lundi 21 septembre 2015

Allow users to download only once

A web app, the client side is jsp and backend is JAVA, DB is simple sqlite. In the DB there is a table that contains "files" called Reports, and users are allowed to download each file in the DB only ONCE "Due to security requirements", and I have been trying to find a way to do that. Is there anyway I can write a jsp code that allows the users to download the requested file once from the DB?

I don't know if it is useful but this is the JAVA piece of code that is used to download from the DB.

String sql = "SELECT file, filename FROM reports INNER JOIN download USING(tipid) WHERE reports.tipid = ?"+
                "AND download.ts_" + ae_num+ " = 0;";

        PreparedStatement stmt = c.prepareStatement(sql);
        String tipNum = request.getParameter("tipid");
        if (tipNum != null) {

            stmt.setString(1, tipNum);
            //stmt.setString(2, tipNum);
            ResultSet res = stmt.executeQuery();
            BufferedInputStream fileBlob = null;
            String filename = "";

            while (res.next()) {
                fileBlob = new BufferedInputStream(res.getBinaryStream("file"), DEFAULT_BUFFER_SIZE);

                filename = res.getString("filename");
            }
            if (fileBlob != null) {
                System.out.println(filename);
                response.setContentType("APPLICATION/OCTET-STREAM");
                response.setHeader("Content-Disposition", "attachment; filename=\"" + filename + "\"");

                BufferedOutputStream output = new BufferedOutputStream(response.getOutputStream(),
                        DEFAULT_BUFFER_SIZE);

                byte[] buffer = new byte[DEFAULT_BUFFER_SIZE];
                int length;
                while ((length = fileBlob.read(buffer)) > 0) {
                    output.write(buffer, 0, length);
                }

                output.close();
                fileBlob.close();
                Date now = new Date();

                sql = "UPDATE download SET ts_" + ae_num + " = " + now.getTime() + " WHERE tipid = ?;";
                System.out.println(sql);
                stmt = c.prepareStatement(sql);
                stmt.setString(1, tipNum);

                stmt.executeUpdate();
                stmt.close();

                c.commit();
                c.close();

Any ideas? Would using cookies in JSP help to implement that? If so can someone guide me?

Aucun commentaire:

Enregistrer un commentaire