War file -- uploading

Question

          Hi everybody, I have a requirement where i need to upload word document into the
          server.
          When the directory structure was expanded i created an folder called upload in
          the root directory of the
          application and would put all the documents uploaded into that. But now i want
          to deploy
          this application into the production and want to deploy all the application as
          a single war file.
          so how can i write into the upload directory now which is also a part of war file.
          Do i need to write in
          some other directory which is not a part of the war file etc. Any ideas???
          Thanks in Advance
          bobby
          

Answer 1

[from previous post]
          Do not give in to the dark side. To keep your application clean and secure,
          you must treat the application space (the server and the applications under
          it) as sacred. At runtime, in fact, it is best if your application server
          and the applications that it serves are "read only", even by OS level
          security where possible. That prevents a huge number of potential cracks in
          and of itself.
          Where there are items being uploaded from the browser to your app, and those
          items need to be persisted, then they should go to a database or to a
          designated data directory with the naming and organization being controlled
          100% by the app. You must avoid allowing the user to "browse" or "request"
          directly from that directory ... e.g. FileServlet. Likewise, you must avoid
          allowing the user to control how things are stored to that directory. It
          should be as transparent as a typical mail client is -- you don't know
          (unless you look) how the messages are being stored. Are they in Microsoft
          structured storage? In a database? Perhaps stored as files in a directory?
          You don't know from the interface, and you shouldn't. Similarly, a web user
          shouldn't know from the interface, and that includes the point that they
          should not be able to determine the mechanism or organization from the URL.
          And even if they attempt to guess (spoof the url) then the app must prevent
          them from accessing anyone else's data or any data that they should not see,
          and it must prevent them from changing other data too.
          Cameron Purdy
          Tangosol Inc.
          << Tangosol Server: How Weblogic applications are customized >>
          << Download now from http://www.tangosol.com/download.jsp >>
          "bobby" <[email protected]> wrote in message
          news:[email protected]...
          >
          >
          >
          > Hi everybody, I have a requirement where i need to upload word document
          into the
          > server.
          > When the directory structure was expanded i created an folder called
          upload in
          > the root directory of the
          > application and would put all the documents uploaded into that. But now i
          want
          > to deploy
          > this application into the production and want to deploy all the
          application as
          > a single war file.
          > so how can i write into the upload directory now which is also a part of
          war file.
          > Do i need to write in
          > some other directory which is not a part of the war file etc. Any ideas???
          >
          > Thanks in Advance
          > bobby