make upload in examlpe web-file-browser work

Author: zjiuyang

examples/web-file-browser/src/main/java/com/dropbox/core/examples/web_file_browser/DropboxBrowse.java

@@ -18,6 +18,7 @@
 import com.dropbox.core.v2.files.LookupError;
 import com.dropbox.core.v2.files.Metadata;
 
+import javax.servlet.MultipartConfigElement;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -240,6 +241,8 @@ public void doBrowse(HttpServletRequest request, HttpServletResponse response)
     public void doUpload(HttpServletRequest request, HttpServletResponse response)
             throws IOException, ServletException
     {
+        MultipartConfigElement multipartConfigElement = new MultipartConfigElement("/tmp");
+        request.setAttribute("org.eclipse.multipartConfig", multipartConfigElement);
         if (!common.checkPost(request, response)) return;
         User user = common.requireLoggedInUser(request, response);
         if (user == null) return;
@@ -323,7 +326,13 @@ private static String slurpUtf8Part(HttpServletRequest request, HttpServletRespo
         byte[] bytes = new byte[maxLength];
         InputStream in = part.getInputStream();
         int bytesRead = in.read(bytes);
+
+        if (in.read() == -1) {
+            return "";
+        }
+
         String s = StringUtil.utf8ToString(bytes, 0, bytesRead);
+
         if (in.read() != -1) {
             response.sendError(400, "Field " + jq(name) + " is too long (the limit is " + maxLength + " bytes): " + jq(s));
             return null;

examples/web-file-browser/src/main/java/com/dropbox/core/examples/web_file_browser/FormProtection.java

@@ -1,8 +1,11 @@
 package com.dropbox.core.examples.web_file_browser;
 
+import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.Part;
 
+import java.io.IOException;
 import java.io.PrintWriter;
 import static org.apache.commons.lang3.StringEscapeUtils.escapeHtml4;
 
@@ -54,10 +57,12 @@ public void insertAntiCsrfFormField(PrintWriter out)
     // Call this when handling any form POST request.  If it returns
     // null, the CSRF token is ok.  If it returns some other string,
     // display that error message to the user.
-    public static String checkAntiCsrfToken(HttpServletRequest request)
+    public static String checkAntiCsrfToken(HttpServletRequest request) throws IOException, ServletException
     {
-        String antiCsrfToken = request.getParameter("anti-csrf-token");
-        if (antiCsrfToken == null) {
+        if (request.getContentType() != null &&
+            request.getContentType().toLowerCase().indexOf("multipart/form-data") > -1 &&
+            request.getPart("anti-csrf-token") == null ||
+            request.getParameter("anti-csrf-token") == null) {
             return "missing \"" + antiCsrfTokenName + "\" POST parameter";
         }