From 7ec85cbf997f9fbaaa19f0ed2945fa50a4ee6159 Mon Sep 17 00:00:00 2001
From: Naoki Takezoe <takezoe@gmail.com>
Date: Fri, 29 Apr 2016 12:52:10 +0900
Subject: [PATCH] Add error checking for data import

---
 .../core/controller/FileUploadController.scala    | 11 ++++++++---
 .../twirl/gitbucket/core/admin/data.scala.html    | 15 +++++++++++----
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/src/main/scala/gitbucket/core/controller/FileUploadController.scala b/src/main/scala/gitbucket/core/controller/FileUploadController.scala
index fe9b456c4..f52491ae6 100644
--- a/src/main/scala/gitbucket/core/controller/FileUploadController.scala
+++ b/src/main/scala/gitbucket/core/controller/FileUploadController.scala
@@ -10,6 +10,7 @@ import gitbucket.core.util.Implicits._
 import org.eclipse.jgit.api.Git
 import org.eclipse.jgit.dircache.DirCache
 import org.eclipse.jgit.lib.{FileMode, Constants}
+import org.scalatra
 import org.scalatra._
 import org.scalatra.servlet.{MultipartConfig, FileUploadSupport, FileItem}
 import org.apache.commons.io.{IOUtils, FileUtils}
@@ -80,9 +81,13 @@ class FileUploadController extends ScalatraServlet with FileUploadSupport with R
   post("/import") {
     session.get(Keys.Session.LoginAccount).collect { case loginAccount: Account if loginAccount.isAdmin =>
       execute({ (file, fileId) =>
-        import JDBCUtil._
-        val conn = request2Session(request).conn
-        conn.importAsXML(file.getInputStream)
+        if(file.getName.endsWith(".xml")){
+          import JDBCUtil._
+          val conn = request2Session(request).conn
+          conn.importAsXML(file.getInputStream)
+        } else {
+          throw new RuntimeException("Import is available for only the XML file.")
+        }
       }, _ => true)
     }
     redirect("/admin/data")
diff --git a/src/main/twirl/gitbucket/core/admin/data.scala.html b/src/main/twirl/gitbucket/core/admin/data.scala.html
index 44f590fdf..4fcbde6af 100644
--- a/src/main/twirl/gitbucket/core/admin/data.scala.html
+++ b/src/main/twirl/gitbucket/core/admin/data.scala.html
@@ -30,10 +30,10 @@
     </div>
 
     <div class="panel panel-default">
-      <div class="panel-heading strong">Import</div>
+      <div class="panel-heading strong">Import (only XML)</div>
       <div class="panel-body">
-        <form class="form form-horizontal" action="@path/upload/import" method="POST" enctype="multipart/form-data">
-          <input type="file" name="file">
+        <form class="form form-horizontal" action="@path/upload/import" method="POST" enctype="multipart/form-data" id="import-form">
+          <input type="file" name="file" id="file">
           <input type="submit" class="btn btn-success pull-right" value="Import" id="import">
         </form>
       </div>
@@ -42,7 +42,14 @@
 }
 <script>
 $(function(){
-  $('#import').click(function(){
+  $('#import-form').submit(function(){
+    if(!$('#file').val() == ''){
+      alert('Choose an import XML file.');
+      return false;
+    } else if(!$('#file').val().endsWith(".xml")){
+      alert('Import is available for only the XML file.');
+      return false;
+    }
     return confirm('All existing data is deleted before importing.\nAre you sure?');
   })
 })