);
                bottomFilePane.add(botCenterFilePane,BorderLayout.CENTER);
            filePane.add(bottomFilePane);        

            okBtn.setMargin(new Insets(0,5,0,5));
            cancelBtn.setMargin(new Insets(0,0,0,0));
            bottomPane.add(okBtn);
            bottomPane.add(cancelBtn);

            bottomPane.setLayout(new FlowLayout(FlowLayout.CENTER,80, 20));

            okBtn.addActionListener(this);
            cancelBtn.addActionListener(this);
            addFileBtn.addActionListener(this);    	    
            delFileBtn.addActionListener(this);
  	    
    	   // uploadDialog.setSize(new Dimension(250,300));
            uploadDialog.pack();
	    uploadDialog.setLocationRelativeTo(frame);
	    uploadDialog.setVisible(true);

    	}

	public void actionPerformed(ActionEvent e) {	
            try{
                Object source = e.getSource();

                if (source == okBtn) {
                    PostMethod filePost = new PostMethod(uploadServer);
                    int listSize= fileListModel.size();
                    if (listSize <= 0) return;
                    try {
                        Part[] parts= new Part[listSize];
                        for (int i=0; i<listSize; i++) {
                            File targetFile= new File((String)fileListModel.get(i));
                            parts[i]= new FilePart(targetFile.getName(), targetFile);
                        }
                        String strQuery= "tId=" + topicId
                                        + "&uploadPath=" + uploadPath;
                        String queryString= strQuery.replace(' ', '+');
                        filePost. setQueryString(queryString);

                        filePost.setRequestEntity(new MultipartRequestEntity(parts, filePost.getParams()));
                        HttpClient client = new HttpClient();
                        client.getHttpConnectionManager().getParams().setConnectionTimeout(5000);
                        int status = client.executeMethod(filePost);
                        if (status == HttpStatus.SC_OK) {
                            String strImage[];
                            Vector fileList= new Vector();
                            String str= filePost.getResponseBodyAsString();
                            strImage= str.split(";");
                            for (int i=0; i<strImage.length; i++){
                                fileList.addElement(strImage[i]);
                            }
                            addImages(fileList);
                            JOptionPane.showMessageDialog(mainFrame, "Upload Images Successfully!"
                                    +System.getProperty("line.separator")
                                    +str);
                        } else {
                            JOptionPane.showMessageDialog(mainFrame, "Upload Images Fail!");
                        }
                    } catch (Exception ex) {
                        ex.printStackTrace();
                    } finally {
                        filePost.releaseConnection();
                    }
                    uploadDialog.dispose();
                 }
                 else if (source == cancelBtn)  {
                    uploadDialog.dispose();
                 }
                 else if (source == addFileBtn) {
                     File[] selFiles;
                     String pathStr, nameStr;
                     selFiles= fc.getSelectedFiles();
                     for (int i=0; i<selFiles.length; i++) {
                         if (selFiles[i].isFile()) {
                             pathStr= selFiles[i].toString();
                             nameStr= selFiles[i].getName();
                            if (!fileListModel.contains(pathStr)) {
                                fileListModel.addElement(pathStr);
                            }
                         }
                     }
                     fc.setSelectedFiles(null);
                 }
                 else if (source == delFileBtn) {
                     int[] selectedIndices= fileList.getSelectedIndices();
                     for (int i=selectedIndices.length-1; i>=0; i--) {
                         fileListModel.removeElementAt(selectedIndices[i]);
                     }
                 }   
               } catch (Exception aa) { 
                    System.out.println(aa);
               }
	}
    }
                
    class DeleteImage{    
    	public DeleteImage() {   
            int tabIdx = tabPane.getSelectedIndex();
            int imgInt= Integer.parseInt(tabPane.getTitleAt(tabIdx));
            DefaultMutableTreeNode imgNode= oth.getImageNode(imgInt); 
            OpinionObject opnObj= (OpinionObject)imgNode.getUserObject();
            long timeStamp = System.currentTimeMillis();
            int opt= JOptionPane.showConfirmDialog(mainFrame, 
                            "Sure To Delete The Selected Image And Its Node?", 
                            "Delete Image",
                            JOptionPane.YES_NO_OPTION);
            if (opt == 0) {
                try {
                    ServletConnection serv= null;
                    if (SessionClient.flagServlet) {
                        serv= new ServletConnection(SessionClient.requestPath);
                        oos= serv.openRequest(SessionClient.topicId, SessionClient.strOos);
                    }
                    
                    //oos.writeLong(timeStamp);
                    oos.writeObject(new Long(timeStamp));
                    oos.flush();
                    //oos.writeInt(10); // send request
                    oos.writeObject(new Integer(10)); // send request
                    oos.flush();
                    //oos.writeUTF(userId);
                    oos.writeObject(new String(userId));
                    oos.flush();
                    //oos.writeUTF(userName);
                    oos.writeObject(new String(userName));
                    oos.flush();
                    oos.writeObject(opnObj);
                    oos.flush();
           
                    if (SessionClient.flagServlet) {
                        serv.closeRequest();
                    }
                } catch (IOException ioe) {
                    JOptionPane.showMessageDialog(mainFrame, ioe.getMessage());
                } 
            }
        }
    }
                                  
    class FitTab{    
    	public FitTab() {   
            int idx= tabPane.getSelectedIndex();
            TabLayer tabLayer= null;

            tabPane.removeAll();
            if (fitTabBtn.getText().equals("Fit Tab")) {
                for (int i=0; i<vecTabLayer.size(); i++) {
                    tabLayer= (TabLayer)vecTabLayer.elementAt(i);
                    JScrollPane jscr = new JScrollPane(tabLayer.getFitLayer());
                    tabPane.addTab(String.valueOf(tabLayer.getImageNo()),jscr);
                }
                fitTabBtn.setText("Original");
            }
            else {
                for (int i=0; i<vecTabLayer.size(); i++) {
                    tabLayer= (TabLayer)vecTabLayer.elementAt(i);
                    JScrollPane jscr = new JScrollPane(tabLayer.getOrgLayer());
                    tabPane.addTab(String.valueOf(tabLayer.getImageNo()),jscr);                    
                }
                fitTabBtn.setText("Fit Tab");
            }            
            tabPane.setSelectedIndex(idx);
            tabPane.validate();
            tabPane.repaint();            
            delPntButton.doClick();
             
        }
    }
                       
    public void addImages(Vector fileList) {
        long timeStamp = System.currentTimeMillis();
        try {
            ServletConnection serv= null;
            if (SessionClient.flagServlet) {
                serv= new ServletConnection(SessionClient.requestPath);
                oos= serv.openRequest(SessionClient.topicId, SessionClient.strOos);
            }
            
            //oos.writeLong(timeStamp);
            oos.writeObject(new Long(timeStamp));
            oos.flush();
            //oos.writeInt(9);                         // send request
            oos.writeObject(new Integer(9));                         // send request                     
            oos.flush();
            //oos.writeUTF(userId);
            oos.writeObject(new String(userId));
            oos.flush();
            //oos.writeUTF(userName);
            oos.writeObject(new String(userName));
            oos.flush();
            oos.writeObject(fileList);
            oos.flush();
           
            if (SessionClient.flagServlet) {
                serv.closeRequest();
            }
        } catch (IOException ioe) {
            JOptionPane.showMessageDialog(mainFrame, ioe.getMessage());
        }
                
    }
    
    public void deleteImage(int imgInt) {
        String imgNo= String.valueOf(imgInt);
        int idx = tabPane.indexOfTab(imgNo);        
        tabPane.remove(idx);
        thumbPanel.remove(idx); 
        vecTabLayer.remove(idx);
        vecDicomData.setElementAt(null, imgInt);
        SessionClient.tagInfoFrame.removeImageNo(imgNo);
	 jpanel.validate();
	 jpanel.repaint();
    }
    
    public void setOpinionTreeHandler(OpinionTreeHandler handler) {
        this.oth= handler;
    }
    
}
  

So you can see the file upload section, how do I use the "do.privlileged" code?

[Ulf Dittmer]

The code is much too long to try and make sense of it.

What did -or did not- you understand about running code as privileged? It's just a matter of placing code inside the block mentioned in that example.

[philip depalo]

I am just not sure "what code" I should place in the block...if I have code that is specifically reading the file from the user, should I put that in the block?

[Ulf Dittmer]

It is good security practice to run as little code as possible as privileged. Start with the code that causes the exception, and progressively expand it if then other code throws exceptions.

[philip depalo]

so i am trying to use the doPrivileged, but I am getting a can not find symbol method doPrivileged. I did add import java.securty.accesscontroll; to the class file...do I need to add something else?

[philip depalo]

I can not get the doprivileged to work...I still don't undertand why this isnt' working...here is the entire error message:

java.security.AccessControlException: access denied (java.io.FilePermission C:\Users\Philip DePalo\Documents\_TricksTrade\philpass.jpg read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkRead(Unknown Source)
at java.io.File.isFile(Unknown Source)
at org.apache.commons.httpclient.methods.multipart.FilePartSource.<init>(FilePartSource.java:67)
at org.apache.commons.httpclient.methods.multipart.FilePart.<init>(FilePart.java:129)
at ThumbnailHandler$UploadImage.actionPerformed(ThumbnailHandler.java:369)
at javax.swing.AbstractButton.fireActionPerformed(Unknown Source)
at javax.swing.AbstractButton$Handler.actionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.fireActionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.setPressed(Unknown Source)
at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Unknown Source)
at java.awt.Component.processMouseEvent(Unknown Source)
at javax.swing.JComponent.processMouseEvent(Unknown Source)
at java.awt.Component.processEvent(Unknown Source)
at java.awt.Container.processEvent(Unknown Source)
at java.awt.Component.dispatchEventImpl(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source)
at java.awt.LightweightDispatcher.processMouseEvent(Unknown Source)
at java.awt.LightweightDispatcher.dispatchEvent(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Window.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
at java.awt.Dialog$1.run(Unknown Source)
at java.awt.Dialog$3.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.awt.Dialog.show(Unknown Source)
at java.awt.Component.show(Unknown Source)
at java.awt.Component.setVisible(Unknown Source)
at java.awt.Window.setVisible(Unknown Source)
at java.awt.Dialog.setVisible(Unknown Source)
at ThumbnailHandler$UploadImage.<init>(ThumbnailHandler.java:353)
at ThumbnailHandler$1.actionPerformed(ThumbnailHandler.java:107)
at javax.swing.AbstractButton.fireActionPerformed(Unknown Source)
at javax.swing.AbstractButton$Handler.actionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.fireActionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.setPressed(Unknown Source)
at javax.swing.AbstractButton.doClick(Unknown Source)
at javax.swing.AbstractButton.doClick(Unknown Source)
at SessionClient$MenuItemListener.actionPerformed(SessionClient.java:500)
at javax.swing.AbstractButton.fireActionPerformed(Unknown Source)
at javax.swing.AbstractButton$Handler.actionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.fireActionPerformed(Unknown Source)
at javax.swing.DefaultButtonModel.setPressed(Unknown Source)
at javax.swing.AbstractButton.doClick(Unknown Source)
at javax.swing.plaf.basic.BasicMenuItemUI.doClick(Unknown Source)
at javax.swing.plaf.basic.BasicMenuItemUI$Handler.mouseReleased(Unknown Source)
at java.awt.Component.processMouseEvent(Unknown Source)
at javax.swing.JComponent.processMouseEvent(Unknown Source)
at java.awt.Component.processEvent(Unknown Source)
at java.awt.Container.processEvent(Unknown Source)
at java.awt.Component.dispatchEventImpl(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source)
at java.awt.LightweightDispatcher.processMouseEvent(Unknown Source)
at java.awt.LightweightDispatcher.dispatchEvent(Unknown Source)
at java.awt.Container.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.run(Unknown Source)


Any other suggestions? If I create a simple applet that reads a file and outputs it, it works once its signed...