security-context.xml

xssRequestFilter, csrfRequestMatcher, noSessionManageRequest에 모두 등록할 필요 없다.

1. SharedController.java

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.core.io.InputStreamResource;
import org.springframework.http.ResponseEntity;


    @Inject
    private CipherUtil cipherUtil;

    @Inject
    AttachService attachService;


    /**
     * 외부에서 파일다운로드
     *
     * @author : 
     * @param : param
     * @return : Response
     * @Date : 
     * @Method Name : download
     */
    @RequestMapping(value="/outer/download.do")
    public ResponseEntity<InputStreamResource> download(HttpServletRequest request, HttpServletResponse response)
    {
        String _queryString = request.getQueryString();
        
        try
        {
            if (StringUtils.isNotEmpty(_queryString))
            {
                //_queryString = cipherUtil.decrypt(_queryString);
                
                String[] param = _queryString.split("=");
                
                if (param.length == 2)
                {
                    String key     = param[0];
                    String value   = param[1];
                    
                    if ("id".equals(key))
                    {
                        return attachService.download(value);
                    }
                }
            }
        }
        catch (Exception e)
        {
            e.printStackTrace();
        }
        
        return new ResponseEntity(HttpStatus.BAD_REQUEST);
    }

2. SharedService.java

import java.net.URLEncoder;

import smartsuite.security.core.crypto.CipherUtil;
import smartsuite.upload.core.entity.FileItem;
import smartsuite.upload.core.entity.FileList;
import smartsuite.upload.core.service.FileService;


    @Value("#{globalProperties['bp.url']}")
    private String bpUrl;

    @Inject
    FileItemEncryptor encryptor;

    @Inject
    FileService fileService;

    /**
     * 첨부파일 외부접근 다운로드 링크 만들기
     * 
     * @author : 
     * @param param the param
     * @return the list
     * @Date : 2023.8.8
     * @Method Name : getDownloadUrl
     */
    public List<Map<String, Object>> getDownloadUrl(String grpCd)
    {
        List<Map<String, Object>> downloadUrls = Lists.newArrayList();
        
        try
        {
            FileList _fileList = fileService.findList(grpCd);
            
            for (FileItem fileItem : _fileList.getItems())
            {
                String _queryString = String.format("id=%s", URLEncoder.encode(fileItem.getId(), "UTF-8"));
                
                //_queryString = cipherUtil.encrypt(_queryString)
                
                String _downloadUrl = String.format("%s%s?%s", bpUrl, "/outer/download.do", _queryString);
                String _fileName    = fileItem.getName();
                
                Map<String, Object> _file = Maps.newHashMap();
                _file.put(_fileName, _downloadUrl);
                
                downloadUrls.add(_file);
            }
            
        }
        catch (Exception e)
        {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        
        return downloadUrls;
    }

3. AttachService.java

import java.net.URLEncoder;

import org.apache.commons.io.FileUtils;
import org.springframework.core.io.InputStreamResource;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.util.MultiValueMap;

import smartsuite.upload.core.config.SMARTSuiteUploadConfiguration;
import smartsuite.upload.core.entity.FileItem;
import smartsuite.upload.core.service.FileService;
import smartsuite.upload.core.util.MIMETypeUtil;


    @Inject
    FileService fileService;
    
    @Inject
    MIMETypeUtil mimeTypeUtil;
    
    @Inject
    private SMARTSuiteUploadConfiguration smartSuiteUploadConfiguration;


    /**
     * 첨부파일 다운로드
     *
     * @author : 
     * @param : param
     * @return : Response
     * @Date : 
     * @Method Name : download
     */
    public ResponseEntity<InputStreamResource> download(String id) throws Exception
    {
        FileItem fileItem = fileService.findDownloadItem(id);
        String downloadFileName = fileItem.getName(); 
        String encodedFileName = URLEncoder.encode(downloadFileName, "UTF-8").replaceAll("\\+", "%20");
        boolean isInMemoryStream = smartSuiteUploadConfiguration.getIsInMemoryStream();
        boolean isDBMS = fileItem.getReference().equalsIgnoreCase("dbms");
        InputStreamResource resource = null;
        if (isInMemoryStream || isDBMS) {
          resource = new InputStreamResource(fileItem.toInputStream());
        } else {
          resource = new InputStreamResource(FileUtils.openInputStream(fileItem.getFile()));
        } 
        HttpHeaders responseHeaders = new HttpHeaders();
        responseHeaders.set("Content-Length", String.valueOf(fileItem.getSize()));
        responseHeaders.set("Content-Type", this.mimeTypeUtil.mimeTypeForFileExtension(fileItem.getExtension()) + "; charset=UTF-8");
        responseHeaders.set("Content-Disposition", "attachment; filename=\"" + encodedFileName + "\"; filename*=UTF-8''" + encodedFileName);
        responseHeaders.set("file-name", encodedFileName);
        return new ResponseEntity(resource, (MultiValueMap)responseHeaders, HttpStatus.OK);
    }