Add more filters templates that are not in the right directory.

JavaSource/gov/noaa/pmel/tmap/iosp/FerretDataSource.java

@@ -57,6 +57,12 @@ public NetcdfFile getNetcdfFile(HttpServletRequest req, HttpServletResponse res)
         	url = urlbuf.toString();
         }
 
+        // Are there still escaped curly braces?
+        // Sometimes the client encodes a URL that is already encoded.
+        while ( url.contains("%7B") || url.contains("%7D") ) {
+            url = URLDecoder.decode(url, "UTF-8");
+        }
+
         log.debug("building netcdf file from "+url);
 
         String base = getBaseURL(url);

JavaSource/gov/noaa/pmel/tmap/las/filter/RequestInputFilter.java

@@ -313,7 +313,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
             	response.sendError(HttpServletResponse.SC_NOT_FOUND, "Request contains an illegal query parameter.");
             	return;
             }
-            if ( !validateTemplates(request) ) {
+            if ( !validateTemplateAndImage(request) ) {
 				LASAction.logerror(request, "Illegal request parameter value.", "Request contains a parameter value that is not allowed.");
 				response.sendError(HttpServletResponse.SC_NOT_FOUND, "Request contains an illegal query parameter value.");
 				return;
@@ -390,7 +390,12 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
 
 	private boolean validPath(HttpServletRequest request) {
 		String v = request.getRequestURI();
-		if (v.toLowerCase().contains(">") || v.toLowerCase().contains("<") || (v.toLowerCase().contains("script") && !v.contains("JavaScript"))) {
+		if (v.toLowerCase().contains(">") ||
+                v.toLowerCase().contains("<") ||
+                v.toLowerCase().contains("meta") ||
+                v.toLowerCase().contains("refresh") ||
+                v.toLowerCase().contains("equiv") ||
+                (v.toLowerCase().contains("script") && !v.contains("JavaScript"))) {
 		    return false;
 		}
 		if ( v.endsWith(".vm") ) {
@@ -405,7 +410,7 @@ private boolean validPath(HttpServletRequest request) {
 		return true;
 	}
 
-	public boolean validateTemplates(HttpServletRequest request) {
+	public boolean validateTemplateAndImage(HttpServletRequest request) {
 		String value[] = request.getParameterValues("template");
 		if ( value != null ) {
             for (int i = 0; i < value.length; i++) {
@@ -414,10 +419,39 @@ public boolean validateTemplates(HttpServletRequest request) {
                     v.toLowerCase().contains("<") || 
                     v.toLowerCase().contains("script") || 
                     v.toLowerCase().contains("..") ) {
+                if ( v.equals(vm[i]) ) {
+                    return true;
+                }
+                if (v.toLowerCase().contains(">") ||
+						v.toLowerCase().contains("<") ||
+						v.toLowerCase().contains("script") ||
+						v.toLowerCase().contains("meta") ||
+						v.toLowerCase().contains("refresh") ||
+						v.toLowerCase().contains("equiv")
+				) {
+>>>>>>> 9afbb8887c0051a06c31109e97022991c57db476
                     return false;
                 }
             }
         }
+		String images[] = request.getParameterValues("image");
+		if ( images != null ) {
+			for (int i = 0; i < images.length; i++) {
+				String v = images[i];
+				if (v.toLowerCase().contains(">") ||
+						v.toLowerCase().contains("<") ||
+						v.toLowerCase().contains("script") ||
+						v.toLowerCase().contains("meta") ||
+						v.toLowerCase().contains("refresh") ||
+						v.toLowerCase().contains("equiv")
+				) {
+					return false;
+				}
+				if ( !v.endsWith("plot_image.png") ) {
+					return false;
+				}
+			}
+		}
 		return true;
 	}
 	public void init(FilterConfig arg0) throws ServletException {

JavaSource/gov/noaa/pmel/tmap/las/ui/GetAnnotations.java

@@ -15,6 +15,7 @@
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import ucar.ma2.Array;
 
 /** 
  * MyEclipse Struts
@@ -63,7 +64,7 @@ public String execute() throws Exception {
 		}
 		String[] files = request.getParameterValues("file");
 		String[] images = request.getParameterValues("image");
-		
+
 		if ( files != null ) {
 			if ( files.length == 1 ) {			
 				LASAnnotations lasAnnotations = new LASAnnotations();
@@ -123,4 +124,4 @@ public String getTemplate() {
 	public void setTemplate(String template) {
 		this.template = template;
 	}
-}
+}