Added SHA256 hash calculation of original document do prevent application document injection

6 files changed, 862 insertions, 808 deletions

diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/FormFields.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/FormFields.java
index 9c95838..0888d7b 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/FormFields.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/FormFields.java
@@ -153,6 +153,8 @@ public abstract class FormFields
   

   public static final String FIELD_MOBILETEST_ENABLED = "mobiletestenabled";

   

+  public static final String FIELD_ORIGINAL_DIGEST = "origdigest";

+  

   

   

   /**

diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/PDFContainer.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/PDFContainer.java
index 9bfd70f..5099f8d 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/PDFContainer.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/PDFContainer.java
@@ -27,11 +27,13 @@ public class PDFContainer {
   

   public long id;

   public byte[] pdf;

+  public String originalDigest;

   

   

-  public PDFContainer(byte[] pdf, long id) {

+  public PDFContainer(byte[] pdf, long id, String originalDigest) {

     this.id = id;

     this.pdf = pdf;

+    this.originalDigest = originalDigest;

   }

   

   public boolean equals(Object pc) {

diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java
index cddd073..4dbe6f0 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/SignServletHelper.java
@@ -262,7 +262,7 @@ public class SignServletHelper
       byte [] signed_pdf = si.signedPdf;

       HttpSession session = request.getSession();

       

-      PDFContainer entry = new PDFContainer(signed_pdf, si.exappinf.pdf_id);

+      PDFContainer entry = new PDFContainer(signed_pdf, si.exappinf.pdf_id, si.plainPDFDigest);

       ProvidePDFServlet.signedDocuments.add(entry);

 

       // notify webapp...

diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java
index 60c5d41..234640b 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java
@@ -66,6 +66,8 @@ public class ProvidePDFServlet extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

       

       String pdfIdString = request.getParameter(FormFields.FIELD_PDF_ID);

+      String plainPDFDigest = request.getParameter(FormFields.FIELD_ORIGINAL_DIGEST);

+      

       HttpSession session = request.getSession();

       

       if (pdfIdString == null) {

@@ -85,6 +87,14 @@ public class ProvidePDFServlet extends HttpServlet {
             // Popup-Blocker, Link-Prefetching, IE 9 SmartScreen-Filter...???

             // session.removeAttribute(SessionAttributes.SIGNED_PDF_DOCUMENT);

             log.debug("Returning signed pdf to browser.");

+            if(plainPDFDigest != null) {

+        		if(!plainPDFDigest.equalsIgnoreCase(si.plainPDFDigest)) {

+        			log.error("PDF Digests don't match!");

+        			log.error("Requested digest: " + plainPDFDigest);

+        			log.error("Saved digest: " + si.plainPDFDigest);

+                    return;

+        		}

+        	}

             SignServletHelper.returnSignResponse(si, request, response);

             log.debug("Removing free text (if any) from session.");

             session.removeAttribute(UpdateFormServlet.UPLOADFORM_FREETEXT_KEY);

@@ -93,32 +103,38 @@ public class ProvidePDFServlet extends HttpServlet {
       } else {

          long pdfId = Long.parseLong(pdfIdString);

 

-         byte[] pdf = null;

-         

+         PDFContainer pdf = null;

          synchronized (signedDocuments) {

             Iterator it = signedDocuments.iterator();

 

             while (it.hasNext() && pdf == null) {

                PDFContainer current = (PDFContainer) it.next();

                if (current.id == pdfId) {

-                  pdf = current.pdf;

+                  pdf = current;

                   signedDocuments.remove(current);

                }

             }

          }

          

-         if (pdf != null) {

+         if (pdf != null && pdf.pdf != null) {

             try {

-

+            	if(plainPDFDigest != null) {

+            		if(!plainPDFDigest.equalsIgnoreCase(pdf.originalDigest)) {

+            			log.error("PDF Digests don't match! 1");

+            			log.error("Requested digest: " + plainPDFDigest);

+            			log.error("Saved digest: " + pdf.originalDigest);

+                        return;

+            		}

+            	}

                SignServletHelper.disableBrowserCacheForResponse(response);

                response.setContentType("application/pdf");

-               response.setContentLength(pdf.length);

+               response.setContentLength(pdf.pdf.length);

                //SignSessionInformation si = (SignSessionInformation)session.getAttribute(SessionAttributes.ATTRIBUTE_SESSION_INFORMATION);

                String filename = (String)session.getAttribute(SignServlet.SUBMITFORM_FILENAME_KEY);

                

                response.setHeader("Content-disposition", "attachment; filename=\""+filename+"\"");

                

-               InputStream is = new ByteArrayInputStream(pdf);

+               InputStream is = new ByteArrayInputStream(pdf.pdf);

                final int bufferSize = 1024;

                byte[] buffer = new byte[bufferSize];

                int len = -1;

diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SignServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SignServlet.java
index cd2c38a..19b729a 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SignServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SignServlet.java
@@ -33,6 +33,8 @@ import java.io.IOException;
 import java.io.InputStream;

 import java.io.UnsupportedEncodingException;

 import java.net.URL;

+import java.security.MessageDigest;

+import java.security.NoSuchAlgorithmException;

 import java.util.Iterator;

 import java.util.List;

 

@@ -44,6 +46,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import javax.servlet.http.HttpSession;

 

+import org.apache.commons.codec.binary.Hex;

 import org.apache.commons.fileupload.FileItem;

 import org.apache.commons.fileupload.FileUploadException;

 import org.apache.commons.fileupload.disk.DiskFileItemFactory;

@@ -78,807 +81,836 @@ import com.lowagie.text.DocumentException;
  * This method is the sign servlet for the pdf-as web application. It takes get

  * and post requests fill out jsp templates and give the user feedback about the

  * results of the sign process

- *

+ * 

  * @author wlackner

  * @author wprinz

  */

-public class SignServlet extends HttpServlet

-{

-

-  /**

-   * SVUID.

-   */

-  private static final long serialVersionUID = -4156938216903740438L;

-

-  /**

-   * The log.

-   */

-  private static Log log = LogFactory.getLog(SignServlet.class);

-

-

-

-  public static final String SUBMITFORM_SIGNATURE_TYPE_KEY   = "signupload.jsp:signatureType";

-  public static final String SUBMITFORM_SIGNATURE_MODE_KEY   = "signupload.jsp:signatureMode";

-  public static final String SUBMITFORM_SIGNATURE_DEVICE_KEY = "signupload.jsp:signatureKey";

-  public static final String SUBMITFORM_PDFA_KEY             = "signupload.jsp:pdfaKey";

-  public static final String SUBMITFORM_SOURCE_KEY           = "signupload.jsp:sourceKey";

-  public static final String SUBMITFORM_FREETEXT_KEY         = "signupload.jsp:freeTextKey";

-  public static final String SUBMITFORM_NOTE_KEY			 = "signupload.jsp:noteKey";

-  public static final String SUBMITFORM_FILE_KEY			 = "signupload.jsp:fileKey";

-  public static final String SUBMITFORM_FILENAME_KEY		 = "signupload.jsp:filenameKey";

-  public static final String SUBMITFORM_PREVIEW		 		 = "signupload.jsp:previewKey";

-

-

-

-

-  //Added by rpiazzi to know if an error occured within IFrame because this calls for

-  //a different display of the error

-  public static final String ERROR_WITHIN_IFRAME			 = "error_within_iframe";

-  //Added by rpiazzi to know the height of the div's in further jsp's

-  public static final String HEIGHT_SIGN_DIV				 = "height_sign_div";

-  //Added by rpiazzi

-  public static HttpSession session = null;

-

-  protected void dispatch(HttpServletRequest request, HttpServletResponse response, String resource) throws ServletException, IOException

-  {

-    dispatch(request, response, resource, getServletContext());

-  }

-

-  protected static void dispatch(HttpServletRequest request, HttpServletResponse response, String resource, ServletContext context) throws ServletException, IOException

-  {

-    response.setContentType("text/html");

-    response.setCharacterEncoding("UTF-8");

-

-    RequestDispatcher disp = context.getRequestDispatcher(resource);

-    disp.forward(request, response);

-  }

-

-  /**

-   * Processes the sign upload.

-   *

-   * @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest,

-   *      javax.servlet.http.HttpServletResponse)

-   */

-  public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException

-  {

-    UploadedData ud = null;

-    ExternAppInformation exappinf = null;

-    SignaturePositioning sigpos = null;

-

-

-    // for performance measurement

-    long startTime = System.currentTimeMillis();

-

-    // check if pdf-as has been called by external webapp

-    if (request.getParameter(FormFields.FIELD_PDF_URL) != null)

-    {

-      String preview = (String) request.getParameter(FormFields.FIELD_PREVIEW);

-      String sig_type = (String) request.getParameter(FormFields.FIELD_SIGNATURE_TYPE);

-      String sig_app = (String) request.getParameter(FormFields.FIELD_CONNECTOR);

-      String sig_mode = (String) request.getParameter(FormFields.FIELD_MODE);

-      String filename = (String) request.getParameter(FormFields.FIELD_FILENAME);

-      String pdf_url = (String) request.getParameter(FormFields.FIELD_PDF_URL);

-      String pdf_id = (String) request.getParameter(FormFields.FIELD_PDF_ID);

-      String invoke_url = (String) request.getParameter(FormFields.FIELD_INVOKE_APP_URL);

-      String invoke_error_url = (String) request.getParameter(FormFields.FIELD_INVOKE_APP_ERROR_URL);

-      String session_id = (String) request.getParameter(FormFields.FIELD_SESSION_ID);

-      String sig_pos_y = (String) request.getParameter(FormFields.FIELD_SIGPOS_Y);

-      String sig_pos_p = (String) request.getParameter(FormFields.FIELD_SIGPOS_P);

-      String sig_pos_x = (String) request.getParameter(FormFields.FIELD_SIGPOS_X);

-      String sig_pos_w = (String) request.getParameter(FormFields.FIELD_SIGPOS_W);

-      String note = (String) request.getParameter(FormFields.FIELD_NOTE_ENABLED);

-

-      //Added by rpiazzi

-      log.debug("Received external request from "+request.getRemoteAddr());

-      log.debug("Parameter preview: "+preview);

-      log.debug("Parameter sig_type: "+sig_type);

-      log.debug("Parameter sig_app: "+sig_app);

-      log.debug("Parameter sig_mode: "+sig_mode);

-      log.debug("Parameter filename: "+filename);

-      log.debug("Parameter pdf_url: "+pdf_url);

-      log.debug("Parameter pdf_id: "+pdf_id);

-      log.debug("Parameter invoke_url: "+invoke_url);

-      log.debug("Parameter invoke_error_url: "+invoke_error_url);

-      log.debug("Parameter session_id: "+session_id);

-      log.debug("Parameter sig_pos_y: "+sig_pos_y);

-      log.debug("Parameter sig_pos_p: "+sig_pos_p);

-      log.debug("Parameter sig_pos_x: "+sig_pos_x);

-      log.debug("Parameter sig_pos_w: "+sig_pos_w);

-      log.debug("Parameter note: "+note);

-      //end added

-

-      session = request.getSession(true);

-

-      session.setAttribute(SignServlet.SUBMITFORM_FILENAME_KEY, filename);

-

-      // added by tknall

-      if (sig_pos_y != null && sig_pos_p != null && sig_pos_x != null) {

-    	 if (sig_pos_w != null) {

-    		 try

-             {

-               sigpos = new SignaturePositioning("x:" + sig_pos_x + ";y:" + sig_pos_y + ";w:"+ sig_pos_w + ";p:" + sig_pos_p);

-             }

-             catch (PDFDocumentException e)

-             {

-               log.warn("Unable to create signature position object: " + e.getMessage(), e);

-             }

-    	 }

-    	 else {

-    		 try

-             {

-               sigpos = new SignaturePositioning("x:" + sig_pos_x + ";y:" + sig_pos_y + ";p:" + sig_pos_p);

-             }

-             catch (PDFDocumentException e)

-             {

-               log.warn("Unable to create signature position object: " + e.getMessage(), e);

-             }

-    	 }

-      } else {

-      	log.debug("No signature position provided.");

-      }

-

-

-      // if we already have parameters "&" must be used instead of "?"

-      String paramSeparator = (pdf_url.indexOf("?") != -1) ? "&" : "?";

-      String query = pdf_url + "/" + filename + paramSeparator + FormFields.FIELD_PDF_ID + "=" + pdf_id;

-      //query = pdf_url;

-

-      log.debug("Query string for loading pdf: "+query);

-

-      // wprinz: rem: this allocation is useless

-      // byte[] extern_pdf = new byte[Integer.parseInt(pdf_length)];

-      URL source_url = new URL(query);

-      InputStream is = source_url.openStream();

-

-      // extern_pdf = toByteArray(is);

-

-      // set UploadedData object...

-      UploadedData ud_extern = new UploadedData();

-

-      ud_extern.file_name = filename;

-      ud_extern.pdfDataSource = new ByteArrayPdfDataSource(IOUtils.toByteArray(is));

-

-      ud_extern.preview = "true".equalsIgnoreCase(preview);

-      ud_extern.sig_app = sig_app;

-      ud_extern.sig_mode = sig_mode;

-      ud_extern.sig_type = sig_type;

-

-      if (note!=null) {

-    	  if (note.equals("true")) {

-          	  ud_extern.note=true;

-          	  ud_extern.sig_type = ud_extern.sig_type + "_NOTE";

-          }

-          else {

-        	  ud_extern.note=false;

-          }

-      }

-      else {

-    	  ud_extern.note=true;

-    	  ud_extern.sig_type = ud_extern.sig_type + "_NOTE";

-      }

-

-

-      ud_extern.pdfa = false;

-

-      ud = ud_extern;

-

-      exappinf = new ExternAppInformation(invoke_url, pdf_id, session_id, invoke_error_url);

-

-    }

-    else

-    {

-      try

-      {

-        // tzefferer: modified

-        // UploadedData ud = retrieveUploadedDataFromRequest(request);

-

-    	UploadedData ud_form = retrieveUploadedDataFromRequest(request);

-        ud = ud_form;

-        // end modify

-

-      }

-      catch (PdfAsException e)

-      {

-    	log.error(e);

-

-    	//Added by rpiazzi to check if this attribute is still null

-        HttpSession session = request.getSession();

-        String error_within_iframe = (String)session.getAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY);

-        if (error_within_iframe==null) {

-        	session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

-        }

-        //end added

-

-        prepareDispatchToErrorPage(e, request);

-        dispatch(request, response, "/jsp/error.jsp");

-

-

-

-

-        return;

-      }

-      catch (FileUploadException e) {

-    	  log.error(e);

-

-    	  //Added by rpiazzi to check if this attribute is still null

-          HttpSession session = request.getSession();

-          String error_within_iframe = (String)session.getAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY);

-          if (error_within_iframe==null) {

-          	session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

-          }

-          //end added

-

-          request.setAttribute("error", e.getMessage());

-          request.setAttribute("cause", e.getCause());

-          request.setAttribute("resourcebundle", Boolean.TRUE);

-          dispatch(request, response, "/jsp/error.jsp");

-      }

-      catch (IOException e) {

-    	  log.error(e);

-

-    	  //Added by rpiazzi to check if this attribute is still null

-          HttpSession session = request.getSession();

-          String error_within_iframe = (String)session.getAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY);

-          if (error_within_iframe==null) {

-          	session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

-          }

-          //end added

-

-    	  request.setAttribute("error", e.getMessage());

-          request.setAttribute("cause", e.getCause());

-          request.setAttribute("resourcebundle", Boolean.TRUE);

-          dispatch(request, response, "/jsp/error.jsp");

-      }

-    }

-    try

-    {

-    	// not needed, that is done in sign()

-		//      ud.pdfDataSource = PdfAS.applyStrictMode(ud.pdfDataSource);

-

-      session = request.getSession(true);

-

-      SignSessionInformation si = new SignSessionInformation(); // SessionTable.generateSessionInformationObject();

-      si.connector = ud.sig_app;

-

-      if ((ud.mobileTestEnabled) && (si.connector.equals("mobile"))) {

-    	  si.connector = Constants.SIGNATURE_DEVICE_MOBILETEST;

-    	  session.setAttribute(SignServlet.SUBMITFORM_SIGNATURE_DEVICE_KEY, si.connector);

-      }

-

-      si.application = "sign";

-      si.mode = ud.sig_mode;

-      si.pdfDataSource = ud.pdfDataSource;

-      si.type = ud.sig_type;

-

-      si.filename = formatFileName(ud.file_name);

-

-      si.download_inline = ud.download_inline;

-      si.pdfa = ud.pdfa;

-      si.note = ud.note;

-

-      // added tzefferer:

-      si.exappinf = exappinf;

-      si.pos = sigpos;

-      // end add

-

-      // added afitzek

-      si.startTime = startTime;

-

-      log.info("Putting signature data into session " + session.getId());

-      session.setAttribute(SessionAttributes.ATTRIBUTE_SESSION_INFORMATION, si);

-

-      // String user_name = (String)

-      // request.getSession().getAttribute(SessionAttributes.ATTRIBUTE_USER_NAME);

-      // String user_password = (String)

-      // request.getSession().getAttribute(SessionAttributes.ATTRIBUTE_USER_PASSWORD);

-      // si.user_name = user_name;

-      // si.user_password = user_password;

-

-      SignServletHelper.prepareSign(ApiHelper.getPdfAsFromContext(getServletContext()), si);

-

-      //comment out by rpiazzi because preview has now its own Servlet

-      /*if (ud.preview)

-      {

-        String submit_url = response.encodeURL(request.getContextPath() + "/SignPreview");

-        String signature_data_url = response.encodeURL(WebUtils.buildRetrieveSignatureDataURL(request, response));

-

-        request.setAttribute("submit_url", submit_url);

-        request.setAttribute("signature_data_url", signature_data_url);

-  	    if (si.mode.equals(FormFields.VALUE_MODE_TEXTUAL)){

-          request.setAttribute("document_text", ((TextBased)si.sdi.getSignatureData()).getText());

-        }

-

-        dispatch(request, response, "/jsp/signpreview.jsp");

-

-        return;

-      }*/

-

-

-      SignServletHelper.finishSign(si, request, response, getServletContext());

-

-    }

-    catch (PresentableException e)

-    {

-      log.error(e.getMessage(), e);

-      prepareDispatchToErrorPage(e, request);

-      dispatch(request, response, "/jsp/error.jsp");

-    } catch (Exception e) {

-       log.error(e.getMessage(), e);

-       PresentableException pe = new PresentableException(ErrorCode.UNKNOWN_ERROR, e);

-       prepareDispatchToErrorPage(pe, request);

-       dispatch(request, response, "/jsp/error.jsp");

-    }

-  }

-

-  // tzefferer:added

-  public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException

-  {

-	HttpSession session = request.getSession();

-	doPost(request, response);

-  }

-  // end add

-

-  protected UploadedData retrieveUploadedDataFromRequest(HttpServletRequest request) throws ServletException, UnsupportedEncodingException, FileUploadException, PDFDocumentException, IOException

-  {

-    DiskFileItemFactory fif = new DiskFileItemFactory();

-    fif.setRepository(WebSettingsReader.getTemporaryDirectory());

-    ServletFileUpload sfu = new ServletFileUpload(fif);

-

-    List items = sfu.parseRequest(request);

-

-    //FileItem preview_fi = null;

-    FileItem mode_fi = null;

-    FileItem file_upload_fi = null;

-    //FileItem download_fi = null;

-    FileItem freeText_fi = null;

-    FileItem source_fi = null;

-    FileItem sig_type_fi = null;

-    FileItem sig_app_fi = null;

-

-    boolean pdfaEnabled=false;

-    boolean noteEnabled=false;

-    String sig_type="";

-    String sig_app="";

-    String mode="";

-    String doc_file_name;

-    DataSource pdfDataSource;

-    boolean mobileTestEnabled=false;

-

-    Iterator it = items.iterator();

-    session = request.getSession(true);

-

-

-

-    //Added by rpiazzi. If servlet was called for preview data was already written into

-    //session.

-    //Now commented out because the preview function is no more supported

-    /*if ((((FileItem)items.get(0)).getFieldName().equals(SignServlet.SUBMITFORM_PREVIEW))) {

-    	FileItem fi = (FileItem)items.get(1);

-

-    	sig_app_fi = fi;

-        session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY, sig_app_fi.getString("UTF-8"));

-

-        if (((String)session.getAttribute(SUBMITFORM_PDFA_KEY))!=null) {

-	    	if (((String)session.getAttribute(SUBMITFORM_PDFA_KEY)).equals("on")) {

-    	    	pdfaEnabled = true;

-    	    }

-	    }

-	    if (((String)session.getAttribute(SUBMITFORM_NOTE_KEY))!=null) {

-	    	if (((String)session.getAttribute(SUBMITFORM_NOTE_KEY)).equals("on")) {

-    	    	noteEnabled = true;

-    	    }

-	    }

-

-    	sig_type = (String)session.getAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY);

-    	sig_app = sig_app_fi.getString("UTF-8");

-

-    	mode = (String)session.getAttribute(SUBMITFORM_SIGNATURE_MODE_KEY);

-    	doc_file_name = (String)session.getAttribute(SUBMITFORM_FILENAME_KEY);

-    	pdfDataSource = (DataSource)session.getAttribute(SUBMITFORM_FILE_KEY);

-

-    }

-    //end added

-    else {*/

-

-    //Added by rpiazzi to check wheter local bku button was hit. In this case the parameters

-    //were already put into session because before local bku, online bku has to be called

-    //and therefore this servlet was already called.

-    //First check if one submitted parameter is the local bku button.

-    boolean localFound = false;

-    int positionLocal = 0;

-    while (it.hasNext()) {

-    	if (((FileItem)it.next()).getFieldName().equals(FormFields.FIELD_CONNECTOR_LOCALBKU)) {

-    		localFound = true;

-    		break;

-    	}

-    	positionLocal++;

-    }

-

-    	if (localFound) {

-

-    		session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

-        	pdfaEnabled = "on".equalsIgnoreCase((String)session.getAttribute(SUBMITFORM_PDFA_KEY));

-        	sig_type = (String)session.getAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY);

-        	noteEnabled = "on".equalsIgnoreCase((String)session.getAttribute(SUBMITFORM_NOTE_KEY));

-

-        	session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY, "bku");

-        	sig_app = "bku";

-        	mode = (String)session.getAttribute(SUBMITFORM_SIGNATURE_MODE_KEY);

-        	doc_file_name = (String)session.getAttribute(SUBMITFORM_FILENAME_KEY);

-        	pdfDataSource = (DataSource)session.getAttribute(SUBMITFORM_FILE_KEY);

-        }

-    	//end added

-        //else get settings from form fields

-        else {

-        	session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "yes");

-        	it = items.iterator();

-        	 while (it.hasNext())

-        	    {

-        	      FileItem item = (FileItem) it.next();

-        	      log.debug("item = " + item.getFieldName()); //$NON-NLS-1$

-

-        	      if (log.isDebugEnabled())

-        	      {

-        	        if (item.isFormField())

-        	        {

-        	          String item_string = item.getString("UTF-8"); //$NON-NLS-1$

-            	      log.debug("  form field string = " + item_string); //$NON-NLS-1$

-        	        }

-        	        else

-        	        {

-        	          log.debug("  filename = " + item.getName()); //$NON-NLS-1$

-        	          log.debug("  filesize = " + item.getSize()); //$NON-NLS-1$

-        	        }

-        	      }

-

-        	      if (item.getFieldName().equals(FormFields.FIELD_SIGNATURE_TYPE))

-        	      {

-        	        sig_type_fi = item;

-        	    	session.setAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY, item.getString("UTF-8"));

-        	        sig_type=item.getString("UTF-8");

-        	        continue;

-        	      }

-

-        	      if ((item.getFieldName().equals(FormFields.FIELD_CONNECTOR_SMARTCARD)) || (item.getFieldName().equals(FormFields.FIELD_CONNECTOR_MOBILE)) || (item.getFieldName().equals(FormFields.FIELD_CONNECTOR_LOCALBKU))) {

-        	    	if (item.getFieldName().equals(FormFields.FIELD_CONNECTOR_SMARTCARD)) {

-        	    		session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY, "moc");

-        	    		sig_app = "moc";

-        	        }

-        	    	if (item.getFieldName().equals(FormFields.FIELD_CONNECTOR_MOBILE)) {

-        	    		session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY, "mobile");

-        	    		sig_app = "mobile";

-        	    	}

-        	    	if (item.getFieldName().equals(FormFields.FIELD_CONNECTOR_LOCALBKU)) {

-        	    		session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY, "bku");

-        	    		sig_app = "bku";

-        	    	}

-        	    	continue;

-        	      }

-

-        	      if (item.getFieldName().equals(FormFields.FIELD_MODE))

-        	      {

-        	        mode_fi = item;

-        	        session.setAttribute(SUBMITFORM_SIGNATURE_MODE_KEY, mode_fi.getString("UTF-8"));

-        	        continue;

-        	      }

-

-        	      if (item.getFieldName().equals(FormFields.FIELD_SOURCE_FILE))

-        	      {

-        	    	//changed by rpiazzi

-        		    //Item always contains something as it is just hidden by javascript

-        		    // because of this just set the value if not empty

-        	    	if (item!=null) {

-        	    		 file_upload_fi = item;

-        	    	}

-        	    	continue;

-

-        	      }

-

-        	      //Added by rpiazzi to ignore the form fields for the inactive mode

-        	      //but not more needed

-        	      /*if (item.getFieldName().equals(FormFields.FIELD_MODE_INACTIVE)) {

-        	    	  continue;

-        	      }*/

-        	      //end added

-

-        	      /*Commented out by rpiazzi because not more needed

-        	       * if (item.getFieldName().equals(FormFields.FIELD_DOWNLOAD))

-        	      {

-        	        download_fi = item;

-        	        continue;

-        	      }*/

-

-        	      if (FormFields.FIELD_PDFA_ENABLED.equals(item.getFieldName())) {

-        	         if (item.getString("UTF-8")!=null) {

-        	        	 session.setAttribute(SUBMITFORM_PDFA_KEY, "on");

-        	        	 pdfaEnabled=true;

-        	         }

-        	         else {

-        	        	 session.setAttribute(SUBMITFORM_PDFA_KEY, "off");

-        	        	 pdfaEnabled=false;

-        	         }

-        	         continue;

-        	      }

-

-        	      if (FormFields.FIELD_SOURCE_FREETEXT.equals(item.getFieldName())) {

-        	         freeText_fi = item;

-        	         String value = freeText_fi.getString("UTF-8");

-        	         if (value != null) {

-        	            session.setAttribute(SUBMITFORM_FREETEXT_KEY, value);

-        	         }

-        	         continue;

-        	      }

-

-        	      if (FormFields.FIELD_SOURCE.equals(item.getFieldName())) {

-        	    	 source_fi = item;

-        	    	 session.setAttribute(SUBMITFORM_SOURCE_KEY, item.getString("UTF-8"));

-        	    	 continue;

-        	      }

-

-        	      //Added by rpiazzi. Feature added for inserting note into signature block

-        	      if (FormFields.FIELD_NOTE_ENABLED.equals(item.getFieldName())) {

-        	          if (item.getString("UTF-8")!=null) {

-        	        	  session.setAttribute(SUBMITFORM_NOTE_KEY, "on");

-        	        	  noteEnabled=true;

-        	          }

-        	          else {

-        	        	  session.setAttribute(SUBMITFORM_NOTE_KEY, "off");

-        	        	  noteEnabled=false;

-        	          }

-        	    	  continue;

-        	      }

-        	      //end added

-

-        	      //Added by rpiazzi to let later jsp's know the height of the div elements

-        	      if (FormFields.FIELD_HEIGHT_SIGNDIV.equals(item.getFieldName())) {

-        	    	  session.setAttribute(HEIGHT_SIGN_DIV, item.getString("UTF-8"));

-        	    	  continue;

-        	      }

-        	      //end added

-

-        	      if (FormFields.FIELD_MOBILETEST_ENABLED.equals(item.getFieldName())) {

-        	    	  if (item.getString("UTF-8")!=null) {

-        	    		  if (item.getString("UTF-8").equals("on")) {

-        	    			  mobileTestEnabled=true;

-        	    		  }

-        	    	  }

-        	    	  continue;

-        	      }

-

-        	      throw new ServletException("Unrecognized POST data."); //$NON-NLS-1$

-

-        	    }

-

-        	 	if (sig_type_fi == null || (file_upload_fi == null && freeText_fi== null))

-        	    {

-        	      throw new ServletException("Insufficient data provided in request"); //$NON-NLS-1$

-        	    }

-

-        	    mode = mode_fi.getString("UTF-8"); //$NON-NLS-1$

-        	    if (!mode.equals(FormFields.VALUE_MODE_BINARY) && !mode.equals(FormFields.VALUE_MODE_TEXTUAL) && !mode.equals(FormFields.VALUE_MODE_DETACHED))

-        	    {

-        	      throw new ServletException("The mode '" + mode + "' is unrecognized."); //$NON-NLS-1$ //$NON-NLS-2$

-        	    }

-

-

-        	    //Commented out by rpiazzi because not more needed

-        	 	/*boolean download_inline = true;

-        	    if (download_fi.getString("UTF-8").equals(FormFields.VALUE_DOWNLOAD_ATTACHMENT)) //$NON-NLS-1$

-        	    {

-        	      download_inline = false;

-        	    }*/

-

-

-        	    // distinguish between file and freetext

-        	    if (source_fi.getString("UTF-8").equals(FormFields.VALUE_SOURCE_FILE)) {

-        	       log.debug("Processing file.");

-        	       File f = new File(file_upload_fi.getName());

-        	       doc_file_name = f.getName();

-        	       log.debug("file content type =" + file_upload_fi.getContentType()); //$NON-NLS-1$

-

-        	       String extension = VerifyServlet.extractExtension(doc_file_name);

-        	       if (extension != null && !extension.equals("pdf")) //$NON-NLS-1$

-        	       {

-        	         throw new PDFDocumentException(201, "The provided file '" + doc_file_name + "' doesn't have the PDF extension (.pdf)."); //$NON-NLS-1$//$NON-NLS-2$

-        	       }

-

-        	       if (file_upload_fi.getSize() <= 0)

-        	       {

-        	         throw new PDFDocumentException(250, "The document is empty."); //$NON-NLS-1$

-        	       }

-

-        	       try

-        	       {

-        	    	 pdfDataSource = new ByteArrayPdfDataSource(IOUtils.toByteArray(file_upload_fi.getInputStream()));

-            	     session.setAttribute(SUBMITFORM_FILE_KEY, pdfDataSource);

-            	     session.setAttribute(SUBMITFORM_FILENAME_KEY, doc_file_name);

-        	    	}

-        	       catch (IOException e)

-        	       {

-        	         throw new PDFDocumentException(201, "Couldn't store the file in the temp dir.", e);

-        	       }

-        	    } else {

-        	       log.debug("Processing free text.");

-        	       try {

-        	          byte[] freeTextPDF = IText.createPDF(freeText_fi.getString("UTF-8"), pdfaEnabled);

-        	          pdfDataSource = new ByteArrayPdfDataSource(freeTextPDF);

-        	          doc_file_name = IText.DEFAULT_FILENAME;

-        	          session.setAttribute(SUBMITFORM_FILE_KEY, pdfDataSource);

-         	          session.setAttribute(SUBMITFORM_FILENAME_KEY, doc_file_name);

-        	       } catch (DocumentException e) {

-        	          throw new PDFDocumentException(201, "Unable to create PDF document.", e);

-        	       } catch (IOException e) {

-        	          throw new PDFDocumentException(201, "Unable to create PDF document.", e);

-        	       }

-

-        	    //}

-        	    // byte[] pdf = file_upload_fi.get();

-        }

-    }

-

-

-

-

-

-

-    UploadedData ud = new UploadedData();

-

-    ud.preview = false;

-    ud.pdfa = pdfaEnabled;

-    ud.download_inline = false;

-    ud.sig_type = sig_type;

-    ud.sig_app = sig_app;

-    ud.sig_mode = mode;

-    ud.file_name = doc_file_name;

-    ud.pdfDataSource = pdfDataSource;

-    ud.note = noteEnabled;

-

-    //Added by rpiazzi

-    if (ud.note && !ud.sig_type.contains("NOTE")) {

-    	ud.sig_type += "_NOTE";

-    	session.setAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY, ud.sig_type);

-    }

-

-    if (mobileTestEnabled) {

-    	ud.mobileTestEnabled=true;

-    }

-

-    //end added

-

-    return ud;

-  }

-

-

-

-

-

-  public static void prepareDispatchToErrorPage(PdfAsException pe, HttpServletRequest request)

-  {

-    request.setAttribute("PresentableException", pe);

-//    if (pe instanceof ErrorCodeException)

-//    {

-      request.setAttribute("error", "Fehler " + pe.getErrorCode());

-

-      String cause = ErrorCodeHelper.getMessageForErrorCode(pe.getErrorCode());

-

-      if (pe instanceof ExternalErrorException)

-      {

-        ExternalErrorException eee = (ExternalErrorException) pe;

-        cause = eee.getExternalErrorCode() + ": " + eee.getExternalErrorMessage();

-      }

-      request.setAttribute("cause", cause);

-

-      if (pe.getErrorCode() == ErrorCode.PLACEHOLDER_EXCEPTION)

-      {

-        PlaceholderException phe = null;

-        if (pe instanceof PlaceholderException)

-        {

-          phe = (PlaceholderException) pe;

-        }

-        else

-        {

-          phe = (PlaceholderException) pe.getCause();

-        }

-

-        request.setAttribute("cause", "Der Platzhalter des Feldes " + phe.getField() + " ist um " + phe.getMissing() + " Bytes zu kurz. " + cause);

-      }

-

-      //Added by rpiazzi to know if error happened when request was within iframe

-      //In this case the visualization of the error has to be done differently

-      /*HttpSession session = request.getSession();

-      if (((String)session.getAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY)).equals(Constants.SIGNATURE_DEVICE_BKU)) {

-    	  request.setAttribute(ERROR_WITHIN_IFRAME, "no");

-      }

-      else {

-    	  request.setAttribute(ERROR_WITHIN_IFRAME, "yes");

-      }*/

-      //end added

-

-

-//    }

-//    else

-//    {

-//      request.setAttribute("error", "PresentableException");

-//      request.setAttribute("cause", pe.toString());

-//    }

-  }

-

-   /**

-   * Formats the file name so that it is suitable for content disposition.

-   *

-   * @param file_name

-   *          The file name.

-   * @return Returns the formatted file name.

-   */

-  public static String formatFileName(String file_name)

-  {

-	File file = new File(file_name);

-    String file_name_only = file.getName();

-    // the file_name contains \\ ==> remove them so Internet Explorer works

-    // correctly.

-    return file_name_only;

-  }

-

-

-

-

-

-  // tzefferer: added

-  public static byte[] toByteArray(InputStream inputStream) throws IOException

-  {

-

-    if (inputStream == null)

-    {

-      return null;

-    }

-

-    ByteArrayOutputStream out = new ByteArrayOutputStream(8192);

-    int n;

-    byte[] buffer = new byte[2048];

-    BufferedInputStream bufIn = new BufferedInputStream(inputStream);

-    try

-    {

-      while ((n = bufIn.read(buffer)) != -1)

-      {

-        out.write(buffer, 0, n);

-      }

-    }

-    finally

-    {

-      if (bufIn != null)

-      {

-        bufIn.close();

-      }

-    }

-    return out.toByteArray();

-  }

-

-  // end add

-

-  protected static class UploadedData

-  {

-    protected boolean preview = false;

-

-    protected boolean pdfa = false;

-

-    protected boolean download_inline = false;

-

-    protected String sig_type = null;

-

-    protected String sig_app = null;

-

-    protected String sig_mode = null;

-

-    protected String file_name = null;

-

-    protected DataSource pdfDataSource = null;

-

-    protected boolean mobileTestEnabled = false;

-

-    //added by rpiazzi

-    protected boolean note = false;

-    // protected byte[] pdf = null;

-  }

+public class SignServlet extends HttpServlet {

+

+	/**

+	 * SVUID.

+	 */

+	private static final long serialVersionUID = -4156938216903740438L;

+

+	/**

+	 * The log.

+	 */

+	private static Log log = LogFactory.getLog(SignServlet.class);

+

+	public static final String SUBMITFORM_SIGNATURE_TYPE_KEY = "signupload.jsp:signatureType";

+	public static final String SUBMITFORM_SIGNATURE_MODE_KEY = "signupload.jsp:signatureMode";

+	public static final String SUBMITFORM_SIGNATURE_DEVICE_KEY = "signupload.jsp:signatureKey";

+	public static final String SUBMITFORM_PDFA_KEY = "signupload.jsp:pdfaKey";

+	public static final String SUBMITFORM_SOURCE_KEY = "signupload.jsp:sourceKey";

+	public static final String SUBMITFORM_FREETEXT_KEY = "signupload.jsp:freeTextKey";

+	public static final String SUBMITFORM_NOTE_KEY = "signupload.jsp:noteKey";

+	public static final String SUBMITFORM_FILE_KEY = "signupload.jsp:fileKey";

+	public static final String SUBMITFORM_FILENAME_KEY = "signupload.jsp:filenameKey";

+	public static final String SUBMITFORM_PREVIEW = "signupload.jsp:previewKey";

+

+	// Added by rpiazzi to know if an error occured within IFrame because this

+	// calls for

+	// a different display of the error

+	public static final String ERROR_WITHIN_IFRAME = "error_within_iframe";

+	// Added by rpiazzi to know the height of the div's in further jsp's

+	public static final String HEIGHT_SIGN_DIV = "height_sign_div";

+	// Added by rpiazzi

+	public static HttpSession session = null;

+

+	protected void dispatch(HttpServletRequest request,

+			HttpServletResponse response, String resource)

+			throws ServletException, IOException {

+		dispatch(request, response, resource, getServletContext());

+	}

+

+	protected static void dispatch(HttpServletRequest request,

+			HttpServletResponse response, String resource,

+			ServletContext context) throws ServletException, IOException {

+		response.setContentType("text/html");

+		response.setCharacterEncoding("UTF-8");

+

+		RequestDispatcher disp = context.getRequestDispatcher(resource);

+		disp.forward(request, response);

+	}

+

+	/**

+	 * Processes the sign upload.

+	 * 

+	 * @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest,

+	 *      javax.servlet.http.HttpServletResponse)

+	 */

+	public void doPost(HttpServletRequest request, HttpServletResponse response)

+			throws ServletException, IOException {

+		UploadedData ud = null;

+		ExternAppInformation exappinf = null;

+		SignaturePositioning sigpos = null;

+

+		// for performance measurement

+		long startTime = System.currentTimeMillis();

+

+		String plain_hex_digest = null;

+		MessageDigest md = null;

+		try {

+			md = MessageDigest.getInstance("SHA-256");

+		} catch (NoSuchAlgorithmException e) {

+			// TODO Auto-generated catch block

+			e.printStackTrace();

+		}

+		

+		// check if pdf-as has been called by external webapp

+		if (request.getParameter(FormFields.FIELD_PDF_URL) != null) {

+			String preview = (String) request

+					.getParameter(FormFields.FIELD_PREVIEW);

+			String sig_type = (String) request

+					.getParameter(FormFields.FIELD_SIGNATURE_TYPE);

+			String sig_app = (String) request

+					.getParameter(FormFields.FIELD_CONNECTOR);

+			String sig_mode = (String) request

+					.getParameter(FormFields.FIELD_MODE);

+			String filename = (String) request

+					.getParameter(FormFields.FIELD_FILENAME);

+			String pdf_url = (String) request

+					.getParameter(FormFields.FIELD_PDF_URL);

+			String pdf_id = (String) request

+					.getParameter(FormFields.FIELD_PDF_ID);

+			String invoke_url = (String) request

+					.getParameter(FormFields.FIELD_INVOKE_APP_URL);

+			String invoke_error_url = (String) request

+					.getParameter(FormFields.FIELD_INVOKE_APP_ERROR_URL);

+			String session_id = (String) request

+					.getParameter(FormFields.FIELD_SESSION_ID);

+			String sig_pos_y = (String) request

+					.getParameter(FormFields.FIELD_SIGPOS_Y);

+			String sig_pos_p = (String) request

+					.getParameter(FormFields.FIELD_SIGPOS_P);

+			String sig_pos_x = (String) request

+					.getParameter(FormFields.FIELD_SIGPOS_X);

+			String sig_pos_w = (String) request

+					.getParameter(FormFields.FIELD_SIGPOS_W);

+			String note = (String) request

+					.getParameter(FormFields.FIELD_NOTE_ENABLED);

+

+			// Added by rpiazzi

+			log.debug("Received external request from "

+					+ request.getRemoteAddr());

+			log.debug("Parameter preview: " + preview);

+			log.debug("Parameter sig_type: " + sig_type);

+			log.debug("Parameter sig_app: " + sig_app);

+			log.debug("Parameter sig_mode: " + sig_mode);

+			log.debug("Parameter filename: " + filename);

+			log.debug("Parameter pdf_url: " + pdf_url);

+			log.debug("Parameter pdf_id: " + pdf_id);

+			log.debug("Parameter invoke_url: " + invoke_url);

+			log.debug("Parameter invoke_error_url: " + invoke_error_url);

+			log.debug("Parameter session_id: " + session_id);

+			log.debug("Parameter sig_pos_y: " + sig_pos_y);

+			log.debug("Parameter sig_pos_p: " + sig_pos_p);

+			log.debug("Parameter sig_pos_x: " + sig_pos_x);

+			log.debug("Parameter sig_pos_w: " + sig_pos_w);

+			log.debug("Parameter note: " + note);

+			// end added

+

+			session = request.getSession(true);

+

+			session.setAttribute(SignServlet.SUBMITFORM_FILENAME_KEY, filename);

+

+			// added by tknall

+			if (sig_pos_y != null && sig_pos_p != null && sig_pos_x != null) {

+				if (sig_pos_w != null) {

+					try {

+						sigpos = new SignaturePositioning("x:" + sig_pos_x

+								+ ";y:" + sig_pos_y + ";w:" + sig_pos_w + ";p:"

+								+ sig_pos_p);

+					} catch (PDFDocumentException e) {

+						log.warn("Unable to create signature position object: "

+								+ e.getMessage(), e);

+					}

+				} else {

+					try {

+						sigpos = new SignaturePositioning("x:" + sig_pos_x

+								+ ";y:" + sig_pos_y + ";p:" + sig_pos_p);

+					} catch (PDFDocumentException e) {

+						log.warn("Unable to create signature position object: "

+								+ e.getMessage(), e);

+					}

+				}

+			} else {

+				log.debug("No signature position provided.");

+			}

+

+			// if we already have parameters "&" must be used instead of "?"

+			String paramSeparator = (pdf_url.indexOf("?") != -1) ? "&" : "?";

+			String query = pdf_url + "/" + filename + paramSeparator

+					+ FormFields.FIELD_PDF_ID + "=" + pdf_id;

+			// query = pdf_url;

+

+			log.debug("Query string for loading pdf: " + query);

+

+			// wprinz: rem: this allocation is useless

+			// byte[] extern_pdf = new byte[Integer.parseInt(pdf_length)];

+			URL source_url = new URL(query);

+			InputStream is = source_url.openStream();

+

+			// extern_pdf = toByteArray(is);

+

+			// set UploadedData object...

+			UploadedData ud_extern = new UploadedData();

+

+			ud_extern.file_name = filename;

+			byte[] plain_pdf_data = IOUtils.toByteArray(is);

+

+			ud_extern.pdfDataSource = new ByteArrayPdfDataSource(plain_pdf_data);

+

+			ud_extern.preview = "true".equalsIgnoreCase(preview);

+			ud_extern.sig_app = sig_app;

+			ud_extern.sig_mode = sig_mode;

+			ud_extern.sig_type = sig_type;

+

+			if (note != null) {

+				if (note.equals("true")) {

+					ud_extern.note = true;

+					ud_extern.sig_type = ud_extern.sig_type + "_NOTE";

+				} else {

+					ud_extern.note = false;

+				}

+			} else {

+				ud_extern.note = true;

+				ud_extern.sig_type = ud_extern.sig_type + "_NOTE";

+			}

+

+			ud_extern.pdfa = false;

+

+			ud = ud_extern;

+

+			exappinf = new ExternAppInformation(invoke_url, pdf_id, session_id,

+					invoke_error_url);

+

+		} else {

+			try {

+				// tzefferer: modified

+				// UploadedData ud = retrieveUploadedDataFromRequest(request);

+

+				UploadedData ud_form = retrieveUploadedDataFromRequest(request);

+				ud = ud_form;

+				// end modify

+

+			} catch (PdfAsException e) {

+				log.error(e);

+

+				// Added by rpiazzi to check if this attribute is still null

+				HttpSession session = request.getSession();

+				String error_within_iframe = (String) session

+						.getAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY);

+				if (error_within_iframe == null) {

+					session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

+				}

+				// end added

+

+				prepareDispatchToErrorPage(e, request);

+				dispatch(request, response, "/jsp/error.jsp");

+

+				return;

+			} catch (FileUploadException e) {

+				log.error(e);

+

+				// Added by rpiazzi to check if this attribute is still null

+				HttpSession session = request.getSession();

+				String error_within_iframe = (String) session

+						.getAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY);

+				if (error_within_iframe == null) {

+					session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

+				}

+				// end added

+

+				request.setAttribute("error", e.getMessage());

+				request.setAttribute("cause", e.getCause());

+				request.setAttribute("resourcebundle", Boolean.TRUE);

+				dispatch(request, response, "/jsp/error.jsp");

+			} catch (IOException e) {

+				log.error(e);

+

+				// Added by rpiazzi to check if this attribute is still null

+				HttpSession session = request.getSession();

+				String error_within_iframe = (String) session

+						.getAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY);

+				if (error_within_iframe == null) {

+					session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

+				}

+				// end added

+

+				request.setAttribute("error", e.getMessage());

+				request.setAttribute("cause", e.getCause());

+				request.setAttribute("resourcebundle", Boolean.TRUE);

+				dispatch(request, response, "/jsp/error.jsp");

+			}

+		}

+		try {

+			// not needed, that is done in sign()

+			// ud.pdfDataSource = PdfAS.applyStrictMode(ud.pdfDataSource);

+

+			session = request.getSession(true);

+

+			SignSessionInformation si = new SignSessionInformation(); // SessionTable.generateSessionInformationObject();

+			si.connector = ud.sig_app;

+

+			if ((ud.mobileTestEnabled) && (si.connector.equals("mobile"))) {

+				si.connector = Constants.SIGNATURE_DEVICE_MOBILETEST;

+				session.setAttribute(

+						SignServlet.SUBMITFORM_SIGNATURE_DEVICE_KEY,

+						si.connector);

+			}

+

+			si.application = "sign";

+			si.mode = ud.sig_mode;

+			si.pdfDataSource = ud.pdfDataSource;

+			si.type = ud.sig_type;

+			if (md != null) {

+				byte[] plain_digest = md.digest(ud.pdfDataSource.getAsByteArray());

+				plain_hex_digest = Hex.encodeHexString(plain_digest);

+				log.info("Original PDF HASH Value: " + plain_hex_digest);

+				si.plainPDFDigest = plain_hex_digest;

+			}

+			

+			si.filename = formatFileName(ud.file_name);

+

+			si.download_inline = ud.download_inline;

+			si.pdfa = ud.pdfa;

+			si.note = ud.note;

+

+			// added tzefferer:

+			si.exappinf = exappinf;

+			si.pos = sigpos;

+			// end add

+

+			// added afitzek

+			si.startTime = startTime;

+

+			log.info("Putting signature data into session " + session.getId());

+			session.setAttribute(

+					SessionAttributes.ATTRIBUTE_SESSION_INFORMATION, si);

+

+			// String user_name = (String)

+			// request.getSession().getAttribute(SessionAttributes.ATTRIBUTE_USER_NAME);

+			// String user_password = (String)

+			// request.getSession().getAttribute(SessionAttributes.ATTRIBUTE_USER_PASSWORD);

+			// si.user_name = user_name;

+			// si.user_password = user_password;

+

+			SignServletHelper.prepareSign(

+					ApiHelper.getPdfAsFromContext(getServletContext()), si);

+

+			// comment out by rpiazzi because preview has now its own Servlet

+			/*

+			 * if (ud.preview) { String submit_url =

+			 * response.encodeURL(request.getContextPath() + "/SignPreview");

+			 * String signature_data_url =

+			 * response.encodeURL(WebUtils.buildRetrieveSignatureDataURL

+			 * (request, response));

+			 * 

+			 * request.setAttribute("submit_url", submit_url);

+			 * request.setAttribute("signature_data_url", signature_data_url);

+			 * if (si.mode.equals(FormFields.VALUE_MODE_TEXTUAL)){

+			 * request.setAttribute("document_text",

+			 * ((TextBased)si.sdi.getSignatureData()).getText()); }

+			 * 

+			 * dispatch(request, response, "/jsp/signpreview.jsp");

+			 * 

+			 * return; }

+			 */

+

+			SignServletHelper.finishSign(si, request, response,

+					getServletContext());

+

+		} catch (PresentableException e) {

+			log.error(e.getMessage(), e);

+			prepareDispatchToErrorPage(e, request);

+			dispatch(request, response, "/jsp/error.jsp");

+		} catch (Exception e) {

+			log.error(e.getMessage(), e);

+			PresentableException pe = new PresentableException(

+					ErrorCode.UNKNOWN_ERROR, e);

+			prepareDispatchToErrorPage(pe, request);

+			dispatch(request, response, "/jsp/error.jsp");

+		}

+	}

+

+	// tzefferer:added

+	public void doGet(HttpServletRequest request, HttpServletResponse response)

+			throws ServletException, IOException {

+		HttpSession session = request.getSession();

+		doPost(request, response);

+	}

+

+	// end add

+

+	protected UploadedData retrieveUploadedDataFromRequest(

+			HttpServletRequest request) throws ServletException,

+			UnsupportedEncodingException, FileUploadException,

+			PDFDocumentException, IOException {

+		DiskFileItemFactory fif = new DiskFileItemFactory();

+		fif.setRepository(WebSettingsReader.getTemporaryDirectory());

+		ServletFileUpload sfu = new ServletFileUpload(fif);

+

+		List items = sfu.parseRequest(request);

+

+		// FileItem preview_fi = null;

+		FileItem mode_fi = null;

+		FileItem file_upload_fi = null;

+		// FileItem download_fi = null;

+		FileItem freeText_fi = null;

+		FileItem source_fi = null;

+		FileItem sig_type_fi = null;

+		FileItem sig_app_fi = null;

+

+		boolean pdfaEnabled = false;

+		boolean noteEnabled = false;

+		String sig_type = "";

+		String sig_app = "";

+		String mode = "";

+		String doc_file_name;

+		DataSource pdfDataSource;

+		boolean mobileTestEnabled = false;

+

+		Iterator it = items.iterator();

+		session = request.getSession(true);

+

+		// Added by rpiazzi. If servlet was called for preview data was already

+		// written into

+		// session.

+		// Now commented out because the preview function is no more supported

+		/*

+		 * if ((((FileItem)items.get(0)).getFieldName().equals(SignServlet.

+		 * SUBMITFORM_PREVIEW))) { FileItem fi = (FileItem)items.get(1);

+		 * 

+		 * sig_app_fi = fi;

+		 * session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY,

+		 * sig_app_fi.getString("UTF-8"));

+		 * 

+		 * if (((String)session.getAttribute(SUBMITFORM_PDFA_KEY))!=null) { if

+		 * (((String)session.getAttribute(SUBMITFORM_PDFA_KEY)).equals("on")) {

+		 * pdfaEnabled = true; } } if

+		 * (((String)session.getAttribute(SUBMITFORM_NOTE_KEY))!=null) { if

+		 * (((String)session.getAttribute(SUBMITFORM_NOTE_KEY)).equals("on")) {

+		 * noteEnabled = true; } }

+		 * 

+		 * sig_type =

+		 * (String)session.getAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY); sig_app

+		 * = sig_app_fi.getString("UTF-8");

+		 * 

+		 * mode = (String)session.getAttribute(SUBMITFORM_SIGNATURE_MODE_KEY);

+		 * doc_file_name =

+		 * (String)session.getAttribute(SUBMITFORM_FILENAME_KEY); pdfDataSource

+		 * = (DataSource)session.getAttribute(SUBMITFORM_FILE_KEY);

+		 * 

+		 * } //end added else {

+		 */

+

+		// Added by rpiazzi to check wheter local bku button was hit. In this

+		// case the parameters

+		// were already put into session because before local bku, online bku

+		// has to be called

+		// and therefore this servlet was already called.

+		// First check if one submitted parameter is the local bku button.

+		boolean localFound = false;

+		int positionLocal = 0;

+		while (it.hasNext()) {

+			if (((FileItem) it.next()).getFieldName().equals(

+					FormFields.FIELD_CONNECTOR_LOCALBKU)) {

+				localFound = true;

+				break;

+			}

+			positionLocal++;

+		}

+

+		if (localFound) {

+

+			session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "no");

+			pdfaEnabled = "on".equalsIgnoreCase((String) session

+					.getAttribute(SUBMITFORM_PDFA_KEY));

+			sig_type = (String) session

+					.getAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY);

+			noteEnabled = "on".equalsIgnoreCase((String) session

+					.getAttribute(SUBMITFORM_NOTE_KEY));

+

+			session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY, "bku");

+			sig_app = "bku";

+			mode = (String) session.getAttribute(SUBMITFORM_SIGNATURE_MODE_KEY);

+			doc_file_name = (String) session

+					.getAttribute(SUBMITFORM_FILENAME_KEY);

+			pdfDataSource = (DataSource) session

+					.getAttribute(SUBMITFORM_FILE_KEY);

+		}

+		// end added

+		// else get settings from form fields

+		else {

+			session.setAttribute(SignServlet.ERROR_WITHIN_IFRAME, "yes");

+			it = items.iterator();

+			while (it.hasNext()) {

+				FileItem item = (FileItem) it.next();

+				log.debug("item = " + item.getFieldName()); //$NON-NLS-1$

+

+				if (log.isDebugEnabled()) {

+					if (item.isFormField()) {

+						String item_string = item.getString("UTF-8"); //$NON-NLS-1$

+						log.debug("  form field string = " + item_string); //$NON-NLS-1$

+					} else {

+						log.debug("  filename = " + item.getName()); //$NON-NLS-1$

+						log.debug("  filesize = " + item.getSize()); //$NON-NLS-1$

+					}

+				}

+

+				if (item.getFieldName().equals(FormFields.FIELD_SIGNATURE_TYPE)) {

+					sig_type_fi = item;

+					session.setAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY,

+							item.getString("UTF-8"));

+					sig_type = item.getString("UTF-8");

+					continue;

+				}

+

+				if ((item.getFieldName()

+						.equals(FormFields.FIELD_CONNECTOR_SMARTCARD))

+						|| (item.getFieldName()

+								.equals(FormFields.FIELD_CONNECTOR_MOBILE))

+						|| (item.getFieldName()

+								.equals(FormFields.FIELD_CONNECTOR_LOCALBKU))) {

+					if (item.getFieldName().equals(

+							FormFields.FIELD_CONNECTOR_SMARTCARD)) {

+						session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY,

+								"moc");

+						sig_app = "moc";

+					}

+					if (item.getFieldName().equals(

+							FormFields.FIELD_CONNECTOR_MOBILE)) {

+						session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY,

+								"mobile");

+						sig_app = "mobile";

+					}

+					if (item.getFieldName().equals(

+							FormFields.FIELD_CONNECTOR_LOCALBKU)) {

+						session.setAttribute(SUBMITFORM_SIGNATURE_DEVICE_KEY,

+								"bku");

+						sig_app = "bku";

+					}

+					continue;

+				}

+

+				if (item.getFieldName().equals(FormFields.FIELD_MODE)) {

+					mode_fi = item;

+					session.setAttribute(SUBMITFORM_SIGNATURE_MODE_KEY,

+							mode_fi.getString("UTF-8"));

+					continue;

+				}

+

+				if (item.getFieldName().equals(FormFields.FIELD_SOURCE_FILE)) {

+					// changed by rpiazzi

+					// Item always contains something as it is just hidden by

+					// javascript

+					// because of this just set the value if not empty

+					if (item != null) {

+						file_upload_fi = item;

+					}

+					continue;

+

+				}

+

+				// Added by rpiazzi to ignore the form fields for the inactive

+				// mode

+				// but not more needed

+				/*

+				 * if

+				 * (item.getFieldName().equals(FormFields.FIELD_MODE_INACTIVE))

+				 * { continue; }

+				 */

+				// end added

+

+				/*

+				 * Commented out by rpiazzi because not more needed if

+				 * (item.getFieldName().equals(FormFields.FIELD_DOWNLOAD)) {

+				 * download_fi = item; continue; }

+				 */

+

+				if (FormFields.FIELD_PDFA_ENABLED.equals(item.getFieldName())) {

+					if (item.getString("UTF-8") != null) {

+						session.setAttribute(SUBMITFORM_PDFA_KEY, "on");

+						pdfaEnabled = true;

+					} else {

+						session.setAttribute(SUBMITFORM_PDFA_KEY, "off");

+						pdfaEnabled = false;

+					}

+					continue;

+				}

+

+				if (FormFields.FIELD_SOURCE_FREETEXT

+						.equals(item.getFieldName())) {

+					freeText_fi = item;

+					String value = freeText_fi.getString("UTF-8");

+					if (value != null) {

+						session.setAttribute(SUBMITFORM_FREETEXT_KEY, value);

+					}

+					continue;

+				}

+

+				if (FormFields.FIELD_SOURCE.equals(item.getFieldName())) {

+					source_fi = item;

+					session.setAttribute(SUBMITFORM_SOURCE_KEY,

+							item.getString("UTF-8"));

+					continue;

+				}

+

+				// Added by rpiazzi. Feature added for inserting note into

+				// signature block

+				if (FormFields.FIELD_NOTE_ENABLED.equals(item.getFieldName())) {

+					if (item.getString("UTF-8") != null) {

+						session.setAttribute(SUBMITFORM_NOTE_KEY, "on");

+						noteEnabled = true;

+					} else {

+						session.setAttribute(SUBMITFORM_NOTE_KEY, "off");

+						noteEnabled = false;

+					}

+					continue;

+				}

+				// end added

+

+				// Added by rpiazzi to let later jsp's know the height of the

+				// div elements

+				if (FormFields.FIELD_HEIGHT_SIGNDIV.equals(item.getFieldName())) {

+					session.setAttribute(HEIGHT_SIGN_DIV,

+							item.getString("UTF-8"));

+					continue;

+				}

+				// end added

+

+				if (FormFields.FIELD_MOBILETEST_ENABLED.equals(item

+						.getFieldName())) {

+					if (item.getString("UTF-8") != null) {

+						if (item.getString("UTF-8").equals("on")) {

+							mobileTestEnabled = true;

+						}

+					}

+					continue;

+				}

+

+				throw new ServletException("Unrecognized POST data."); //$NON-NLS-1$

+

+			}

+

+			if (sig_type_fi == null

+					|| (file_upload_fi == null && freeText_fi == null)) {

+				throw new ServletException(

+						"Insufficient data provided in request"); //$NON-NLS-1$

+			}

+

+			mode = mode_fi.getString("UTF-8"); //$NON-NLS-1$

+			if (!mode.equals(FormFields.VALUE_MODE_BINARY)

+					&& !mode.equals(FormFields.VALUE_MODE_TEXTUAL)

+					&& !mode.equals(FormFields.VALUE_MODE_DETACHED)) {

+				throw new ServletException(

+						"The mode '" + mode + "' is unrecognized."); //$NON-NLS-1$ //$NON-NLS-2$

+			}

+

+			// Commented out by rpiazzi because not more needed

+			/*

+			 * boolean download_inline = true; if

+			 * (download_fi.getString("UTF-8")

+			 * .equals(FormFields.VALUE_DOWNLOAD_ATTACHMENT)) //$NON-NLS-1$ {

+			 * download_inline = false; }

+			 */

+

+			// distinguish between file and freetext

+			if (source_fi.getString("UTF-8").equals(

+					FormFields.VALUE_SOURCE_FILE)) {

+				log.debug("Processing file.");

+				File f = new File(file_upload_fi.getName());

+				doc_file_name = f.getName();

+				log.debug("file content type =" + file_upload_fi.getContentType()); //$NON-NLS-1$

+

+				String extension = VerifyServlet

+						.extractExtension(doc_file_name);

+				if (extension != null && !extension.equals("pdf")) //$NON-NLS-1$

+				{

+					throw new PDFDocumentException(

+							201,

+							"The provided file '" + doc_file_name + "' doesn't have the PDF extension (.pdf)."); //$NON-NLS-1$//$NON-NLS-2$

+				}

+

+				if (file_upload_fi.getSize() <= 0) {

+					throw new PDFDocumentException(250,

+							"The document is empty."); //$NON-NLS-1$

+				}

+

+				try {

+					pdfDataSource = new ByteArrayPdfDataSource(

+							IOUtils.toByteArray(file_upload_fi.getInputStream()));

+					session.setAttribute(SUBMITFORM_FILE_KEY, pdfDataSource);

+					session.setAttribute(SUBMITFORM_FILENAME_KEY, doc_file_name);

+				} catch (IOException e) {

+					throw new PDFDocumentException(201,

+							"Couldn't store the file in the temp dir.", e);

+				}

+			} else {

+				log.debug("Processing free text.");

+				try {

+					byte[] freeTextPDF = IText.createPDF(

+							freeText_fi.getString("UTF-8"), pdfaEnabled);

+					pdfDataSource = new ByteArrayPdfDataSource(freeTextPDF);

+					doc_file_name = IText.DEFAULT_FILENAME;

+					session.setAttribute(SUBMITFORM_FILE_KEY, pdfDataSource);

+					session.setAttribute(SUBMITFORM_FILENAME_KEY, doc_file_name);

+				} catch (DocumentException e) {

+					throw new PDFDocumentException(201,

+							"Unable to create PDF document.", e);

+				} catch (IOException e) {

+					throw new PDFDocumentException(201,

+							"Unable to create PDF document.", e);

+				}

+

+				// }

+				// byte[] pdf = file_upload_fi.get();

+			}

+		}

+

+		UploadedData ud = new UploadedData();

+

+		ud.preview = false;

+		ud.pdfa = pdfaEnabled;

+		ud.download_inline = false;

+		ud.sig_type = sig_type;

+		ud.sig_app = sig_app;

+		ud.sig_mode = mode;

+		ud.file_name = doc_file_name;

+		ud.pdfDataSource = pdfDataSource;

+		ud.note = noteEnabled;

+

+		// Added by rpiazzi

+		if (ud.note && !ud.sig_type.contains("NOTE")) {

+			ud.sig_type += "_NOTE";

+			session.setAttribute(SUBMITFORM_SIGNATURE_TYPE_KEY, ud.sig_type);

+		}

+

+		if (mobileTestEnabled) {

+			ud.mobileTestEnabled = true;

+		}

+

+		// end added

+

+		return ud;

+	}

+

+	public static void prepareDispatchToErrorPage(PdfAsException pe,

+			HttpServletRequest request) {

+		request.setAttribute("PresentableException", pe);

+		// if (pe instanceof ErrorCodeException)

+		// {

+		request.setAttribute("error", "Fehler " + pe.getErrorCode());

+

+		String cause = ErrorCodeHelper

+				.getMessageForErrorCode(pe.getErrorCode());

+

+		if (pe instanceof ExternalErrorException) {

+			ExternalErrorException eee = (ExternalErrorException) pe;

+			cause = eee.getExternalErrorCode() + ": "

+					+ eee.getExternalErrorMessage();

+		}

+		request.setAttribute("cause", cause);

+

+		if (pe.getErrorCode() == ErrorCode.PLACEHOLDER_EXCEPTION) {

+			PlaceholderException phe = null;

+			if (pe instanceof PlaceholderException) {

+				phe = (PlaceholderException) pe;

+			} else {

+				phe = (PlaceholderException) pe.getCause();

+			}

+

+			request.setAttribute("cause",

+					"Der Platzhalter des Feldes " + phe.getField() + " ist um "

+							+ phe.getMissing() + " Bytes zu kurz. " + cause);

+		}

+

+		// Added by rpiazzi to know if error happened when request was within

+		// iframe

+		// In this case the visualization of the error has to be done

+		// differently

+		/*

+		 * HttpSession session = request.getSession(); if

+		 * (((String)session.getAttribute

+		 * (SUBMITFORM_SIGNATURE_DEVICE_KEY)).equals

+		 * (Constants.SIGNATURE_DEVICE_BKU)) {

+		 * request.setAttribute(ERROR_WITHIN_IFRAME, "no"); } else {

+		 * request.setAttribute(ERROR_WITHIN_IFRAME, "yes"); }

+		 */

+		// end added

+

+		// }

+		// else

+		// {

+		// request.setAttribute("error", "PresentableException");

+		// request.setAttribute("cause", pe.toString());

+		// }

+	}

+

+	/**

+	 * Formats the file name so that it is suitable for content disposition.

+	 * 

+	 * @param file_name

+	 *            The file name.

+	 * @return Returns the formatted file name.

+	 */

+	public static String formatFileName(String file_name) {

+		File file = new File(file_name);

+		String file_name_only = file.getName();

+		// the file_name contains \\ ==> remove them so Internet Explorer works

+		// correctly.

+		return file_name_only;

+	}

+

+	// tzefferer: added

+	public static byte[] toByteArray(InputStream inputStream)

+			throws IOException {

+

+		if (inputStream == null) {

+			return null;

+		}

+

+		ByteArrayOutputStream out = new ByteArrayOutputStream(8192);

+		int n;

+		byte[] buffer = new byte[2048];

+		BufferedInputStream bufIn = new BufferedInputStream(inputStream);

+		try {

+			while ((n = bufIn.read(buffer)) != -1) {

+				out.write(buffer, 0, n);

+			}

+		} finally {

+			if (bufIn != null) {

+				bufIn.close();

+			}

+		}

+		return out.toByteArray();

+	}

+

+	// end add

+

+	protected static class UploadedData {

+		protected boolean preview = false;

+

+		protected boolean pdfa = false;

+

+		protected boolean download_inline = false;

+

+		protected String sig_type = null;

+

+		protected String sig_app = null;

+

+		protected String sig_mode = null;

+

+		protected String file_name = null;

+

+		protected DataSource pdfDataSource = null;

+

+		protected boolean mobileTestEnabled = false;

+

+		// added by rpiazzi

+		protected boolean note = false;

+		// protected byte[] pdf = null;

+	}

 

 }

-

diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/session/SignSessionInformation.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/session/SignSessionInformation.java
index 11efbc1..ed05715 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/session/SignSessionInformation.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/session/SignSessionInformation.java
@@ -187,4 +187,6 @@ public class SignSessionInformation implements HttpSessionBindingListener, Seria
     log.debug("Unbound SignSessionInformation from session (ID=" + event.getSession().getId() + ").");

 

   }

+  

+  public String plainPDFDigest;

 }